Skip to content

Latest commit

 

History

History
29 lines (24 loc) · 1.66 KB

README.md

File metadata and controls

29 lines (24 loc) · 1.66 KB

PT to AT

Attack Tree Generation via Process Mining: From Process Trees to Attack Trees

This work provides a method for the semi-automatic generation of Attack Trees using process mining. The main concept is applying Process Mining to attack logs and deriving a Process Tree from them. Then we define rules for translating a Process Tree to an Attack Tree.

Features

  • Derive a Process Tree directly from an event log which describes the behavior of an attacker
  • Translate the Process Tree into an Attack Tree, in the RisQFLan format

Implementation

PTtoAT is implemented as a Python application. The main script PTtoAT.py is composed by the following steps:

  • Import the log file and derive a Process Tree using the Inductive Miner, or import directly a Process Tree file
  • Translate the Process Tree into an Attack Tree
  • Convert the AttackTree into RISQFlan code

Usage/Example

The implemented script can derive an Attack Tree directly from the input event log (in xes format), or translate a Process Tree into an Attack Tree. The following is the format of the execution, where:

  • filename is the filename of the log file (withouth extension, in xes format), or the filename of the Process Tree file (withouth extension, in xml format)
  • code [1,2], where 1 indicates the translation from an event log, 2 indicates the translation from a Process Tree
python PTtoAT.py filename code

A sample log (.xes) file is provided, which can be used to run the script using the following command:

python PTtoAT.py Example 1

The script will save the Process Tree file in .xml, the Attack Tree file in .xml and the RISQFlan file in .bbt