It Is Well Known That IT Security Risk Assessment Is A Vital And Sometimes Regularity Mandated: Method For Attack Tree Data Transformation Assignment, VU, Australia

 Introduction

It is well known that IT security risk assessment is a vital and sometimes regulatorily mandated process that helps in identifying risks; prioritizing protective measures; and protecting customers, businesses, and private information.

Expert systems play a crucial role in taking the knowledge from a security expert, expressed as rules, and allowing it to be shared effortlessly. Many authors emphasize that expert systems are adequate for automating risk assessments, thereby minimizing the need for a company to have a security expert. This is of great importance for small-medium-sized enterprises that lack human and financial resources.

Although the concept of expert systems is not new and is widely used in many areas, their application in the information security area, including risk analysis, is relatively new; i.e., expert systems and methods of their optimization, including methods of automated knowledge base formation, remain a relevant research topic due to a big dynamics and many method application perspectives.

Sometimes it becomes a problem since high-quality knowledge is expensive. On the other hand, there exist many sources of systematic information that can be used for knowledge base creation, which can minimize the process expenses at least partially.

The idea of automating knowledge base formation is relatively new; still, some research on the area was already done, and currently, proposed methods have demonstrated the possibility and benefits of such an approach.

In our previous research, methods for transformation of ontologies into expert system (ES) knowledge base format and integration of data from websites on regional malware distribution for further use in the expert system-based risk analysis were discussed.

Attack trees can assist in the IT risk analysis process by providing a structure to contemplate an attack against a system; i.e., attack trees provide a formal, methodical way of describing the security of systems, based on varying attacks, which can be very useful while evaluating possible threats and their probabilities during the risk assessment.

The primary purpose of attack trees is to model security threats, represent attacks against a system, and analyze attack vectors. Some researchers have demonstrated that attack trees can be used as a supportive tool in the fields of defense and vulnerability detection.

Attack trees are also successfully used in information security risk analysis, and design processes of security and defense systems and their analysis. The versatility of attack trees and their wide areas of application have allowed making an assumption that attack trees can be considered as a reliable source of information that can be applied for increasing the efficiency of expert systems. This paper proposes the idea of using attack trees for IT security risk analysis by converting them into ES knowledge base rules.

By developing a process that streamlines the risk assessment process via expert systems, risk analysis can be brought into a more affordable place for small and medium enterprise (SME) category businesses and individuals while simultaneously increasing the accuracy of the risk assessment process for everyone, especially SMEs that cannot afford to hire high-quality security
experts for risk analysis.

Under current methods, a cybersecurity professional, when using an attack tree, is required to painstakingly proceed through several attack trees to perform a risk analysis for a system or to base his decision on a subjective valuation.

This is a task that can take a considerable amount of time and effort, as an expert will have to spend his time going through every attack route possible within the attack trees, some of which can have thousands of nodes.

Solving the problem of converting attack trees to formats that an expert system can utilize will help reduce the labor costs associated with performing risk assessments. The creation of a knowledge base should provide a higher level of information security, since countless examples of attack trees already exist, with varying levels of detail and complexity, targeted against different information systems and platforms. Utilizing an expert system for this process would also ensure accuracy, reliability, and repeatability for the risk
analyses conducted.

By converting attack trees to formats usable by expert systems, the benefits of attack trees and expert systems can be combined and multiplied. Moreover, crucially, this method allows the use of existing resources and repositories of attack trees to assist in building a wide knowledge base.