Fuzzy Attack Tree: Assessing Cyberattack Risk Using Attack Tree and Fuzzy Logic

Organisations and users have been experiencing significant rises in cyberattacks and their severity, which means that they require a greater awareness and understanding of the anatomy of cyberattacks, to prevent and mitigate their effects. In analysing cyberattacks, there are a number of different approaches that may be used to assess their potential risks and effects. However, these are utilised in specific types of cyberattacks and their analysis, which means they cannot be applied in every situation or cyberattack. Moreover, several other factors may influence the decision to use these approaches, such as cost, complexity, skills and adaptability. As a result, continuous research to design and enhance these approaches is undertaken to produce a generic, cost-effective, easy and adaptable approach. This paper presents one such approach to assess the risk of cyberattacks utilising an attack tree and fuzzy logic. An attack tree is a systematic and illustrative method for describing an attack on a system and analysing its taxonomy and other aspects. Subsequently, the probability and risk of each leaf node in the attack tree are calculated using the proposed formulas. Finally, fuzzy logic enables decision making based on imprecise data and heuristics to obtain the overall risk of attack. This proposed approach comprises systematic steps to accomplish an assessment of any cyberattack and its associated risks in an uncomplicated and effective manner, enabling its prevention and mitigation to be determined. The paper illustrates an application of the proposed approach to assess the risk of an information theft attack on an organisation, which can then be utilised to assess the risk of other cyberattacks.