Skip to content

Attack Graph Analysis

Model — instantiates Conjunctive Path Assurance

Maps the multi-step routes an adversary can chain from an entry point to a protected asset, exposing the sequences of conditions that make a whole attack conduct.

Most conjunctive-hazard tools ask which conditions might line up by coincidence. Attack Graph Analysis asks a sharper question: which conditions can an intelligent adversary deliberately line up? It builds a graph whose nodes are states an attacker can occupy — a foothold, a stolen credential, a privilege — and whose edges are actions that move the attacker from one state to the next, each conditional on a precondition (an unpatched service, a reused password, a flat network segment). Its defining move is treating the conjunction as goal-directed: the adversary chooses and sequences the edges, so the analysis must enumerate reachable end-to-end routes from an entry point to the crown-jewel asset, not just tally independent weaknesses. The output is the set of complete attack paths and, crucially, the chokepoints where breaking one edge severs many of them.

Example

A retailer wants to know how an outsider could reach its customer database. The graph starts the adversary at "internet, no access" and grows forward: a phishing email lands a foothold on a marketing workstation (precondition: user opens attachment); credential-dumping yields a service account (precondition: local admin, unpatched OS); that account logs into a file server (precondition: password reuse); a known privilege-escalation bug there grants domain admin (precondition: missing patch); domain admin reaches the database. Three complete routes emerge; the shortest needs only those four hops, all currently open. The graph shows that segmenting the flat network breaks a hop shared by all three routes at once — one control that leaves no complete path standing. Patching the workstation, by contrast, only closes one route.

How it works

Nodes are attacker states (privileges, positions, held credentials); edges are actions, each carrying a precondition that must hold and a postcondition it establishes. The graph is grown forward from assumed entry points — or backward from the target asset — until routes connect the two. Each route is a conjunction of conditions the attacker must satisfy in sequence. Routes are then ranked by attacker effort, likelihood, or stealth, and the analysis looks for edges whose removal cuts the most routes. What distinguishes it from a failure-side model is the adversary: edges are available moves, not random faults, so the search is over what a capable, motivated opponent can assemble.

Tuning parameters

  • Attacker model — the assumed starting foothold, skill, resources, and goal. A stronger adversary reveals more routes but can balloon the graph; the model is the single biggest determinant of what you find.
  • Enumeration scope and depth — how many hops deep and which assets are in scope. Deeper finds convoluted routes; shallower stays tractable but may miss the long way around.
  • Edge admissibility — what counts as an available move (only known-exploitable CVEs, or also misconfigurations, social engineering, physical access, insider action). Broader realism, bigger graph.
  • Ranking metric — order routes by hop count, exploit difficulty, or detectability, depending on whether you are prioritizing patching, hardening, or monitoring.

When it helps, and when it misleads

Its strength is that it captures the assembled conjunction an adversary builds on purpose, and it exposes chokepoint edges where one control severs many routes — far better leverage than patching leaves alone. Its failure mode is state-space explosion in a real network, and completeness bounded by the move catalog: an exploit or path you did not model is simply an edge you did not draw, so "no path found" can breed false confidence. The classic misuse is running it backwards — grooming the model until it shows no path, to bless the controls already in place. The discipline is to red-team for moves outside the model, keep the technique catalog current, and read "no path" as "no path we modeled."[1]

How it implements the components

  • adversarial_path_search_boundary — the attacker model (entry points, goal asset, admissible moves) defines and bounds the search.
  • state_conditional_causal_graph — nodes are attacker states and edges are condition-gated actions: the graph is the state-conditional causal model.
  • path_enumeration_scope — it fixes how many routes and how many hops to enumerate between entry and asset.

It does not run the common_driver_and_independence_check that tests whether its edges share a driver — that is the Common-Cause Dependency Audit — nor the probabilistic_dependence_profile that quantifies route likelihood (Scenario or Monte Carlo Joint-State Sampling); and the path_break_or_interlock_requirement that severs a route belongs to Independent Interlock or Guard.

Notes

"No path found" means no path in the modeled move set — it is only as strong as the catalog of edges the analyst thought to include. An attack graph is best kept live and paired with adversarial red-teaming, whose job is precisely to discover the edge nobody drew.

References

[1] Curated catalogs of real adversary techniques — MITRE ATT&CK is the widely-used one — supply the admissible-move set an attack graph is built from, which is why the graph's completeness tracks the currency and breadth of that catalog rather than the analyst's imagination alone. ↩