Security Evaluation of Cyber-Physical Systems Using Automatically Generated Attack Trees

  • Laurens LemaireEmail author
  • Jan Vossaert
  • Bart De Decker
  • Vincent Naessens
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10707)


The security of cyber-physical systems (CPS) is often lacking. This abstract presents a methodology that performs a security evaluation of these systems by automatically generating attack trees based on the system model. The assessor can define different kinds of attackers and see how the attack tree is evaluated with respect to a specific type of attacker. Optimal attacker strategies are calculated and from here the most vulnerable elements of the system can be derived.


Cyber-physical systems Attack trees Security assessment 


  1. 1.
    Cherdantseva, Y., et al.: A review of cyber security risk assessment methods for scada systems. Comput. Secur. 56, 1–27 (2016)CrossRefGoogle Scholar
  2. 2.
    ENISA. Protecting industrial control systems: Recommendations for Europe and member states (2011)Google Scholar
  3. 3.
    Friedenthal, S., Moore, A., Steiner, R.: A Practical Guide to SysML: The Systems Modeling Language. Morgan Kaufmann, Burlington (2014)Google Scholar
  4. 4.
    Lee, E.A.: Cyber physical systems: design challenges. In: 2008 11th IEEE International Symposium on Object Oriented Real-Time Distributed Computing (ISORC), pp. 363–369. IEEE (2008)Google Scholar
  5. 5.
    Lemaire, L., Lapon, J., De Decker, B., Naessens, V.: A SysML extension for security analysis of industrial control systems. In: Proceedings of the 2nd International Symposium for ICS & SCADA Cyber Security Research, p. 1 (2014)Google Scholar
  6. 6.
    Stouffer, K., Lightman, S., Pillitteri, V., Abrams, M., Hahn, A.: Guide to industrial control systems (ICS) security (2015)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  • Laurens Lemaire
    • 1
    Email author
  • Jan Vossaert
    • 1
  • Bart De Decker
    • 2
  • Vincent Naessens
    • 1
  1. 1.MSEC, iMinds-DistriNet, Department of Computer ScienceKU LeuvenGhentBelgium
  2. 2.iMinds-DistriNet, Department of Computer ScienceKU LeuvenHeverleeBelgium

Personalised recommendations