## 1 Introduction
For instance, nodes in EDG can represent privileges, vulnerabilities, and host machines, among others (see [12; 13; 14; 15; 16; 17]). However, the analysis and comparison of these interpretations are beyond the scope of this work. Each exploit node in EDG can be interpreted as describing an AND combination of its preconditions, and a condition node corresponds to an OR combination of its preceding exploit nodes. In simple terms, each exploit node is of type AND, and each condition node is an OR node in this formal model. The edges in the EDG lead from condition nodes to exploit nodes or from exploit nodes to condition nodes. Thus, the exploit-dependency graph can be viewed as a bipartite AND/OR graph. To address a combinatorial explosion in the number of nodes, a monotonicity assumption is introduced in [5], which states that if a network component is compromised by an attacker once, it will remain compromised then and forever after. Due to this assumption, the graph model stores exactly one node for each exploit and each security condition, resulting in an attack graph of polynomial size in the number of vulnerabilities and security conditions. This study adheres to the monotonicity assumption. A more detailed investigation of the complexity of EDG generation is beyond the scope of this study. The second popular formal model, called the AND-OR graph (AOG) [18; 19; 20; 21; 22; 23; 24; 25], is a directed graph consisting of two types of nodes: AND and OR nodes. The nodes generally represent different components of the CPS, such as host computers, sensors, routers, and controllers. In this type of graph, the nodes may also optionally represent conditions of an attack graph. If all immediately preceding nodes (subtasks) before the parent node must be accessed to achieve the attacker's goal, then such a parent node is called an AND node; in this paper, such a node will be displayed as a circle. If executing/accessing any immediately preceding node is sufficient to successfully achieve the goal of the parent node, then such a parent node is called an OR node and is represented as a diamond. The nodes are connected by edges representing possible attacker paths from node to node. The node set \(V\) in the AOG is defined as follows: \(V=s\cup\mathsf{AND}\cup\mathbb{OR}\), where the terms have the following meanings:  
* \(s\): the start node in the graph, which has no predecessors;
* \(\mathsf{AND}\): the set of AND nodes with a conjunctive relationship between their predecessors. That is, all predecessors of an AND node must be accessed before this parent node can be accessed;
* \(\mathbb{OR}\): the set of OR nodes, where at least one predecessor of such node must be accessed so the parent node can be accessed;
* A particular node, either of AND or OR type, is specified as a target of an intruder. The set of the edges is denoted by \(E\). The AOG models are beneficial in vulnerability analysis as they are suitable for semantically treating intricate logical interdependencies between CPS components. The EDGs defined above can be easily transformed into the AOGs, which are not necessarily bipartite, making them more general than the EDGs. In the following, we will focus on the cybersecurity of general non-bipartite AOGs. Specifically, our primary attention will be paid to the attack graphs containing directed cycles of positive length. Now, we highlight the role and importance of attack paths in attack graphs. Discovering (extracting) an attack path is one of the well-known and powerful tools for assessing the actual vulnerability and constitutes the primary focus of the current research. An attack path (AP) is a sequence of steps attackers can take to infiltrate computer systems and reach their target(s). It is a connected acyclic subgraph of the attack graph that typically takes the form of a chain composed of the linked exploits (AND nodes) and conditions (OR nodes).