## 1 Introduction  
It is well known that IT security risk assessment is a vital and sometimes regulatorily mandated process which helps in identifying risks; prioritizing protective measures; and protecting customers, businesses, and private information. Expert systems play a crucial role in taking the knowledge from a security expert, expressed as rules, and allowing it to be shared effortlessly. Many authors [1; 2; 3] emphasize that expert systems are adequate for automating risk assessments, thereby minimizing the need for a company to have a security expert. This is of great importance for small-medium sized enterprises that lack human and financial resources. Although the concept of expert systemsis not new and is widely used in many areas [4; 5], their application in information security area, including risk analysis [6], is relatively new; i.e., expert systems and methods of their optimization, including methods of automated knowledge base formation, remain a relevant research topic due to a big dynamics and many method application perspectives [7; 8]. Sometimes it becomes a problem, since high-quality knowledge is expensive. On the other hand, there exist many sources of systematic information that can be used for knowledge base creation, which can minimize the process expenses at least partially. The idea of automating knowledge base formation is relatively new; still, some research on the area was already done, and currently, proposed methods have demonstrated the possibility and benefits of such an approach. In our previous research, methods for transformation of ontologies into expert system (ES) knowledge base format [9] and integration of data from websites on regional malware distribution [10] for further use in the expert system-based risk analysis were discussed. Attack trees can assist in the IT risk analysis process by providing a structure to contemplate an attack against a system; i.e., attack trees provide a formal, methodal way of describing the security of systems, based on varying attacks, which can be very useful while evaluating possible threats and their probabilities during the risk assessment. The primary purpose of attack trees is to model security threats, represent attacks against a system, and analyze attack vectors. Some researchers have demonstrated [11; 12; 13; 14] that attack trees can be used as a supportive tool in the fields of defense and vulnerability detection. Attack trees are also successfully used in information security risk analysis [15], and design processes of security and defense systems [16] and their analysis [17]. The versatility of attack trees and their wide areas of application have allowed making an assumption that attack trees can be considered as a reliable source of information that can be applied for increasing the efficiency of expert systems. This paper proposes the idea of using attack trees for IT security risk analysis by converting them into ES knowledge base rules. By developing a process which streamlines the risk assessment process via expert systems, risk analysis can be brought into a more affordable place for small and medium enterprise (SME) category businesses and individuals while simultaneously increasing the accuracy of the risk assessment process [1; 18] for everyone, especially SMEs that cannot afford to hire high-quality security experts for risk analysis. Under current methods, a cybersecurity professional, when using an attack tree, is required to painstakingly proceed through several attack trees to perform a risk analysis for a system or to base his decision on a subjective valuation. This is a task that can take a considerable amount of time and effort, as an expert will have to spend his time going through every attack route possible within the attack trees, some of which can have thousands of nodes [19]. Solving the problem of converting attack trees to formats that an expert system can utilize will help reduce the labor costs associated with performing risk assessments.