# Automatic Hybrid Attack Graph (AHAG) Generation for Complex Engineering Systems +
## 2 Model-Based Attack Graph Implementation  
### Networked Systems Examples  
The two images of Figure 1a,b show two communication networks with identical clients and services (Email, File Transfer Protocol (FTP), and Video), but with different topologies [15]. In both networks, the routers \(R_{1}\), \(R_{2}\), and \(R_{3}\) are built with Routing Protocol (RIP) [37], where the traffic is rerouted under faults as a recovery action through a redundant path (if it exists) based on hop count [37]. In addition to that, \(R_{1}\) is linked to three Local Area Networks (_LANs_); \(LAN_{1}\), \(LAN_{2}\), and \(LAN_{3}\), where every \(LAN\) has 10 clients. \(R_{2}\) is linked to \(LAN_{4}\), which has 10 clients as well. Router \(R_{3}\) has three more links, which connect it, respectively, to an Email server through the Internet, an FTP server, and a Video workstation. The second communication network, \(CN_{2}\), has similar clients and services as \(CN_{1}\), but has a different topology.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline  & **Main Characteristics** & **Limitations** \\ \hline \multirow{6}{*}{Hybrid Attack Dependency Graph (HADG) [33]} & \(\bullet\) & Replaces the state transition graph with a dependency graph. & \(\bullet\) & The process for generating HADGs must be articulated and formalized and its performance characterized to better handle continuous variables. \\  & \(\bullet\) & A hybrid attack takes a range of real values as preconditions and output a range of values as postconditions. & \(\bullet\) & Expansion of the exploit list and the asset parameters in the network file is required to fully explore the attack space. \\  & \(\bullet\) & Provids the capability of modeling continuous state variables and their evolution over the execution of attacks with duration. & \(\bullet\) & The number of time steps in the Markov Chain model per unit time in the PLADD model must be specified by a domain expert. \\  & \(\bullet\) & Hybrid Attack Model (HAM) consists of both Probabilistic Learning Attacker, Dynamic Defender (PLADD) nodes and Markov state nodes. & \(\bullet\) & The number of time steps in the Markov Chain model per unit time in the PLADD model must be specified by a domain expert. \\  & \(\bullet\) & The attacker must have control over all PLADD nodes, which represent the preparation for an attack, to be able to execute an attack by traversing through the Markov states. & \(\bullet\) & The PLADD and the Markov Chain models do not have the means to run a simulation where the time-to-completion of an action for attacker and defender can be significantly different in the preparation stage and the execution stage. \\  & \(\bullet\) & Stateful graph. & \(\bullet\) & Requires comprehensive overview of the system model and security/resiliency property. \\  & \(\bullet\) & Specifies attack patterns as sets of preconditions and postcondition. & \(\bullet\) & Requires comprehensive overview of the system model and security/resiliency property. \\  & \(\bullet\) & The integration of level of resilience values captures the system response under sequential attack and recovery actions. & \(\bullet\) & Levels-of-Resilience values need to be determined under attacks. \\ \hline \hline \end{tabular}
\end{table}
Table 1: _Cont._