## 4 Numerical Examples and Their Analysis  
The purpose of this section is to illustrate the implementation of the proposed algorithm on various attack graphs and to investigate its characteristics. The analysis of the obtained results accompanies the solution of numerical examples. We start with a simple cycle-free AND/OR attack graph, where only the edges are weighted with their times (durations) (see Example 1). Then, in Example 2, we add weights to the nodes while keeping the attack graph acyclic, and in Example 3, we add cycles to the weighted graph. The  
Figure 1: The flow chart of the proposed algorithm. implementation of the algorithm on the unweighted cycle graph is presented in Example 4. Example 5 shows the case when the attack graph with a cycle does not contain a solvable attack path. Note that the times on nodes and arcs, i.e., \(\pi_{j}\) and \(\tau_{kj}\), respectively, in all examples are expressed in minutes. These times were obtained from the CVSS (Common Vulnerability Scoring System [49]) and expert assessments, which were then converted into minutes. **Example 1**. : _This example of the AND/OR attack graph under consideration is adapted from [41] and is shown in Figure 2a. The corresponding graph includes five main nodes, numbered from **2** to **6**, with these numbers shown in bold italics inside the nodes. The edges are equipped with known times (durations) marked in blue._  
The node _Start_ is an auxiliary node. Among the nodes in Figure 2a, three AND nodes are exploits (shown as ovals) and two OR nodes are conditions (shown as diamonds). The attacker starts from the _Start_ node, and his/her goal is to gain access to the target node **3** in the shortest time. The proposed algorithm provides the solution presented in Table 1. The rows in Table 1 correspond to the cyclically repeated Steps 1-3 of the algorithm; the columns correspond to the nodes. In the cells of Table 1, we place temporal or permanent time values for the nodes produced by the algorithm. The algorithm solves this example step by step as follows. It starts with the initialization step, in which it assigns a permanent time \(t_{S}=0\) to the Start node and temporal times (\"temporal labels\") \(u_{i}=\infty\) to all OR nodes; then, the Start node is added to the set \(\mathbb{F}\), which stores all nodes with permanent (i.e., minimal) completion times. Next, in Step 1, the algorithm searches for and scans AND nodes for which all predecessors are in the set \(\mathbb{F}\) \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Step** & **Node** & _Start_ & **2** & **3** & **4** & **5** & **6** \\ \hline Initial & \(t_{S}=0\) & & & & \(u_{5}=\infty\) & \(u_{6}=\infty\) \\ (1) & & \(t_{2}=2\) & & & \(u_{5}=4\) & \(u_{6}=3\) \\ (2) & & & & & \(t_{6}=3\) \\ (3) & & & \(t_{3}=6\) & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Solution to Example 1. Figure 2: (a) Example 1 adapted from [41]. (b) Extracted minimum-length attack path. Since node 2 in this example has only one predecessor, the node Start, which is already in \(\mathbb{F}\), a permanent label for node 2 is calculated according to (4), and this node is added to \(\mathbb{F}\) (see the row labeled (1) in the third line of Table 1). The given time parameters are used as follows. According to (4), the permanent time label \(t_{2}\) for node 2 is calculated as follows: \(t_{2}:=t_{s}+\tau_{s2}+\tau_{2}=2\), where \(t_{s}=0\); \(\tau_{s2}=2\); and \(\tau_{2}=0\). At this step, we consider that node 2 has only one predecessor. Note that two other AND nodes, 3 and 4, do not yet have all their predecessors in \(\mathbb{F}\), so they cannot receive a permanent label at this step, and therefore the algorithm goes to Step 2. In Step 2, the temporal time labels \(u_{i}\) for the OR nodes are calculated according to (5) and (6) (see row (2) of Table 1). For instance, the temporal time for node 6 is calculated as follows: \(u_{6}:=t_{2}+\tau_{26}+\tau_{6}=3\), where \(t_{2}=2\), \(\tau_{26}=1\), and \(\tau_{6}=0\).