# Automatic Hybrid Attack Graph (AHAG) Generation for Complex Engineering Systems +
## 5 Automatic Hybrid Attack Graph (AHAG) Tool  
In Section 2, the attack scenarios were generated by repeatedly running AGREE, and updating the security property in every run to exclude the previously generated attack scenarios. Here, the automatic generation of attack scenarios is presented. The Automatic Hybrid Attack Graph (AHAG) tool was developed through NetBeans, an Integrated Development Environment (IDE) for Java [44]. _NetBeans_ allows applications to be developed from a set of modular software components called modules. In addition to Java development, NetBeans has extensions for other languages like Personal Home Page (PHP), C, C++, and fifth version of Hyper Text Markup Language (HTML5). Maven, a build automation tool used primarily for Java projects, was selected as the main project for the AHAG tool in NetBeans [45]. When running an AGREE based JKind model-checker for Lustre models within Osate2, it can only produce one counterexample at a time. However, if executed more than once, it may repeat the same counterexample. The AHAG tool shown in Figure 4 confirms that a different new counterexample is produced (if exists) each time the JKind is called, and automatically, all possible attack scenarios are visualized using Unity software. AHAG tool takes only the first Lustre model (a translation of the system model and the security property from AGREE). Then, it generates all possible combinations of potential attack scenarios (i.e., CEs) as (.lus) format files. Next, AHAG communicates with the model checker JKind through the Command Prompt Commands (CMD) to iteratively check the system model and the potential CE against the security property within the Lustre files. Doing so, AHAG generates all corresponding results as separate Excel files, illustrating if the potential CE is truly an attack scenario or not. Once all Excel files are generated, AHAG converts them to (.csv) files to be used later along with LoR values in Unity Visualizer. The AHAG Algorithm 2 is as follows. The user inserts the first Lustre Model as input and defines the attack instances/actions constituting the attack paths in a single-dimensional array. In addition to that, the user has to choose the maximum expected length \(n\) of an attack scenario. AHAG in turns, generates all potential combinations of attack scenarios \(A^{n}\), where \(A\) is number of attack instances/actions. Each new potential attack scenario is stored as a variable CE_1 within (.lus) generated files. Next, JKind is called iteratively to check these files against the security property \(\phi\). If CE_1 violates the security property, then it is a true attack scenario, which belongs to the Attack graph, and the result is given as an Excel sheet (.lskx). Otherwise, AHAG will reject the CE_1. Afterward, since it is easier for Unity visualizer to read (.csv) files, AHAG converts xlsx to csv files and feed them to Unity. Figure 4: _AHAG_ Workflow. AADL: Architecture Analysis & Design Language. The generated attack scenarios were visualized using Unity visualizer tool and the Levels-of-Resilience values, including Level-of-Stability-Reduction (LoS\({}_{R}\)), Level-of-Performance-Reduction (LoP\({}_{R}\)) in the networks applications (given by \(FTP_{R}\), \(Email_{R}\), and \(Video_{R}\)), and the Recovery-Time (RT) are annotated to the attack scenarios terminating at the final states using Algorithm 1. This generates the HAG for \(CN_{1}\) and \(CN_{2}\), as shown in Figures 5 and 6, respectively. It can be seen that Attack scenario \(S_{4}\) was chosen as the worst attack scenario (highlighted in red). The detailed computations of Levels-of-Resilience values for networks \(CN_{1}\) and \(CN_{2}\) are given in [43], and [15]. By comparing the generated HAGs to the traditional Attack graphs of Figures 2 and 3, respectively, it is clear how HAG can aid in differentiating attack scenarios terminating in the same state, yet with distinguishable resilience levels. Thus, network designers can have a better overview on the attack scenario that the network is most vulnerable to.