# Automatic Hybrid Attack Graph (AHAG) Generation for Complex Engineering Systems +
## 1 Introduction
### Related Work  
Existing Attack graph generation tools can be summarized as follows [21]. One research implemented a tool that consisted of three main pieces: a model builder (it takes as input information about network topology, configuration, and a library of attack rules), an attack graph generator (SPIN), and a Graphical User Interface (GUI) for graphical presentation. Topological Vulnerability Analysis (TVA), Network Security Planning Architecture (NETSPA), and Multi-host Multi-stage Vulnerability Analysis (MULVAL) tools [22]. These tools can explore all potential methods an attacker can use to corrupt an enterprise network by determining the configuration information of the hosts and the network. The Cauldron tool implemented by [23] automatically mapped all paths of vulnerability by correlating, aggregating, normalizing, and fusing data from various assets. The Network Attack Graph GENeration (Naggen) tool is developed by [24] to generate attack graph. Other research [5] has illustrated how logical attack graph complexity can be simply elevated when a network becomes denser and larger [25]. They utilized the MULVAL tool, but they changed its engine so that the trace of evaluation was recorded and sent to a graph builder. In [26], the New Symbolic Model Checker (NuSMV) model checker was implemented to develop Attack graph counterexamples. The value iteration method was also implemented to determine the reliability of Attack graph, which allowed designers to identify which nominal set of security defenses would assure systems safety. A model-checking-based Automated Attack Graph Generator and Visualizer (A2G2V) was proposed by [27]. The proposed A2G2V algorithm used existing model-checking tools, an architecture description tool, and C code to generate an attack graph that enumerates the set of all possible sequences in which atomic-level vulnerabilities can be exploited to compromise system security. The A2G2V tool required building three main functions: a counterexample parsing function, a cyclic testing function, and a Luster model editing function. In [28], a heuristic algorithm was used to automatically determine the optimal security hardening through cost-benefit analysis [29]. They used multiple algorithms, such as Vulnerability Node Matching, Attack Graph Optimization, Maximum Loss Flow, Path Seeking, and Multi-Objective Augmented Road Sorting, to investigate the vulnerability, estimate the global path, and determine the optimal attack path. The surveys conducted by [30; 31] illustrated the state-of-the-art technologies in Attack graph construction in computer networks, and their potential development challenges. Alerts were also analyzed from intrusion detection system, and how well the approaches scaled to larger networks. A Hybrid Attack Graph (HAG) was modeled by [32], using linguistics and type extensions of traditional attack graph given the necessary inputs of asset, topology, and fact declarations in the typed grammar. The HAG was illustrated through an example of an attacker who is trying to compromise an automotive car by forcing it to drivetoward a wall. The tool automates the task of creating HAGs by compiling the inputs specified and making the appropriate connections. A Hybrid Attack Dependency Graph (HADG) was presented by [33], which allowed discretization into intervals of the reachable and related ranges of the system's state variables and their evolution over the execution of attacks with duration. The HAG generation software of [33] was used by [34] to model a Cyber physical System's attack for a smart grid in which an attacker has to obtain access to a Supervisory Control and Data Acquisition (SCADA) system to cause the transformer to overheat. Thus, transformer temperature was the continuous value in question and was discretized into intervals. The HAG was built by matching exploit patterns to a particular system state.