## 5 A Case Study  
In this section, we study a more realistic example of an attack graph of larger size with actual data and an attack on a network with AND/OR nodes. The example is adapted from [20] and shown in Figure 7.  
The attacker's target in Figure 7 is node G. As we argued in the Introduction, the AND nodes correspond to exploits, representing the specific actions or steps an attacker must take to exploit a vulnerability within the system. The OR nodes are associated with privileges, representing the conditions that must be satisfied or acquired during the attack. These privileges involve gaining certain access rights or control over a part of the system. The description of the conditions is given in Table 6. The description of the AND nodes is presented in Table 7. Note that the meaning of vulnerabilities and the CVE codes in columns #2-#3 in Table 7 are borrowed from [49]. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Node ID (\#1)** & **Node Description (\#2)** & **Compromising Time (in Minutes)** \\ \hline A & Initial access obtained (e.g., phishing, exploiting an external service) & 30 \\ B & Privilege escalation & 15 \\ C & Gained Remote Code Execution (RCE) privileges & 60 \\ D & Gaining access to restricted or high-privilege resources & 15 \\ E & Execution of unauthorized or harmful operations & 20 \\ F & Gaining administrative privileges & 1 \\ G & Stealing sensitive data & 30 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The list of OR nodes used in the attack graph presented in Figure 7. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Node ID (\#1)** & **Vulnerability (\#2)** & **CVE Reference (\#3)** & \multicolumn{3}{c}{**Compromising Time (in Minutes)**} \\ \hline
1 & Microsoft’s Windows Print Spooler service vulnerability & CVE-2021-34527 & 10 \\
2 & Windows Netlogon Service vulnerability & CVE-2020-1472 & 20 \\
3 & Remote desktop services’ vulnerability & CVE-2019-0708 & 30 \\
5 & Microsoft’s Windows certificate vulnerability & CVE-2020-0601 & 50 \\
6 & Unix mail transfer vulnerability & CVE-2018-6789 & 20 \\
7 & Microsoft’s Windows SMB protocol vulnerability & CVE-2017-0144 & 10 \\
8 & Enterprise network infrastructure vulnerability & CVE-2021-22986 & 45 \\
9 & HTTP Protocol vulnerability & CVE-2021-31166 & 60 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The list of exploits used in the attack graph presented in Figure 7.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Step**Node** & **Start** & **2** & **3** & **5** & **6** & **7** \\ \hline Initial & \(t_{S}=0\) & & & \(u_{5}=\infty\) & \(u_{6}=\infty\) & \(u_{7}=\infty\) \\ (1) & & & & \(u_{5}=9.5\) & \(u_{6}=3\) & \(u_{7}=\infty\) \\ (2) & & & & \(t_{3}=7\) &The attack graph from [20] is modified as follows: the edges and nodes are equipped with weights representing the expected action durations of the attacker (in minutes); they are obtained from the Common Vulnerability Scoring System [49] and expert assessments. Table 8 below shows the operations of the algorithm executed step by step. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Node ID** & **Vulnerability** & **CVE Reference** & **Compromising Time** \\ **(\#1)** & **(\#2)** & **(\#3)** & **(\#4)** \\ \hline
10 & Windows name resolution server vulnerability & CVE-2020-1350 & 10 \\
11 & Web application vulnerability & CVE-2017-5638 & 5 \\
12 & Microsoft.NET Framework vulnerability & CVE-2017-8759 & 60 \\
13 & Microsoft Office Memory Corruption Vulnerability & CVE-2017-11882 & 6 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: _Cont._  
Figure 7: The extended attack graph with the start node (adapted from [20]). The shortest extracted attack path is shown in a thick dashed line in Figure 8 and is as follows: AP\({}^{*}\) = {start \(\to\) 1 \(\to\) 2 \(\rightarrow\) [A\(\cup\)B] \(\to\) 3 \(\rightarrow\) C \(\rightarrow\)7 \(\rightarrow\) D\(\rightarrow\) 11 \(\rightarrow\) G}. Its duration is 295 min (see Table 8).