Pontus Svenson
Forskare
Contact Pontus
Automating the Hard Part: Linking STPA and Attack Trees
How do we analyse cyber threats in systems of systems where everything is connected? ASCHAS combines STPA with Attack Trees and explores how AI can support threat modelling, helping analysts manage complexity and scale their work. The results point toward a more automated future for cyber risk analysis.
Modern cyber threats increasingly target complex, interconnected systems rather than isolated technical components. In sectors such as transport, healthcare and energy, failures and attacks cascade across system boundaries, with potentially catastrophic consequences. At RISE, we are exploring new ways to analyse cyber risks in large, distributed socio-technical systems of systems.
In the ASCHAS project we connected two well-proven analysis methods: System-Theoretic Process Analysis (STPA) and Attack Trees. STPA is a safety analysis method based on control theory that focuses on how accidents emerge from inadequate control, unsafe interactions and missing constraints in complex systems. It provides a structured way of identifying hazards and unsafe control actions but can be cumbersome to use and requires manual work. In earlier work, RISE has explored using STPA for risk and resilience analysis, not just safety. Attack Trees are hierarchical models that describe different attack methods and how an antagonist uses them.
By investigating case studies from the transport and health-care sectors, we found that Attack Trees are a natural fit for the loss scenario generation step in the STPA process.
In parallel with the methodological work, ASCHAS also started to develop modelling tools for both STPA and Attack Trees. The tools aim to support analysts in building, maintaining and exploring models of interconnected systems and includes using generative AI for improving parts of the modelling and generating output suggestions for the user. The goal is to reduce the manual effort required, support cross-domain reasoning and make the methods more accessible to a broader group of stakeholders.
The results from ASCHAS are important because many of today’s critical systems are analysed using methods that are still heavily manual and difficult to scale. STPA offers a potentially powerful way to understand security in interconnected systems, but its practical use is often limited by the effort required to generate and analyse large numbers of scenarios. The results of the ASCHAS pre-study indicates that some of the steps in this process can be automated.
STPA provides a powerful framework for analysing interconnected systems, but it is still largely qualitative and manual. The connection to Attack Trees offers one possible way of scaling the analysis to larger distributed systems.
