The commonly used flaw hypothesis model (FHM) for performing penetration tests provides only limited, highlevel guidance for the derivation of actual penetration attempts. In this paper, a mechanism for the systematic modeling, simulation, and exploitation of complex multistage and multi-agent vulnerabilities in networked and distributed systems based on stochastic and interval-timed colored Petri nets is described and analyzed through case studies elucidating several properties of Petri net variants and their suitability to modeling this type of attack.
Citation:
Ole Martin Dahl, Stephen D. Wolthusen, "Modeling and Execution of Complex Attack Scenarios using Interval Timed Colored Petri Nets," iwia, pp.157-168, Fourth IEEE International Workshop on Information Assurance (IWIA'06), 2006