Ansys medini analyze supports the calculation of attack paths based on the scenario descriptions given in an attack tree. The result of that calculation is shown in a separate viewer.
Every single calculated attack path contains all those events that, when executed all together by an attacker, will lead to the top-level threat. The attack path forms the basis for the estimation of the feasibility or potential of a threat or a threat scenario.
The calculation is initiated by calling "Calculate Attack Paths..." from the context menu of a top-level or intermediate event of the attack tree either in the Model Browser or in the diagram.
An options dialog is opened where you can restrict the resulting set of attack paths to those that only contain the given maximum number of attack events. This might significantly speed up the calculation of the paths if you choose smaller numbers.
As a result, a new viewer (read-only editor) will open in medini analyze that shows the results:
Please note that you can also call "Calculate Attack Paths..." from any intermediate event node in the attack tree. In this case, however, the calculation is done only for the sub-tree starting at that selected event.
You can browse the results in different pages of the viewer:
Attack Paths
This view shows the different attack paths as a list of attack events. Using the "Highlight Attack Path Events" from the context menu of a row in the table you can easily identify the set of events of an attack path in the graphical editor for the attack tree.
Events
This view shows all events participating in an attack path and for each event the information in how many paths it occurs.
Please note that you can also save the results of an attack path calculation by clicking on the "Save Attack Paths" button in the attack path viewer. After giving a name to the results, they will be shown in the Model Browser and can be reopened at a later point in time. After saving, the attack paths could be linked into a Threat Assessment Table in order to ease the estimation of the feasibility. Also profile properties can be edited to e.g. add documentation to the results.