[{"data":1,"prerenderedAt":2098},["ShallowReactive",2],{"article-\u002Finsights\u002Fbeyond-kill-chain":3,"related-\u002Finsights\u002Fbeyond-kill-chain":2097},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":19,"category":20,"tags":22,"body":25,"_type":2088,"_id":2089,"_source":2090,"_file":2091,"_stem":2092,"_extension":2093,"sitemap":2094},"\u002Finsights\u002Fbeyond-kill-chain","insights",false,"","Beyond Kill Chains: A Graph-Theoretic Framework for Attack Modeling","This article proposes a graph-theoretic framework where attack tactics form nodes in a directed graph with weighted edges representing transition probabilities and dependencies.","2025-09-25",{"name":12,"headshot":13,"role":14,"contact":15},"Levente Simon","\u002Fheadshots\u002FLS.jpeg","Creator of Dethernety",{"linkedin":16,"email":17,"twitter":18},"https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Flevente-simon\u002F","levente.simon@dether.net","https:\u002F\u002Fx.com\u002FLevente_Simon","\u002Fimages\u002Fbeyond-kill-chain-transparent.png",[21],"Thinking in Graphs",[23,24],"analysis","research",{"type":26,"children":27,"toc":2037},"root",[28,36,46,53,58,64,71,76,112,122,128,133,176,182,188,200,207,217,278,282,288,301,483,486,499,561,564,577,610,613,626,770,773,786,794,883,891,940,943,956,1020,1029,1052,1058,1063,1073,1083,1089,1094,1137,1147,1153,1158,1184,1201,1211,1217,1223,1233,1243,1261,1270,1283,1289,1298,1307,1325,1331,1340,1349,1367,1373,1379,1389,1398,1421,1429,1437,1443,1474,1480,1486,1509,1515,1521,1544,1550,1571,1577,1598,1604,1625,1631,1637,1680,1686,1729,1735,1778,1784,1790,1823,1829,1862,1868,1900,1906,1969,1975,1980,1985,1990,1995,2001,2029],{"type":29,"tag":30,"props":31,"children":33},"element","h1",{"id":32},"beyond-kill-chains-a-graph-theoretic-framework-for-attack-modeling",[34],{"type":35,"value":8},"text",{"type":29,"tag":37,"props":38,"children":39},"p",{},[40],{"type":29,"tag":41,"props":42,"children":43},"em",{},[44],{"type":35,"value":45},"From Sequential Chains to Dynamic State Machines",{"type":29,"tag":47,"props":48,"children":50},"h2",{"id":49},"abstract",[51],{"type":35,"value":52},"Abstract",{"type":29,"tag":37,"props":54,"children":55},{},[56],{"type":35,"value":57},"Traditional cybersecurity models conceptualize attacks as linear \"kill chains\" progressing through sequential phases. This article proposes a graph-theoretic framework where attack tactics form nodes in a directed graph with weighted edges representing transition probabilities and dependencies. We argue that attacks are better modeled as state machines with cycles, branches, and context-dependent transitions. This framework enables data-driven resource allocation and domain-specific security strategy optimization.",{"type":29,"tag":47,"props":59,"children":61},{"id":60},"research-motivation",[62],{"type":35,"value":63},"Research Motivation",{"type":29,"tag":65,"props":66,"children":68},"h3",{"id":67},"limitations-of-linear-models",[69],{"type":35,"value":70},"Limitations of Linear Models",{"type":29,"tag":37,"props":72,"children":73},{},[74],{"type":35,"value":75},"Current security frameworks suffer from sequential thinking:",{"type":29,"tag":77,"props":78,"children":79},"ul",{},[80,92,102],{"type":29,"tag":81,"props":82,"children":83},"li",{},[84,90],{"type":29,"tag":85,"props":86,"children":87},"strong",{},[88],{"type":35,"value":89},"Lockheed Martin Kill Chain",{"type":35,"value":91},": Assumes linear progression through reconnaissance → weaponization → delivery → exploitation → installation → command & control → actions",{"type":29,"tag":81,"props":93,"children":94},{},[95,100],{"type":29,"tag":85,"props":96,"children":97},{},[98],{"type":35,"value":99},"MITRE ATT&CK",{"type":35,"value":101},": Provides tactics and techniques but lacks formal relationship modeling",{"type":29,"tag":81,"props":103,"children":104},{},[105,110],{"type":29,"tag":85,"props":106,"children":107},{},[108],{"type":35,"value":109},"NIST Framework",{"type":35,"value":111},": Focuses on functional areas rather than attack dynamics",{"type":29,"tag":37,"props":113,"children":114},{},[115,120],{"type":29,"tag":85,"props":116,"children":117},{},[118],{"type":35,"value":119},"Core Problem",{"type":35,"value":121},": Real attacks are iterative, adaptive, and highly context-dependent. Linear models miss critical relationships and fail to prioritize defensive investments effectively.",{"type":29,"tag":65,"props":123,"children":125},{"id":124},"graph-theory-advantages",[126],{"type":35,"value":127},"Graph Theory Advantages",{"type":29,"tag":37,"props":129,"children":130},{},[131],{"type":35,"value":132},"Modeling attacks as directed graphs enables:",{"type":29,"tag":77,"props":134,"children":135},{},[136,146,156,166],{"type":29,"tag":81,"props":137,"children":138},{},[139,144],{"type":29,"tag":85,"props":140,"children":141},{},[142],{"type":35,"value":143},"Cycle detection",{"type":35,"value":145},": Lateral movement loops, persistence re-establishment",{"type":29,"tag":81,"props":147,"children":148},{},[149,154],{"type":29,"tag":85,"props":150,"children":151},{},[152],{"type":35,"value":153},"Critical path analysis",{"type":35,"value":155},": Identifying high-impact disruption points",{"type":29,"tag":81,"props":157,"children":158},{},[159,164],{"type":29,"tag":85,"props":160,"children":161},{},[162],{"type":35,"value":163},"Probabilistic reasoning",{"type":35,"value":165},": Weighting transitions based on empirical data",{"type":29,"tag":81,"props":167,"children":168},{},[169,174],{"type":29,"tag":85,"props":170,"children":171},{},[172],{"type":35,"value":173},"Context adaptation",{"type":35,"value":175},": Different edge weights for different environments",{"type":29,"tag":47,"props":177,"children":179},{"id":178},"theoretical-framework",[180],{"type":35,"value":181},"Theoretical Framework",{"type":29,"tag":65,"props":183,"children":185},{"id":184},"illustrative-example-hypothetical-attack-graph",[186],{"type":35,"value":187},"Illustrative Example: Hypothetical Attack Graph",{"type":29,"tag":37,"props":189,"children":190},{},[191,193,198],{"type":35,"value":192},"The following diagram illustrates the proposed graph-theoretic approach using MITRE ATT&CK tactics. ",{"type":29,"tag":85,"props":194,"children":195},{},[196],{"type":35,"value":197},"This is a conceptual example only",{"type":35,"value":199}," - the specific relationships and priorities shown require empirical validation and may vary significantly across environments.",{"type":29,"tag":201,"props":202,"children":206},"img",{"src":203,"alt":204,"width":205},"\u002Fimages\u002Fbeyond-kill-chain.jpg","MITRE ATT&CK Graph",800,[],{"type":29,"tag":208,"props":209,"children":211},"h4",{"id":210},"visual-legend",[212],{"type":29,"tag":85,"props":213,"children":214},{},[215],{"type":35,"value":216},"Visual Legend",{"type":29,"tag":77,"props":218,"children":219},{},[220,232,244,255,267],{"type":29,"tag":81,"props":221,"children":222},{},[223,225,230],{"type":35,"value":224},"🔴 ",{"type":29,"tag":85,"props":226,"children":227},{},[228],{"type":35,"value":229},"Red thick lines",{"type":35,"value":231},": Attack-Breaking Critical Path (relationships 1-6)",{"type":29,"tag":81,"props":233,"children":234},{},[235,237,242],{"type":35,"value":236},"🟠 ",{"type":29,"tag":85,"props":238,"children":239},{},[240],{"type":35,"value":241},"Orange thick lines",{"type":35,"value":243},": Damage Limitation Critical Path (relationships 7-8 )",{"type":29,"tag":81,"props":245,"children":246},{},[247,248,253],{"type":35,"value":236},{"type":29,"tag":85,"props":249,"children":250},{},[251],{"type":35,"value":252},"Orange normal lines",{"type":35,"value":254},": Advanced Threat Enablers (relationship 9)",{"type":29,"tag":81,"props":256,"children":257},{},[258,260,265],{"type":35,"value":259},"⚫ ",{"type":29,"tag":85,"props":261,"children":262},{},[263],{"type":35,"value":264},"Gray normal lines",{"type":35,"value":266},": Supporting Flow Relationships (relationships 10-16)",{"type":29,"tag":81,"props":268,"children":269},{},[270,271,276],{"type":35,"value":259},{"type":29,"tag":85,"props":272,"children":273},{},[274],{"type":35,"value":275},"Gray dashed lines",{"type":35,"value":277},": Supporting\u002FInformation Relationships (relationships 17-45)",{"type":29,"tag":279,"props":280,"children":281},"hr",{},[],{"type":29,"tag":208,"props":283,"children":285},{"id":284},"relationships-documentation",[286],{"type":35,"value":287},"Relationships Documentation",{"type":29,"tag":37,"props":289,"children":290},{},[291,296],{"type":29,"tag":85,"props":292,"children":293},{},[294],{"type":35,"value":295},"🔴 Attack-Breaking Critical Path (1-6)",{"type":29,"tag":41,"props":297,"children":298},{},[299],{"type":35,"value":300},"Red thick lines representing early disruption opportunities - stopping these breaks the attack",{"type":29,"tag":302,"props":303,"children":304},"ol",{},[305,338,367,396,425,454],{"type":29,"tag":81,"props":306,"children":307},{},[308,310,315,317,321,326,328,331,336],{"type":35,"value":309},"Initial Access → Execution\n",{"type":29,"tag":85,"props":311,"children":312},{},[313],{"type":35,"value":314},"Relationship",{"type":35,"value":316},": Initial Access precedes Execution",{"type":29,"tag":318,"props":319,"children":320},"br",{},[],{"type":29,"tag":85,"props":322,"children":323},{},[324],{"type":35,"value":325},"Explanation",{"type":35,"value":327},": Once attackers gain entry, their immediate priority is achieving code execution. This is the critical transition from \"foothold\" to \"active compromise.\"",{"type":29,"tag":318,"props":329,"children":330},{},[],{"type":29,"tag":85,"props":332,"children":333},{},[334],{"type":35,"value":335},"Defensive Focus",{"type":35,"value":337},": Application allowlisting, EDR behavioral monitoring, process creation monitoring",{"type":29,"tag":81,"props":339,"children":340},{},[341,343,347,349,352,356,358,361,365],{"type":35,"value":342},"Execution → Discovery\n",{"type":29,"tag":85,"props":344,"children":345},{},[346],{"type":35,"value":314},{"type":35,"value":348},": Execution initiates Discovery",{"type":29,"tag":318,"props":350,"children":351},{},[],{"type":29,"tag":85,"props":353,"children":354},{},[355],{"type":35,"value":325},{"type":35,"value":357},": Modern attacks depend heavily on discovery for effectiveness. Blind attacks rarely succeed in complex enterprise environments. Discovery immediately follows execution to map the environment.",{"type":29,"tag":318,"props":359,"children":360},{},[],{"type":29,"tag":85,"props":362,"children":363},{},[364],{"type":35,"value":335},{"type":35,"value":366},": Network scanning detection, AD enumeration monitoring, reconnaissance detection systems",{"type":29,"tag":81,"props":368,"children":369},{},[370,372,376,378,381,385,387,390,394],{"type":35,"value":371},"Discovery → Privilege Escalation\n",{"type":29,"tag":85,"props":373,"children":374},{},[375],{"type":35,"value":314},{"type":35,"value":377},": Discovery reveals paths for Privilege Escalation",{"type":29,"tag":318,"props":379,"children":380},{},[],{"type":29,"tag":85,"props":382,"children":383},{},[384],{"type":35,"value":325},{"type":35,"value":386},": Discovery activities identify privilege escalation opportunities, vulnerable services, and misconfigured systems. This intelligence directly informs escalation attempts.",{"type":29,"tag":318,"props":388,"children":389},{},[],{"type":29,"tag":85,"props":391,"children":392},{},[393],{"type":35,"value":335},{"type":35,"value":395},": Privilege enumeration detection, vulnerability scanning alerts, system hardening",{"type":29,"tag":81,"props":397,"children":398},{},[399,401,405,407,410,414,416,419,423],{"type":35,"value":400},"Privilege Escalation → Credential Access\n",{"type":29,"tag":85,"props":402,"children":403},{},[404],{"type":35,"value":314},{"type":35,"value":406},": Privilege Escalation enables Credential Access",{"type":29,"tag":318,"props":408,"children":409},{},[],{"type":29,"tag":85,"props":411,"children":412},{},[413],{"type":35,"value":325},{"type":35,"value":415},": Elevated privileges are typically required for effective credential harvesting (LSASS dumps, registry access, memory scraping). System\u002Fadmin rights unlock credential stores.",{"type":29,"tag":318,"props":417,"children":418},{},[],{"type":29,"tag":85,"props":420,"children":421},{},[422],{"type":35,"value":335},{"type":35,"value":424},": LSASS protection, credential access monitoring, privileged access management",{"type":29,"tag":81,"props":426,"children":427},{},[428,430,434,436,439,443,445,448,452],{"type":35,"value":429},"Credential Access → Lateral Movement\n",{"type":29,"tag":85,"props":431,"children":432},{},[433],{"type":35,"value":314},{"type":35,"value":435},": Credential Access enables Lateral Movement",{"type":29,"tag":318,"props":437,"children":438},{},[],{"type":29,"tag":85,"props":440,"children":441},{},[442],{"type":35,"value":325},{"type":35,"value":444},": Valid credentials are the primary method for lateral movement in enterprise environments, allowing attackers to authenticate to remote systems legitimately.",{"type":29,"tag":318,"props":446,"children":447},{},[],{"type":29,"tag":85,"props":449,"children":450},{},[451],{"type":35,"value":335},{"type":35,"value":453},": Authentication monitoring, network segmentation, just-in-time access controls",{"type":29,"tag":81,"props":455,"children":456},{},[457,459,463,465,468,472,474,477,481],{"type":35,"value":458},"Execution → Persistence\n",{"type":29,"tag":85,"props":460,"children":461},{},[462],{"type":35,"value":314},{"type":35,"value":464},": Execution establishes Persistence",{"type":29,"tag":318,"props":466,"children":467},{},[],{"type":29,"tag":85,"props":469,"children":470},{},[471],{"type":35,"value":325},{"type":35,"value":473},": After gaining code execution, attackers typically establish persistence mechanisms to maintain access across reboots, credential changes, or detection attempts.",{"type":29,"tag":318,"props":475,"children":476},{},[],{"type":29,"tag":85,"props":478,"children":479},{},[480],{"type":35,"value":335},{"type":35,"value":482},": System integrity monitoring, persistence mechanism detection, configuration baselines",{"type":29,"tag":279,"props":484,"children":485},{},[],{"type":29,"tag":37,"props":487,"children":488},{},[489,494],{"type":29,"tag":85,"props":490,"children":491},{},[492],{"type":35,"value":493},"🟡 Damage Limitation Critical Path ( 7-8 )",{"type":29,"tag":41,"props":495,"children":496},{},[497],{"type":35,"value":498},"Orange thick lines representing late-stage defense - focus when early disruption fails",{"type":29,"tag":302,"props":500,"children":502},{"start":501},7,[503,532],{"type":29,"tag":81,"props":504,"children":505},{},[506,508,512,514,517,521,523,526,530],{"type":35,"value":507},"Collection → Exfiltration\n",{"type":29,"tag":85,"props":509,"children":510},{},[511],{"type":35,"value":314},{"type":35,"value":513},": Collection precedes Exfiltration",{"type":29,"tag":318,"props":515,"children":516},{},[],{"type":29,"tag":85,"props":518,"children":519},{},[520],{"type":35,"value":325},{"type":35,"value":522},": Data must be identified, gathered, and staged before it can be stolen. This represents the direct progression from data gathering to data theft.",{"type":29,"tag":318,"props":524,"children":525},{},[],{"type":29,"tag":85,"props":527,"children":528},{},[529],{"type":35,"value":335},{"type":35,"value":531},": DLP systems, egress filtering, data staging detection",{"type":29,"tag":81,"props":533,"children":534},{},[535,537,541,543,546,550,552,555,559],{"type":35,"value":536},"Lateral Movement → Collection\n",{"type":29,"tag":85,"props":538,"children":539},{},[540],{"type":35,"value":314},{"type":35,"value":542},": Lateral Movement expands Collection opportunities",{"type":29,"tag":318,"props":544,"children":545},{},[],{"type":29,"tag":85,"props":547,"children":548},{},[549],{"type":35,"value":325},{"type":35,"value":551},": Each successful lateral movement provides access to new data repositories and expands the attacker's collection capabilities across the network.",{"type":29,"tag":318,"props":553,"children":554},{},[],{"type":29,"tag":85,"props":556,"children":557},{},[558],{"type":35,"value":335},{"type":35,"value":560},": Cross-system data access monitoring, network segmentation for data protection",{"type":29,"tag":279,"props":562,"children":563},{},[],{"type":29,"tag":37,"props":565,"children":566},{},[567,572],{"type":29,"tag":85,"props":568,"children":569},{},[570],{"type":35,"value":571},"🔵 Advanced Threat Enablers (9)",{"type":29,"tag":41,"props":573,"children":574},{},[575],{"type":35,"value":576},"Orange normal lines for sophisticated\u002Ftargeted attacks",{"type":29,"tag":302,"props":578,"children":580},{"start":579},9,[581],{"type":29,"tag":81,"props":582,"children":583},{},[584,586,590,592,595,599,601,604,608],{"type":35,"value":585},"Resource Development → Initial Access (Targeted)\n",{"type":29,"tag":85,"props":587,"children":588},{},[589],{"type":35,"value":314},{"type":35,"value":591},": Resource Development enables targeted Initial Access",{"type":29,"tag":318,"props":593,"children":594},{},[],{"type":29,"tag":85,"props":596,"children":597},{},[598],{"type":35,"value":325},{"type":35,"value":600},": Critical for targeted attacks with custom malware and infrastructure, but irrelevant for most opportunistic attacks using existing tools and techniques.",{"type":29,"tag":318,"props":602,"children":603},{},[],{"type":29,"tag":85,"props":605,"children":606},{},[607],{"type":35,"value":335},{"type":35,"value":609},": Threat intelligence, infrastructure analysis, custom signature development",{"type":29,"tag":279,"props":611,"children":612},{},[],{"type":29,"tag":37,"props":614,"children":615},{},[616,621],{"type":29,"tag":85,"props":617,"children":618},{},[619],{"type":35,"value":620},"⚫ Supporting Flow Relationships (10-16)",{"type":29,"tag":41,"props":622,"children":623},{},[624],{"type":35,"value":625},"Gray normal lines representing important operational capabilities",{"type":29,"tag":302,"props":627,"children":629},{"start":628},10,[630,650,670,690,710,730,750],{"type":29,"tag":81,"props":631,"children":632},{},[633,635,639,641,644,648],{"type":35,"value":634},"Lateral Movement → Initial Access (Internal)\n",{"type":29,"tag":85,"props":636,"children":637},{},[638],{"type":35,"value":314},{"type":35,"value":640},": Lateral Movement represents internal Initial Access",{"type":29,"tag":318,"props":642,"children":643},{},[],{"type":29,"tag":85,"props":645,"children":646},{},[647],{"type":35,"value":325},{"type":35,"value":649},": Each lateral movement to a new system essentially restarts the attack cycle internally, requiring new initial access within the compromised environment.",{"type":29,"tag":81,"props":651,"children":652},{},[653,655,659,661,664,668],{"type":35,"value":654},"Lateral Movement → Execution\n",{"type":29,"tag":85,"props":656,"children":657},{},[658],{"type":35,"value":314},{"type":35,"value":660},": Lateral Movement restarts Execution",{"type":29,"tag":318,"props":662,"children":663},{},[],{"type":29,"tag":85,"props":665,"children":666},{},[667],{"type":35,"value":325},{"type":35,"value":669},": After moving laterally to a new system, attackers must establish execution capabilities on that system to continue operations.",{"type":29,"tag":81,"props":671,"children":672},{},[673,675,679,681,684,688],{"type":35,"value":674},"Privilege Escalation → Credential Access (Enhanced)\n",{"type":29,"tag":85,"props":676,"children":677},{},[678],{"type":35,"value":314},{"type":35,"value":680},": Privilege Escalation enhances Credential Access",{"type":29,"tag":318,"props":682,"children":683},{},[],{"type":29,"tag":85,"props":685,"children":686},{},[687],{"type":35,"value":325},{"type":35,"value":689},": Beyond the primary flow, elevated privileges also enhance the scope and effectiveness of credential harvesting operations.",{"type":29,"tag":81,"props":691,"children":692},{},[693,695,699,701,704,708],{"type":35,"value":694},"Credential Access → Collection\n",{"type":29,"tag":85,"props":696,"children":697},{},[698],{"type":35,"value":314},{"type":35,"value":700},": Credential Access provides access for Collection",{"type":29,"tag":318,"props":702,"children":703},{},[],{"type":29,"tag":85,"props":705,"children":706},{},[707],{"type":35,"value":325},{"type":35,"value":709},": Valid credentials unlock access to file shares, databases, email systems, and other repositories where valuable data can be collected.",{"type":29,"tag":81,"props":711,"children":712},{},[713,715,719,721,724,728],{"type":35,"value":714},"Execution → Command and Control\n",{"type":29,"tag":85,"props":716,"children":717},{},[718],{"type":35,"value":314},{"type":35,"value":720},": Execution may establish Command and Control",{"type":29,"tag":318,"props":722,"children":723},{},[],{"type":29,"tag":85,"props":725,"children":726},{},[727],{"type":35,"value":325},{"type":35,"value":729},": Code execution capabilities are often used to establish C2 channels, download additional tools, or communicate with attacker infrastructure.",{"type":29,"tag":81,"props":731,"children":732},{},[733,735,739,741,744,748],{"type":35,"value":734},"Command and Control → Execution\n",{"type":29,"tag":85,"props":736,"children":737},{},[738],{"type":35,"value":314},{"type":35,"value":740},": Command and Control enables remote Execution",{"type":29,"tag":318,"props":742,"children":743},{},[],{"type":29,"tag":85,"props":745,"children":746},{},[747],{"type":35,"value":325},{"type":35,"value":749},": Established C2 channels allow attackers to remotely execute commands, scripts, and additional payloads throughout the compromised environment.",{"type":29,"tag":81,"props":751,"children":752},{},[753,755,759,761,764,768],{"type":35,"value":754},"Persistence → Privilege Escalation\n",{"type":29,"tag":85,"props":756,"children":757},{},[758],{"type":35,"value":314},{"type":35,"value":760},": Persistence enables sustained Privilege Escalation",{"type":29,"tag":318,"props":762,"children":763},{},[],{"type":29,"tag":85,"props":765,"children":766},{},[767],{"type":35,"value":325},{"type":35,"value":769},": Persistent access mechanisms often include privilege escalation components or provide sustained access needed for privilege escalation attempts over time.",{"type":29,"tag":279,"props":771,"children":772},{},[],{"type":29,"tag":37,"props":774,"children":775},{},[776,781],{"type":29,"tag":85,"props":777,"children":778},{},[779],{"type":35,"value":780},"⚫ Supporting\u002FInformation Relationships (17-42)",{"type":29,"tag":41,"props":782,"children":783},{},[784],{"type":35,"value":785},"Gray dashed lines representing information, protection, and facilitation",{"type":29,"tag":37,"props":787,"children":788},{},[789],{"type":29,"tag":41,"props":790,"children":791},{},[792],{"type":35,"value":793},"17-33 - Information and Intelligence Relationships",{"type":29,"tag":302,"props":795,"children":797},{"start":796},17,[798,803,808,813,818,823,828,833,838,843,848,853,858,863,868,873,878],{"type":29,"tag":81,"props":799,"children":800},{},[801],{"type":35,"value":802},"Reconnaissance → Resource Development**: Intelligence informs tool\u002Finfrastructure development",{"type":29,"tag":81,"props":804,"children":805},{},[806],{"type":35,"value":807},"Reconnaissance → Initial Access**: Identifies specific targets for compromise",{"type":29,"tag":81,"props":809,"children":810},{},[811],{"type":35,"value":812},"Resource Development → Defense Evasion**: Custom tools designed for evasion",{"type":29,"tag":81,"props":814,"children":815},{},[816],{"type":35,"value":817},"Resource Development → Execution**: Provides execution tools and payloads",{"type":29,"tag":81,"props":819,"children":820},{},[821],{"type":35,"value":822},"Initial Access → Credential Access**: Some vectors provide direct credential access",{"type":29,"tag":81,"props":824,"children":825},{},[826],{"type":35,"value":827},"Execution → Defense Evasion**: Enables evasion techniques (process hollowing, etc.)",{"type":29,"tag":81,"props":829,"children":830},{},[831],{"type":35,"value":832},"Persistence → Defense Evasion**: Persistence designed with evasion in mind",{"type":29,"tag":81,"props":834,"children":835},{},[836],{"type":35,"value":837},"Persistence → Collection**: Some persistence includes collection capabilities",{"type":29,"tag":81,"props":839,"children":840},{},[841],{"type":35,"value":842},"Defense Evasion → Credential Access**: Protects credential harvesting from detection",{"type":29,"tag":81,"props":844,"children":845},{},[846],{"type":35,"value":847},"Defense Evasion → Discovery**: Conceals discovery activities",{"type":29,"tag":81,"props":849,"children":850},{},[851],{"type":35,"value":852},"Defense Evasion → Lateral Movement**: Hides lateral movement from monitoring",{"type":29,"tag":81,"props":854,"children":855},{},[856],{"type":35,"value":857},"Defense Evasion → Collection**: Obscures data collection activities",{"type":29,"tag":81,"props":859,"children":860},{},[861],{"type":35,"value":862},"Credential Access → Discovery**: Valid credentials enable further discovery",{"type":29,"tag":81,"props":864,"children":865},{},[866],{"type":35,"value":867},"Discovery → Lateral Movement**: Identifies lateral movement targets",{"type":29,"tag":81,"props":869,"children":870},{},[871],{"type":35,"value":872},"Discovery → Collection**: Locates data repositories for collection",{"type":29,"tag":81,"props":874,"children":875},{},[876],{"type":35,"value":877},"Discovery → Command and Control**: Reveals communication channels",{"type":29,"tag":81,"props":879,"children":880},{},[881],{"type":35,"value":882},"Discovery → Credential Access**: Identifies credential stores and vaults",{"type":29,"tag":37,"props":884,"children":885},{},[886],{"type":29,"tag":41,"props":887,"children":888},{},[889],{"type":35,"value":890},"34-42 - Operational and Command Relationships",{"type":29,"tag":302,"props":892,"children":894},{"start":893},34,[895,900,905,910,915,920,925,930,935],{"type":29,"tag":81,"props":896,"children":897},{},[898],{"type":35,"value":899},"Lateral Movement → Persistence**: New systems require new persistence",{"type":29,"tag":81,"props":901,"children":902},{},[903],{"type":35,"value":904},"Lateral Movement → Discovery**: New systems provide new discovery vantage points",{"type":29,"tag":81,"props":906,"children":907},{},[908],{"type":35,"value":909},"Collection → Impact**: Collected data enables impact operations",{"type":29,"tag":81,"props":911,"children":912},{},[913],{"type":35,"value":914},"Collection → Persistence**: Large-scale collection requires persistent access",{"type":29,"tag":81,"props":916,"children":917},{},[918],{"type":35,"value":919},"Command and Control → Lateral Movement**: C2 coordinates lateral movement",{"type":29,"tag":81,"props":921,"children":922},{},[923],{"type":35,"value":924},"Command and Control → Collection**: C2 orchestrates collection activities",{"type":29,"tag":81,"props":926,"children":927},{},[928],{"type":35,"value":929},"Command and Control → Exfiltration**: C2 manages data exfiltration",{"type":29,"tag":81,"props":931,"children":932},{},[933],{"type":35,"value":934},"Command and Control → Impact**: C2 directs impact operations",{"type":29,"tag":81,"props":936,"children":937},{},[938],{"type":35,"value":939},"Exfiltration → Impact**: Data theft followed by additional impact",{"type":29,"tag":279,"props":941,"children":942},{},[],{"type":29,"tag":37,"props":944,"children":945},{},[946,951],{"type":29,"tag":85,"props":947,"children":948},{},[949],{"type":35,"value":950},"🔄 Cyclic Relationships (43-45)",{"type":29,"tag":41,"props":952,"children":953},{},[954],{"type":35,"value":955},"Gray dotted lines representing feedback loops and attack cycle restarts",{"type":29,"tag":302,"props":957,"children":959},{"start":958},43,[960,980,1000],{"type":29,"tag":81,"props":961,"children":962},{},[963,965,969,971,974,978],{"type":35,"value":964},"Lateral Movement → Discovery (Cycle)\n",{"type":29,"tag":85,"props":966,"children":967},{},[968],{"type":35,"value":314},{"type":35,"value":970},": Lateral Movement cycles back to Discovery",{"type":29,"tag":318,"props":972,"children":973},{},[],{"type":29,"tag":85,"props":975,"children":976},{},[977],{"type":35,"value":325},{"type":35,"value":979},": Each successful lateral movement opens new discovery opportunities, creating a continuous cycle of movement and exploration.",{"type":29,"tag":81,"props":981,"children":982},{},[983,985,989,991,994,998],{"type":35,"value":984},"Impact → Credential Access (Cycle)\n",{"type":29,"tag":85,"props":986,"children":987},{},[988],{"type":35,"value":314},{"type":35,"value":990},": Impact may require additional Credential Access",{"type":29,"tag":318,"props":992,"children":993},{},[],{"type":29,"tag":85,"props":995,"children":996},{},[997],{"type":35,"value":325},{"type":35,"value":999},": Certain impact operations (like domain-wide ransomware) may require additional high-privilege credentials to achieve maximum effect.",{"type":29,"tag":81,"props":1001,"children":1002},{},[1003,1005,1009,1011,1014,1018],{"type":35,"value":1004},"Impact → Reconnaissance (Cycle)\n",{"type":29,"tag":85,"props":1006,"children":1007},{},[1008],{"type":35,"value":314},{"type":35,"value":1010},": Impact may trigger new Reconnaissance",{"type":29,"tag":318,"props":1012,"children":1013},{},[],{"type":29,"tag":85,"props":1015,"children":1016},{},[1017],{"type":35,"value":325},{"type":35,"value":1019},": After successful impact, attackers may conduct new reconnaissance to identify additional targets for follow-up operations or to assess the effectiveness of their actions.",{"type":29,"tag":65,"props":1021,"children":1023},{"id":1022},"critical-disclaimers",[1024],{"type":29,"tag":85,"props":1025,"children":1026},{},[1027],{"type":35,"value":1028},"Critical Disclaimers:",{"type":29,"tag":77,"props":1030,"children":1031},{},[1032,1037,1042,1047],{"type":29,"tag":81,"props":1033,"children":1034},{},[1035],{"type":35,"value":1036},"Edge weights and relationship types are hypothetical examples requiring validation",{"type":29,"tag":81,"props":1038,"children":1039},{},[1040],{"type":35,"value":1041},"Real attack graphs will vary significantly by environment, threat actor, and context",{"type":29,"tag":81,"props":1043,"children":1044},{},[1045],{"type":35,"value":1046},"The \"high-probability transitions\" shown are research hypotheses, not proven relationships",{"type":29,"tag":81,"props":1048,"children":1049},{},[1050],{"type":35,"value":1051},"This diagram illustrates the modeling approach, not validated attack patterns",{"type":29,"tag":65,"props":1053,"children":1055},{"id":1054},"state-machine-representation",[1056],{"type":35,"value":1057},"State Machine Representation",{"type":29,"tag":37,"props":1059,"children":1060},{},[1061],{"type":35,"value":1062},"Each attack can be modeled as a finite state automaton:",{"type":29,"tag":1064,"props":1065,"children":1067},"pre",{"code":1066},"States (S): {Initial_Access, Execution, Persistence, Privilege_Escalation, ...}\nAlphabet (Σ): {Environmental_Context, Actor_Type, Target_Value, ...}\nTransition Function (δ): S × Σ → P(S) [probabilistic transitions]\nStart State (s₀): Initial_Access\nAccept States (F): {Impact, Exfiltration}\n",[1068],{"type":29,"tag":1069,"props":1070,"children":1071},"code",{"__ignoreMap":7},[1072],{"type":35,"value":1066},{"type":29,"tag":37,"props":1074,"children":1075},{},[1076,1081],{"type":29,"tag":85,"props":1077,"children":1078},{},[1079],{"type":35,"value":1080},"Key Insight",{"type":35,"value":1082},": The same attack tactic can have different transition probabilities based on context variables (environment, threat actor, target value).",{"type":29,"tag":65,"props":1084,"children":1086},{"id":1085},"edge-classification-hypothesis",[1087],{"type":35,"value":1088},"Edge Classification Hypothesis",{"type":29,"tag":37,"props":1090,"children":1091},{},[1092],{"type":35,"value":1093},"We propose classifying edges into categories based on their role in attack success:",{"type":29,"tag":302,"props":1095,"children":1096},{},[1097,1107,1117,1127],{"type":29,"tag":81,"props":1098,"children":1099},{},[1100,1105],{"type":29,"tag":85,"props":1101,"children":1102},{},[1103],{"type":35,"value":1104},"Critical Dependencies",{"type":35,"value":1106},": Target cannot be achieved without source (hard dependencies)",{"type":29,"tag":81,"props":1108,"children":1109},{},[1110,1115],{"type":29,"tag":85,"props":1111,"children":1112},{},[1113],{"type":35,"value":1114},"Enhancement Relationships",{"type":35,"value":1116},": Source improves probability\u002Feffectiveness of target",{"type":29,"tag":81,"props":1118,"children":1119},{},[1120,1125],{"type":29,"tag":85,"props":1121,"children":1122},{},[1123],{"type":35,"value":1124},"Information Flows",{"type":35,"value":1126},": Source provides intelligence that informs target selection",{"type":29,"tag":81,"props":1128,"children":1129},{},[1130,1135],{"type":29,"tag":85,"props":1131,"children":1132},{},[1133],{"type":35,"value":1134},"Cyclic Transitions",{"type":35,"value":1136},": Tactics that restart or repeat attack phases",{"type":29,"tag":37,"props":1138,"children":1139},{},[1140,1145],{"type":29,"tag":85,"props":1141,"children":1142},{},[1143],{"type":35,"value":1144},"Research Question",{"type":35,"value":1146},": Can we empirically validate these classifications through incident analysis?",{"type":29,"tag":65,"props":1148,"children":1150},{"id":1149},"mathematical-formulation",[1151],{"type":35,"value":1152},"Mathematical Formulation",{"type":29,"tag":37,"props":1154,"children":1155},{},[1156],{"type":35,"value":1157},"For a given environment context C, the attack graph G(C) = (V, E, W) where:",{"type":29,"tag":77,"props":1159,"children":1160},{},[1161,1166,1171],{"type":29,"tag":81,"props":1162,"children":1163},{},[1164],{"type":35,"value":1165},"V = set of MITRE ATT&CK tactics",{"type":29,"tag":81,"props":1167,"children":1168},{},[1169],{"type":35,"value":1170},"E = directed edges representing possible transitions",{"type":29,"tag":81,"props":1172,"children":1173},{},[1174,1176,1182],{"type":35,"value":1175},"W: E → ",{"type":29,"tag":1177,"props":1178,"children":1179},"span",{},[1180],{"type":35,"value":1181},"0,1",{"type":35,"value":1183}," = weight function representing transition probabilities",{"type":29,"tag":37,"props":1185,"children":1186},{},[1187,1192,1194,1199],{"type":29,"tag":85,"props":1188,"children":1189},{},[1190],{"type":35,"value":1191},"Attack Path Probability",{"type":35,"value":1193},": For path p = ",{"type":29,"tag":1177,"props":1195,"children":1196},{},[1197],{"type":35,"value":1198},"v₁, v₂, ..., vₙ",{"type":35,"value":1200},", P(p|C) = ∏ᵢ w(vᵢ, vᵢ₊₁|C)",{"type":29,"tag":37,"props":1202,"children":1203},{},[1204,1209],{"type":29,"tag":85,"props":1205,"children":1206},{},[1207],{"type":35,"value":1208},"Critical Path Definition",{"type":35,"value":1210},": Path p* such that removing any edge reduces overall attack success probability by >threshold τ",{"type":29,"tag":47,"props":1212,"children":1214},{"id":1213},"domain-specific-adaptations",[1215],{"type":35,"value":1216},"Domain-Specific Adaptations",{"type":29,"tag":65,"props":1218,"children":1220},{"id":1219},"cloud-environments",[1221],{"type":35,"value":1222},"Cloud Environments",{"type":29,"tag":37,"props":1224,"children":1225},{},[1226,1231],{"type":29,"tag":85,"props":1227,"children":1228},{},[1229],{"type":35,"value":1230},"Hypothesis",{"type":35,"value":1232},": Cloud attacks exhibit different graph structures than on-premises networks.",{"type":29,"tag":37,"props":1234,"children":1235},{},[1236,1241],{"type":29,"tag":85,"props":1237,"children":1238},{},[1239],{"type":35,"value":1240},"Proposed State Modifications",{"type":35,"value":1242},":",{"type":29,"tag":77,"props":1244,"children":1245},{},[1246,1251,1256],{"type":29,"tag":81,"props":1247,"children":1248},{},[1249],{"type":35,"value":1250},"Initial_Access → {Credential_Compromise, Service_Exploitation, Misconfiguration}",{"type":29,"tag":81,"props":1252,"children":1253},{},[1254],{"type":35,"value":1255},"Lateral_Movement → {Cross_Service_Access, Role_Escalation, Account_Switching}",{"type":29,"tag":81,"props":1257,"children":1258},{},[1259],{"type":35,"value":1260},"Persistence → {Backdoor_Users, Policy_Modification, Resource_Hijacking}",{"type":29,"tag":37,"props":1262,"children":1263},{},[1264,1269],{"type":29,"tag":85,"props":1265,"children":1266},{},[1267],{"type":35,"value":1268},"Research Questions",{"type":35,"value":1242},{"type":29,"tag":77,"props":1271,"children":1272},{},[1273,1278],{"type":29,"tag":81,"props":1274,"children":1275},{},[1276],{"type":35,"value":1277},"Do cloud environments show higher transition probabilities between certain tactics?",{"type":29,"tag":81,"props":1279,"children":1280},{},[1281],{"type":35,"value":1282},"Are there cloud-specific cycles not present in traditional networks?",{"type":29,"tag":65,"props":1284,"children":1286},{"id":1285},"industrial-control-systems-icsscada",[1287],{"type":35,"value":1288},"Industrial Control Systems (ICS\u002FSCADA)",{"type":29,"tag":37,"props":1290,"children":1291},{},[1292,1296],{"type":29,"tag":85,"props":1293,"children":1294},{},[1295],{"type":35,"value":1230},{"type":35,"value":1297},": OT environments exhibit fundamentally different attack graph structures due to air gaps and legacy systems.",{"type":29,"tag":37,"props":1299,"children":1300},{},[1301,1306],{"type":29,"tag":85,"props":1302,"children":1303},{},[1304],{"type":35,"value":1305},"Proposed Adaptations",{"type":35,"value":1242},{"type":29,"tag":77,"props":1308,"children":1309},{},[1310,1315,1320],{"type":29,"tag":81,"props":1311,"children":1312},{},[1313],{"type":35,"value":1314},"Bifurcated graphs: IT_Network_Graph → OT_Network_Graph transitions",{"type":29,"tag":81,"props":1316,"children":1317},{},[1318],{"type":35,"value":1319},"Safety considerations: Impact states include {Process_Disruption, Physical_Damage, Safety_System_Compromise}",{"type":29,"tag":81,"props":1321,"children":1322},{},[1323],{"type":35,"value":1324},"Extended lateral movement cycles due to network architecture",{"type":29,"tag":65,"props":1326,"children":1328},{"id":1327},"smallmedium-businesses",[1329],{"type":35,"value":1330},"Small\u002FMedium Businesses",{"type":29,"tag":37,"props":1332,"children":1333},{},[1334,1338],{"type":29,"tag":85,"props":1335,"children":1336},{},[1337],{"type":35,"value":1230},{"type":35,"value":1339},": SMB environments exhibit compressed attack graphs with higher transition probabilities between tactics.",{"type":29,"tag":37,"props":1341,"children":1342},{},[1343,1348],{"type":29,"tag":85,"props":1344,"children":1345},{},[1346],{"type":35,"value":1347},"Proposed Characteristics",{"type":35,"value":1242},{"type":29,"tag":77,"props":1350,"children":1351},{},[1352,1357,1362],{"type":29,"tag":81,"props":1353,"children":1354},{},[1355],{"type":35,"value":1356},"Shorter critical paths due to reduced network complexity",{"type":29,"tag":81,"props":1358,"children":1359},{},[1360],{"type":35,"value":1361},"Higher edge weights for privilege escalation due to credential reuse",{"type":29,"tag":81,"props":1363,"children":1364},{},[1365],{"type":35,"value":1366},"Different accept states reflecting different attacker objectives",{"type":29,"tag":47,"props":1368,"children":1370},{"id":1369},"practical-applications-framework",[1371],{"type":35,"value":1372},"Practical Applications Framework",{"type":29,"tag":65,"props":1374,"children":1376},{"id":1375},"resource-allocation-optimization",[1377],{"type":35,"value":1378},"Resource Allocation Optimization",{"type":29,"tag":37,"props":1380,"children":1381},{},[1382,1387],{"type":29,"tag":85,"props":1383,"children":1384},{},[1385],{"type":35,"value":1386},"Problem Statement",{"type":35,"value":1388},": Given limited security budget B, how should resources be allocated across defensive capabilities?",{"type":29,"tag":37,"props":1390,"children":1391},{},[1392,1397],{"type":29,"tag":85,"props":1393,"children":1394},{},[1395],{"type":35,"value":1396},"Proposed Method",{"type":35,"value":1242},{"type":29,"tag":302,"props":1399,"children":1400},{},[1401,1406,1411,1416],{"type":29,"tag":81,"props":1402,"children":1403},{},[1404],{"type":35,"value":1405},"Model current environment as attack graph G(C)",{"type":29,"tag":81,"props":1407,"children":1408},{},[1409],{"type":35,"value":1410},"Calculate critical paths and edge importance scores",{"type":29,"tag":81,"props":1412,"children":1413},{},[1414],{"type":35,"value":1415},"Map defensive controls to graph edges (control c reduces edge weight w by factor f)",{"type":29,"tag":81,"props":1417,"children":1418},{},[1419],{"type":35,"value":1420},"Solve optimization problem: maximize attack path disruption subject to budget constraint B",{"type":29,"tag":37,"props":1422,"children":1423},{},[1424,1428],{"type":29,"tag":85,"props":1425,"children":1426},{},[1427],{"type":35,"value":1152},{"type":35,"value":1242},{"type":29,"tag":1064,"props":1430,"children":1432},{"code":1431},"maximize: Σ(path importance × disruption caused by controls)\nsubject to: Σ(control costs) ≤ B\n",[1433],{"type":29,"tag":1069,"props":1434,"children":1435},{"__ignoreMap":7},[1436],{"type":35,"value":1431},{"type":29,"tag":65,"props":1438,"children":1440},{"id":1439},"strategic-planning-applications",[1441],{"type":35,"value":1442},"Strategic Planning Applications",{"type":29,"tag":37,"props":1444,"children":1445},{},[1446,1451,1453,1458,1460,1465,1467,1472],{"type":29,"tag":85,"props":1447,"children":1448},{},[1449],{"type":35,"value":1450},"Threat Modeling",{"type":35,"value":1452},": Generate attack graphs for planned system changes\n",{"type":29,"tag":85,"props":1454,"children":1455},{},[1456],{"type":35,"value":1457},"Red Team Optimization",{"type":35,"value":1459},": Identify highest-probability attack paths for testing\n",{"type":29,"tag":85,"props":1461,"children":1462},{},[1463],{"type":35,"value":1464},"Vendor Selection",{"type":35,"value":1466},": Evaluate security products based on graph edge coverage\n",{"type":29,"tag":85,"props":1468,"children":1469},{},[1470],{"type":35,"value":1471},"Compliance Mapping",{"type":35,"value":1473},": Align regulatory requirements with critical graph paths",{"type":29,"tag":47,"props":1475,"children":1477},{"id":1476},"empirical-validation-framework",[1478],{"type":35,"value":1479},"Empirical Validation Framework",{"type":29,"tag":65,"props":1481,"children":1483},{"id":1482},"data-requirements",[1484],{"type":35,"value":1485},"Data Requirements",{"type":29,"tag":77,"props":1487,"children":1488},{},[1489,1494,1499,1504],{"type":29,"tag":81,"props":1490,"children":1491},{},[1492],{"type":35,"value":1493},"Historical incident reports with tactical progression sequences",{"type":29,"tag":81,"props":1495,"children":1496},{},[1497],{"type":35,"value":1498},"Environmental context variables (network architecture, security controls)",{"type":29,"tag":81,"props":1500,"children":1501},{},[1502],{"type":35,"value":1503},"Threat actor attribution and capability assessments",{"type":29,"tag":81,"props":1505,"children":1506},{},[1507],{"type":35,"value":1508},"Time-series data on attack technique prevalence",{"type":29,"tag":65,"props":1510,"children":1512},{"id":1511},"proposed-experiments",[1513],{"type":35,"value":1514},"Proposed Experiments",{"type":29,"tag":208,"props":1516,"children":1518},{"id":1517},"experiment-1-graph-structure-validation",[1519],{"type":35,"value":1520},"Experiment 1: Graph Structure Validation",{"type":29,"tag":37,"props":1522,"children":1523},{},[1524,1528,1530,1535,1537,1542],{"type":29,"tag":85,"props":1525,"children":1526},{},[1527],{"type":35,"value":1230},{"type":35,"value":1529},": Attack progression data will show non-random patterns consistent with graph structure\n",{"type":29,"tag":85,"props":1531,"children":1532},{},[1533],{"type":35,"value":1534},"Method",{"type":35,"value":1536},": Statistical analysis of tactic transition frequencies in incident databases\n",{"type":29,"tag":85,"props":1538,"children":1539},{},[1540],{"type":35,"value":1541},"Success Criteria",{"type":35,"value":1543},": Significant deviation from random transitions, identifiable patterns",{"type":29,"tag":208,"props":1545,"children":1547},{"id":1546},"experiment-2-critical-path-identification",[1548],{"type":35,"value":1549},"Experiment 2: Critical Path Identification",{"type":29,"tag":37,"props":1551,"children":1552},{},[1553,1557,1559,1563,1565,1569],{"type":29,"tag":85,"props":1554,"children":1555},{},[1556],{"type":35,"value":1230},{"type":35,"value":1558},": Certain tactical transitions are more critical for attack success than others\n",{"type":29,"tag":85,"props":1560,"children":1561},{},[1562],{"type":35,"value":1534},{"type":35,"value":1564},": Comparative analysis of successful vs. failed attacks, identifying common disruption points\n",{"type":29,"tag":85,"props":1566,"children":1567},{},[1568],{"type":35,"value":1541},{"type":35,"value":1570},": Statistically significant differences in critical path components",{"type":29,"tag":208,"props":1572,"children":1574},{"id":1573},"experiment-3-context-dependency",[1575],{"type":35,"value":1576},"Experiment 3: Context Dependency",{"type":29,"tag":37,"props":1578,"children":1579},{},[1580,1584,1586,1590,1592,1596],{"type":29,"tag":85,"props":1581,"children":1582},{},[1583],{"type":35,"value":1230},{"type":35,"value":1585},": Environmental context significantly affects transition probabilities\n",{"type":29,"tag":85,"props":1587,"children":1588},{},[1589],{"type":35,"value":1534},{"type":35,"value":1591},": Multi-environment analysis of attack patterns (cloud vs. on-premises vs. hybrid)\n",{"type":29,"tag":85,"props":1593,"children":1594},{},[1595],{"type":35,"value":1541},{"type":35,"value":1597},": Measurable differences in graph structure across environments",{"type":29,"tag":208,"props":1599,"children":1601},{"id":1600},"experiment-4-practical-validation",[1602],{"type":35,"value":1603},"Experiment 4: Practical Validation",{"type":29,"tag":37,"props":1605,"children":1606},{},[1607,1611,1613,1617,1619,1623],{"type":29,"tag":85,"props":1608,"children":1609},{},[1610],{"type":35,"value":1230},{"type":35,"value":1612},": Graph-informed resource allocation outperforms traditional approaches\n",{"type":29,"tag":85,"props":1614,"children":1615},{},[1616],{"type":35,"value":1534},{"type":35,"value":1618},": Simulated attack scenarios with different defensive allocation strategies\n",{"type":29,"tag":85,"props":1620,"children":1621},{},[1622],{"type":35,"value":1541},{"type":35,"value":1624},": Improved attack disruption rates with graph-optimized defenses",{"type":29,"tag":47,"props":1626,"children":1628},{"id":1627},"implementation-methodology",[1629],{"type":35,"value":1630},"Implementation Methodology",{"type":29,"tag":65,"props":1632,"children":1634},{"id":1633},"phase-1-graph-construction",[1635],{"type":35,"value":1636},"Phase 1: Graph Construction",{"type":29,"tag":302,"props":1638,"children":1639},{},[1640,1650,1660,1670],{"type":29,"tag":81,"props":1641,"children":1642},{},[1643,1648],{"type":29,"tag":85,"props":1644,"children":1645},{},[1646],{"type":35,"value":1647},"Data Collection",{"type":35,"value":1649},": Systematic analysis of published incident reports",{"type":29,"tag":81,"props":1651,"children":1652},{},[1653,1658],{"type":29,"tag":85,"props":1654,"children":1655},{},[1656],{"type":35,"value":1657},"Context Classification",{"type":35,"value":1659},": Environmental and threat actor categorization",{"type":29,"tag":81,"props":1661,"children":1662},{},[1663,1668],{"type":29,"tag":85,"props":1664,"children":1665},{},[1666],{"type":35,"value":1667},"Transition Mapping",{"type":35,"value":1669},": Statistical analysis of tactic-to-tactic progressions",{"type":29,"tag":81,"props":1671,"children":1672},{},[1673,1678],{"type":29,"tag":85,"props":1674,"children":1675},{},[1676],{"type":35,"value":1677},"Validation",{"type":35,"value":1679},": Expert review and red team validation of graph structures",{"type":29,"tag":65,"props":1681,"children":1683},{"id":1682},"phase-2-probabilistic-modeling",[1684],{"type":35,"value":1685},"Phase 2: Probabilistic Modeling",{"type":29,"tag":302,"props":1687,"children":1688},{},[1689,1699,1709,1719],{"type":29,"tag":81,"props":1690,"children":1691},{},[1692,1697],{"type":29,"tag":85,"props":1693,"children":1694},{},[1695],{"type":35,"value":1696},"Weight Calculation",{"type":35,"value":1698},": Statistical estimation of transition probabilities",{"type":29,"tag":81,"props":1700,"children":1701},{},[1702,1707],{"type":29,"tag":85,"props":1703,"children":1704},{},[1705],{"type":35,"value":1706},"Uncertainty Quantification",{"type":35,"value":1708},": Confidence intervals for edge weights",{"type":29,"tag":81,"props":1710,"children":1711},{},[1712,1717],{"type":29,"tag":85,"props":1713,"children":1714},{},[1715],{"type":35,"value":1716},"Context Adaptation",{"type":35,"value":1718},": Environmental modifier calculations",{"type":29,"tag":81,"props":1720,"children":1721},{},[1722,1727],{"type":29,"tag":85,"props":1723,"children":1724},{},[1725],{"type":35,"value":1726},"Temporal Analysis",{"type":35,"value":1728},": How edge weights change over time",{"type":29,"tag":65,"props":1730,"children":1732},{"id":1731},"phase-3-optimization-framework",[1733],{"type":35,"value":1734},"Phase 3: Optimization Framework",{"type":29,"tag":302,"props":1736,"children":1737},{},[1738,1748,1758,1768],{"type":29,"tag":81,"props":1739,"children":1740},{},[1741,1746],{"type":29,"tag":85,"props":1742,"children":1743},{},[1744],{"type":35,"value":1745},"Control Mapping",{"type":35,"value":1747},": Defensive controls to graph edge relationships",{"type":29,"tag":81,"props":1749,"children":1750},{},[1751,1756],{"type":29,"tag":85,"props":1752,"children":1753},{},[1754],{"type":35,"value":1755},"Cost Modeling",{"type":35,"value":1757},": Resource requirements for different defensive strategies",{"type":29,"tag":81,"props":1759,"children":1760},{},[1761,1766],{"type":29,"tag":85,"props":1762,"children":1763},{},[1764],{"type":35,"value":1765},"Optimization Algorithms",{"type":35,"value":1767},": Multi-objective optimization for resource allocation",{"type":29,"tag":81,"props":1769,"children":1770},{},[1771,1776],{"type":29,"tag":85,"props":1772,"children":1773},{},[1774],{"type":35,"value":1775},"Sensitivity Analysis",{"type":35,"value":1777},": Robustness testing of optimization results",{"type":29,"tag":47,"props":1779,"children":1781},{"id":1780},"critical-limitations-and-research-challenges",[1782],{"type":35,"value":1783},"Critical Limitations and Research Challenges",{"type":29,"tag":65,"props":1785,"children":1787},{"id":1786},"data-quality-issues",[1788],{"type":35,"value":1789},"Data Quality Issues",{"type":29,"tag":77,"props":1791,"children":1792},{},[1793,1803,1813],{"type":29,"tag":81,"props":1794,"children":1795},{},[1796,1801],{"type":29,"tag":85,"props":1797,"children":1798},{},[1799],{"type":35,"value":1800},"Reporting Bias",{"type":35,"value":1802},": Successful attacks may be under-reported",{"type":29,"tag":81,"props":1804,"children":1805},{},[1806,1811],{"type":29,"tag":85,"props":1807,"children":1808},{},[1809],{"type":35,"value":1810},"Attribution Challenges",{"type":35,"value":1812},": Uncertain threat actor identification affects context modeling",{"type":29,"tag":81,"props":1814,"children":1815},{},[1816,1821],{"type":29,"tag":85,"props":1817,"children":1818},{},[1819],{"type":35,"value":1820},"Temporal Drift",{"type":35,"value":1822},": Attack patterns evolve faster than data collection cycles",{"type":29,"tag":65,"props":1824,"children":1826},{"id":1825},"model-validation-challenges",[1827],{"type":35,"value":1828},"Model Validation Challenges",{"type":29,"tag":77,"props":1830,"children":1831},{},[1832,1842,1852],{"type":29,"tag":81,"props":1833,"children":1834},{},[1835,1840],{"type":29,"tag":85,"props":1836,"children":1837},{},[1838],{"type":35,"value":1839},"Ground Truth",{"type":35,"value":1841},": Difficult to validate probabilistic models without extensive historical data",{"type":29,"tag":81,"props":1843,"children":1844},{},[1845,1850],{"type":29,"tag":85,"props":1846,"children":1847},{},[1848],{"type":35,"value":1849},"Environment Specificity",{"type":35,"value":1851},": Models may not generalize across organizations",{"type":29,"tag":81,"props":1853,"children":1854},{},[1855,1860],{"type":29,"tag":85,"props":1856,"children":1857},{},[1858],{"type":35,"value":1859},"Adversarial Adaptation",{"type":35,"value":1861},": Attackers may adapt to known graph structures",{"type":29,"tag":65,"props":1863,"children":1865},{"id":1864},"practical-implementation-barriers",[1866],{"type":35,"value":1867},"Practical Implementation Barriers",{"type":29,"tag":77,"props":1869,"children":1870},{},[1871,1881,1890],{"type":29,"tag":81,"props":1872,"children":1873},{},[1874,1879],{"type":29,"tag":85,"props":1875,"children":1876},{},[1877],{"type":35,"value":1878},"Complexity",{"type":35,"value":1880},": Graph-based planning may be too complex for operational teams",{"type":29,"tag":81,"props":1882,"children":1883},{},[1884,1888],{"type":29,"tag":85,"props":1885,"children":1886},{},[1887],{"type":35,"value":1485},{"type":35,"value":1889},": Organizations may lack sufficient incident data for modeling",{"type":29,"tag":81,"props":1891,"children":1892},{},[1893,1898],{"type":29,"tag":85,"props":1894,"children":1895},{},[1896],{"type":35,"value":1897},"Integration",{"type":35,"value":1899},": Existing security tools may not support graph-based approaches",{"type":29,"tag":47,"props":1901,"children":1903},{"id":1902},"open-research-questions",[1904],{"type":35,"value":1905},"Open Research Questions",{"type":29,"tag":302,"props":1907,"children":1908},{},[1909,1919,1929,1939,1949,1959],{"type":29,"tag":81,"props":1910,"children":1911},{},[1912,1917],{"type":29,"tag":85,"props":1913,"children":1914},{},[1915],{"type":35,"value":1916},"Graph Topology",{"type":35,"value":1918},": What are the fundamental structural properties of attack graphs across different domains?",{"type":29,"tag":81,"props":1920,"children":1921},{},[1922,1927],{"type":29,"tag":85,"props":1923,"children":1924},{},[1925],{"type":35,"value":1926},"Temporal Dynamics",{"type":35,"value":1928},": How do attack graphs evolve over time, and can we predict these changes?",{"type":29,"tag":81,"props":1930,"children":1931},{},[1932,1937],{"type":29,"tag":85,"props":1933,"children":1934},{},[1935],{"type":35,"value":1936},"Multi-Actor Modeling",{"type":35,"value":1938},": How do simultaneous attacks by different actors affect graph dynamics?",{"type":29,"tag":81,"props":1940,"children":1941},{},[1942,1947],{"type":29,"tag":85,"props":1943,"children":1944},{},[1945],{"type":35,"value":1946},"Defensive Integration",{"type":35,"value":1948},": What graph modifications result from specific defensive technologies?",{"type":29,"tag":81,"props":1950,"children":1951},{},[1952,1957],{"type":29,"tag":85,"props":1953,"children":1954},{},[1955],{"type":35,"value":1956},"Measurement Frameworks",{"type":35,"value":1958},": How do we empirically validate graph-based security improvements?",{"type":29,"tag":81,"props":1960,"children":1961},{},[1962,1967],{"type":29,"tag":85,"props":1963,"children":1964},{},[1965],{"type":35,"value":1966},"Adversarial Robustness",{"type":35,"value":1968},": How quickly do attackers adapt to graph-optimized defenses?",{"type":29,"tag":47,"props":1970,"children":1972},{"id":1971},"conclusion",[1973],{"type":35,"value":1974},"Conclusion",{"type":29,"tag":37,"props":1976,"children":1977},{},[1978],{"type":35,"value":1979},"The graph-theoretic approach to attack modeling represents a paradigm shift from linear thinking to systems thinking in cybersecurity. By modeling attacks as state machines with probabilistic transitions, we can potentially optimize defensive strategies in ways that linear models cannot support.",{"type":29,"tag":37,"props":1981,"children":1982},{},[1983],{"type":35,"value":1984},"However, significant empirical work is required to validate this framework. The core hypotheses about graph structure, critical paths, and context dependency need rigorous testing with real-world data.",{"type":29,"tag":37,"props":1986,"children":1987},{},[1988],{"type":35,"value":1989},"This framework should be viewed as a research agenda rather than a proven methodology. Its value will ultimately depend on empirical validation and practical demonstration of improved security outcomes.",{"type":29,"tag":37,"props":1991,"children":1992},{},[1993],{"type":35,"value":1994},"The transition from intuitive security planning to data-driven, graph-optimized strategies represents both an opportunity and a challenge for the cybersecurity community. Success will require collaboration between security practitioners, data scientists, and graph theorists.",{"type":29,"tag":47,"props":1996,"children":1998},{"id":1997},"future-research-directions",[1999],{"type":35,"value":2000},"Future Research Directions",{"type":29,"tag":77,"props":2002,"children":2003},{},[2004,2009,2014,2019,2024],{"type":29,"tag":81,"props":2005,"children":2006},{},[2007],{"type":35,"value":2008},"Development of standardized attack graph datasets for community research",{"type":29,"tag":81,"props":2010,"children":2011},{},[2012],{"type":35,"value":2013},"Investigation of machine learning approaches for automated graph construction",{"type":29,"tag":81,"props":2015,"children":2016},{},[2017],{"type":35,"value":2018},"Game-theoretic analysis of attacker-defender interactions on attack graphs",{"type":29,"tag":81,"props":2020,"children":2021},{},[2022],{"type":35,"value":2023},"Integration with existing security frameworks (NIST, ISO 27001) through graph mappings",{"type":29,"tag":81,"props":2025,"children":2026},{},[2027],{"type":35,"value":2028},"Economic analysis of graph-optimized security investments",{"type":29,"tag":37,"props":2030,"children":2031},{},[2032],{"type":29,"tag":41,"props":2033,"children":2034},{},[2035],{"type":35,"value":2036},"This paper presents a theoretical framework requiring empirical validation. All optimization claims are hypothetical pending experimental verification.",{"title":7,"searchDepth":2038,"depth":2038,"links":2039},4,[2040,2042,2047,2057,2062,2066,2075,2080,2085,2086,2087],{"id":49,"depth":2041,"text":52},2,{"id":60,"depth":2041,"text":63,"children":2043},[2044,2046],{"id":67,"depth":2045,"text":70},3,{"id":124,"depth":2045,"text":127},{"id":178,"depth":2041,"text":181,"children":2048},[2049,2053,2054,2055,2056],{"id":184,"depth":2045,"text":187,"children":2050},[2051,2052],{"id":210,"depth":2038,"text":216},{"id":284,"depth":2038,"text":287},{"id":1022,"depth":2045,"text":1028},{"id":1054,"depth":2045,"text":1057},{"id":1085,"depth":2045,"text":1088},{"id":1149,"depth":2045,"text":1152},{"id":1213,"depth":2041,"text":1216,"children":2058},[2059,2060,2061],{"id":1219,"depth":2045,"text":1222},{"id":1285,"depth":2045,"text":1288},{"id":1327,"depth":2045,"text":1330},{"id":1369,"depth":2041,"text":1372,"children":2063},[2064,2065],{"id":1375,"depth":2045,"text":1378},{"id":1439,"depth":2045,"text":1442},{"id":1476,"depth":2041,"text":1479,"children":2067},[2068,2069],{"id":1482,"depth":2045,"text":1485},{"id":1511,"depth":2045,"text":1514,"children":2070},[2071,2072,2073,2074],{"id":1517,"depth":2038,"text":1520},{"id":1546,"depth":2038,"text":1549},{"id":1573,"depth":2038,"text":1576},{"id":1600,"depth":2038,"text":1603},{"id":1627,"depth":2041,"text":1630,"children":2076},[2077,2078,2079],{"id":1633,"depth":2045,"text":1636},{"id":1682,"depth":2045,"text":1685},{"id":1731,"depth":2045,"text":1734},{"id":1780,"depth":2041,"text":1783,"children":2081},[2082,2083,2084],{"id":1786,"depth":2045,"text":1789},{"id":1825,"depth":2045,"text":1828},{"id":1864,"depth":2045,"text":1867},{"id":1902,"depth":2041,"text":1905},{"id":1971,"depth":2041,"text":1974},{"id":1997,"depth":2041,"text":2000},"markdown","content:insights:beyond-kill-chain.md","content","insights\u002Fbeyond-kill-chain.md","insights\u002Fbeyond-kill-chain","md",{"loc":4,"images":2095},[2096],{"loc":203},[],1793813918270]