Modeling Internet Attacks

—As the frequency and complexity Internet attacks increase, systems administrators need more sophisticated tools to warn and direct their responses. The foundation for any such effort is a coherent model of exploits and vulnerabilities that is rich enough to capture the behavior and composition of multi-stage attacks. This paper describes an enhanced attack tree model of Internet attacks, and a companion specification language for expressing aggregate attack behaviors and modalities. A distributed attack notification and visualization system is briefly described that uses the model as a common representation for incidents captured by Intrusion Detection Systems (IDSs).