<Foundations of Attack Trees>

1 2 Sjouke Mauw and Martijn Oostdijk 1 Eindhoven University of Technology (sjouke@win.tue.nl) 2 Radboud University Nijmegen (martijno@cs.ru.nl) Abstract. Attack trees have found their way to practice because they have proved to be an intuitive aid in threat analysis. Despite, or perhaps thanks to, their apparent simplicity, they have not yet been provided with an unambiguous semantics. We argue that such a formal interpre- tation is indispensable to precisely understand how attack trees can be manipulated during construction and analysis.We provide a denotational semantics, based on a mapping to attack suites, which abstracts from the internal structure of an attack tree, we study transformations between attack trees, and we study the attribution and projection of an attack tree. Keywords: attack trees, semantics, threat analysis.