Pith. sign in

REVIEW 4 major objections 4 minor 60 references

Automated Repeatable Adversary Threat Emulation with Effects Language (EL)

T0 review · 4 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read EL makes attack graphs directly executable: the visual plan is the program, with formal semantics and an automatic proof-of-attack trace.

desk verdict The paper's real contribution is a graph-based coordination language for APT emulation, but the published semantics has two concrete bugs that undermine the formal claims; as written, loops do not execute under Algorithm 6 and Lemma 2 is false. read the letter →

arxiv 2510.06420 v2 pith:DTYZFNNL submitted 2025-10-07 cs.CR cs.PL

Suresh K. Damodaran , Paul D. Rowe This is my paper · ORCID
classification cs.CRcs.PL
keywords EffectsLanguageattackgraphsthreatemulationoperationalsemanticsvisualprogrammingproof-of-attackexecutiontraceformalmethods
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Effects Language (EL) is a visual programming language whose attack graphs are not just diagrams but executable specifications: the same graph an analyst draws is what runs against the target environment. The paper defines EL's operational semantics completely — a main loop that collects environment alerts, fires triggered watchpoint and logic nodes, manages delays, timeouts, loops, and garbage collection — and proves the properties an execution should have: node states always partition the graph, executions terminate when loops are finite, and goal nodes are reachable whenever a path exists and watchpoints eventually fire. Because the engine appends every fired node to a trace E, the run itself produces a proof-of-attack: a chronological, evidenced record of what the adversary did. Applying EL to steps from a published advanced-threat emulation plan, the authors report that repeat executions take 58% less time and require 63% less labor than the previous approach. If the semantics hold, EL would give red teams and tool evaluators a low-labor way to run the same multi-step campaign again and again with a verifiable log of what happened.

What carries the argument

The load-bearing machinery is the four-state node model — inactive, delayed, active, fired — driven by a time-stamped main loop (Algorithms 1–9). Each watchpoint node carries a delay and a timeout; delays hold a node in D until a specified time, timeouts set its expiry in A, and garbage collection removes expired nodes. The constrained loop structure is what makes cycles tractable: a loop-count node has exactly two children, the loop's first node and a loop-exit node, and firing the exit node resets every node in the loop. The paper's proofs depend on these structural constraints to show that the D/A/F sets form a partition and that forward progress is never lost.

What would settle it

Run Algorithms 6 and 9 on a minimal loop with count 1 and a first node whose delay is 0: the node is added to the active set with expiry t* and then removed by garbage collection in the same round, so the loop body never executes — contradicting Lemmas 1 and Theorem 2. Equivalently, exhibit a path from a start node to the first loop node that contains the loop-count node but not the loop-exit node, which the Lemma 2 proof asserts cannot happen.

Watch

Extended reading notes

Core claim

The paper's central claim is that an attack graph can be the program itself. An EL graph — activation nodes with watchpoints, guarded effect nodes that run scripts, logic nodes expressing AND/OR joins, and strictly constrained loops — is given a graph-based operational semantics: Algorithm 1 polls the environment for alerts, activates delayed nodes, fires triggered nodes, processes loop-count and loop-exit nodes, and garbage-collects timeouts, with the full behavior specified by Algorithms 1–9. On that basis the paper proves Theorem 1 (the delayed, active, and fired sets partition the graph at every step), Lemma 1 (finite loop counts imply finite executions), Lemma 2 (every path that once co

Load-bearing premise

The reachability guarantee stands only if the loop semantics behave exactly as the proofs assume: the published proof claims every path through a loop-count node also passes through the loop-exit node, which is false for paths that end inside the loop, and the published activation rule sets a zero-delay loop node's expiry to the current time, so garbage collection can remove it in the same round.

Editorial extensions

If this is right

  • An EL graph is directly executable, so the visual plan needs no translation into another format, eliminating a whole class of human translation errors.
  • Every run accumulates a trace E of fired nodes with the alerts that triggered them, giving vendor evaluations a ready-made, timestamped proof-of-attack.
  • Because effects are opaque scripts attached to nodes, attack steps written in different languages can be coordinated in one graph without reimplementation.
  • The reported savings — 58% less time and 63% less labor on repeat runs — mean campaigns can be re-run frequently for training, what-if tests, and tool scoring at a fraction of current cost.
  • Under the theorem's conditions (finite loop counts, no finite timeouts, watchpoints eventually satisfied, at least one start-to-goal path), a goal node is guaranteed to be reached, so a well-formed EL plan will not stall for reasons intrinsic to the semantics.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the semantics are made fully rigorous, EL graphs become objects that can be statically checked before execution — for example, to detect deadlocking watchpoints or unsatisfiable joins that would stall a campaign.
  • The proof-of-attack trace could be reused in reverse: align the adversary-side trace against defender alerts to score detection coverage automatically on every run.
  • A natural stress-test is to port the same emulation plan to other automation frameworks and compare time, labor, and fidelity on identical scenarios, something the paper does not attempt.
  • The gap between the published pseudocode and the proofs (loop activation and garbage-collection timing) suggests that machine-checked proofs of the state-partition invariant would be a worthwhile next step to catch subtle timing defects before they ship.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces Effects Language (EL), a visual, graph-based coordination language for adversary threat emulation. An EL graph is a directed graph of AGE (activation/guard/effect), logic, loop count, loop break, and loop exit nodes; the authors give a formal operational semantics (Algorithms 1–9) that maintains partitions into inactive, delayed, active, and fired nodes, and they prove in the appendix termination, liveness, and reachability properties (Lemmas 1–3 and Theorem 2). The paper also defines proof-of-attack traces, translates part of the Wizard Spider emulation plan into EL, and reports time and labor savings from using EL. The central claims are that EL makes attack graphs directly executable and repeatable and that its execution semantics are formally established.

Significance. EL addresses a real gap: most attack-graph notations are descriptive rather than executable, and automation tools generally lack formal execution semantics. The paper's separation of coordination semantics from watchpoint/effect details is a sound design, and the proof-of-attack trace is a useful idea. The manuscript includes the full pseudo-code specification, an appendix of proofs, a concrete ATT&CK-derived example, and self-reported efficiency data; it is not circular and does not rely on fitted parameters. If the semantic defects in §4.4/§4.5 are fixed, the formal framework would be a meaningful contribution to automated threat emulation and attack-graph research. At present, however, the correctness results are not established as written.

major comments (4)
  1. [§4.5, Lemma 2; proof in Appendix A] Lemma 2 is false as stated. In the loop structure of Fig. 8, let l be the loop count node, A1..Ak the internal nodes, and x the loop exit. Take a path π = s⋯l A1⋯Aj that ends at an internal node Aj (j≤k) and suppose l fires with counter 0. Algorithm 6 line 3 resets R(l) = {A1..Ak} to inactive, line 5 activates x, and line 6 moves l to F. Since π ends at Aj and does not contain x, after this round π∩(D∪A) is empty, contradicting the lemma. The proof's assertion that every path through l also passes through x is true only for paths that continue to the loop exit; paths ending inside the loop are valid instances of the lemma. Lemma 3 and hence Theorem 2 depend on Lemma 2, so the reachability theorem is not established.
  2. [§4.4, Algorithm 6, lines 10–13] In the non-zero branch, the first loop node n is activated with expiry `t* + delay(n)`. For the default delay 0 this is `(n, t*)`. Algorithm 9, called from Algorithm 1 line 11 in the same round, removes every pair with t ≤ t*, so n is deactivated immediately and never executes. The no-delay case should pair n with `t* + timeout(n)`, matching Algorithm 5 line 5. As written, loops cannot iterate, contradicting the loop semantics described in §4.2.1 and assumed by Lemmas 1–3.
  3. [§5.1, Definition 4; trace example] Definition 4 defines the proof-of-attack trace as the list E, but Algorithm 5 line 12 appends only watchpoint node names, and logic, loop count, and loop exit nodes are excluded. The trace example in §5.1, however, includes a timestamp (`2024-12-26T13:25:21...`) and a full `_EL_EXEC_RESP` payload, neither of which is recorded in E as defined. If proof-of-attack is claimed to be a chronological evidence trail, the semantics must either enrich E (or a separate evidence log) with timestamps and evidence, or the claim should be narrowed to 'ordered list of fired watchpoint nodes.'
  4. [§6, Tables 3a/3b] The efficiency claims are internally inconsistent. The text says EL gives a '7% reduction in labor' in initial execution, but Table 3a's People column drops from 27 to 18 (33%); even if 'labor' means person-months, the table gives 66 vs 55.25 person-months (16% reduction). The 7% figure matches only the time column (17 vs 15.75 months). No methodology is given for the month/person entries. The abstract's efficiency conclusion is therefore not supported by the data as presented.
minor comments (4)
  1. [§7.2] Typo: 'CALDREA' should be 'CALDERA'.
  2. [§5.1, trace example] The ATT&CK identifier 'T10003_003_NTDSCredential-Dump' appears to have an extra zero; it should be consistent with identifiers such as 'T1003.002' used elsewhere.
  3. [§4.4] The statement 'The actual EL implementation is in Rust' would be more useful with an artifact/repository link or an availability statement, so that the semantics can be checked against the implementation.
  4. [Fig. 2 and Table 2] Node names mix spaces, underscores, and hyphens (e.g., 'T1105 IngressELRat', 'T1547 004 AutostartWinlogonPersistence'); consistent notation would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: EL semantics and proofs are self-contained; efficiency claims are self-reported estimates rather than circular derivations.

full rationale

The paper's central contribution is a formal operational semantics for EL (Algorithms 1-9, Definitions 1-4) with proofs of partition and reachability properties (Theorem 1, Lemmas 1-3, Theorem 2). These proofs are derived from the stated graph structure and transition rules, not from fitted parameters or from reusing the target result as an assumption. The skeptical concern that Lemma 2 is false for paths ending inside loops is a correctness defect in the proof, not a circularity: the lemma is asserted and argued, not assumed from an equivalent source. Similarly, the tables reporting 7% and 58% time savings (Tables 3a, 3b) are the authors' own estimates without an external benchmark, but they do not claim to derive those numbers from a fitted model; they are empirical self-reports and therefore weaken evidence quality, not derivational circularity. The only self-citation, [49], describes an earlier version of EL used for simulation and is not load-bearing for the formal semantics presented here; the semantics are defined and proved within the paper. No step reduces, by the paper's own equations or by self-citation, to its inputs. Hence a score of 0 is appropriate.

Assumptions & free parameters 0 free parameters · 4 assumptions · 1 invented entities

The central formal claims rest on a finite graph with constrained loop structure, a coordination-only view of effects/watchpoints, and conditional environment assumptions. No fitted free parameters are involved. The efficiency claim rests on self-reported estimates rather than external data.

assumptions (4)
  • domain assumption Watchpoints and effects can be treated as opaque atomic units; EL coordination semantics is independent of their implementation and outcomes.
    Invoked in Section 4 intro: 'we treat these ... abstractly'; all node-state proofs assume only that alerts eventually arrive and effects do not directly change node activation logic.
  • domain assumption An EL graph is finite and satisfies Definition 3 structural constraints (constrained loop shapes, precomputed reset sets, entry/goal rules).
    Section 4.2 Definition 3; functions next/logicNodes/getResetNodes and the Lemma proofs rely on these constraints.
  • domain assumption For Theorem 2, no node has a finite timeout, every watchpoint is eventually satisfied in finite time, there are no infinite loops, and every parentless node is a start node.
    Hypotheses of Theorem 2 and Lemmas 1-3; they make the reachability guarantee conditional on an idealized environment.
  • domain assumption Reaching a goal node is treated as the adversary having achieved the desired changes to the target environment.
    Section 4.1: 'Our assumption is that when a goal node is reached, the adversary has succeeded...'
invented entities (1)
  • Effects Language (EL) graph formalism: AGE nodes (activation + guarded effect), watchpoints, logic AND/OR nodes, loop count/exit/break nodes.
    purpose: Provide a directly executable visual coordination language for threat emulation attack graphs.
    Introduced and defined entirely within this paper (building on cited MITRE TR [49]); no external implementation, formal verification, or independent benchmark is provided. The only evidence is the internal Wizard Spider example and handwritten proofs.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Automated Repeatable Adversary Threat Emulation with Effects Language (EL)." pith.science (2026). https://pith.science/paper/DTYZFNNL

@misc{pith2026251006420,
  author       = {Pith},
  title        = {Pith review of: Automated Repeatable Adversary Threat Emulation with Effects Language (EL)},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DTYZFNNL}},
  note         = {Machine review of arXiv:2510.06420}
}
read the original abstract

The emulation of multi-step attacks attributed to advanced persistent threats is valuable for training defenders and evaluating defense tools. In this paper, we discuss the numerous challenges and desired attributes associated with such automation. Additionally, we introduce the use of Effects Language (EL), a visual programming language with graph-based operational semantics, as a solution to address many of these challenges and requirements. We formally define the execution semantics of EL, and prove important execution properties. Furthermore, we showcase the application of EL to codify attacks using an example from one of the publicly available attack scenarios. We also demonstrate how EL can be utilized to provide proof-of-attack of complex multi-step attacks. Our results highlight the improvements in time and resource efficiency achieved through the use of EL for repeatable automation.

Figures

Figures reproduced from arXiv: 2510.06420 by the authors.

Figure 1
Figure 1. Non-goal terminal node words, if we want to express the content of an attack plan in enough detail to emulate a TTP, a directed graph is a natural structure to use for expressing attack plans since that is how people already convey the information for human consumption. Notice, also, that it is not simply a linear sequence of steps. Instead, paths through the graph can split and possibly rejoin at a later point. Whe… view at source ↗
Figure 2
Figure 2. EL Example with Annotated Rules An AGE node consists of two distinct types of sub-nodes: activation nodes and guarded effect nodes. An activation node controls how an EL program execution goes forward through a precondition embedded in it that must be satisfied for execution to proceed. These preconditions are called watchpoints, and typically embed conditions that must be evaluated in real-time, when exe￾cution rea… view at source ↗
Figure 3
Figure 3. EL IDE 3.1 Creating an Attack Graph The EL Integrated Development Environment (IDE) is a visual editor to create and edit EL graphs. A screenshot of EL IDE is shown in [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Roles • Attack Tester: Responsible for integrating the attack effects developed by the Effect Developer and the attack graph, and then testing the integrated attack graph on the operating environment. • Red Team Operator: Responsible for executing the fully integrated …
Figure 5
Figure 5. Figure 5: The standard node state sequence is from inactive to active to fired. [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: More node state sequences are possible with delays and timeouts. [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: Adding loops creates even more possible state sequences. [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Constrained structure of a loop. but it is somewhat easier to describe if we assume the graph is in collapsed form. Therefore below, we assume all graphs are in collapsed form. Loops in graphs. The ability to repeat portions of a graph is important in many situations. …
Figure 9
Figure 9. Figure 9: Wizard Spider Steps 7 and 8 In [PITH_FULL_IMAGE:figures/full_fig_p031_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 2 linked inside Pith

  1. [1]

    Analysis of automated adversary emulation techniques

    Andy Applebaum, Doug Miller, Blake Strom, Henry Foster, and Cody Thomas. Analysis of automated adversary emulation techniques. InPro- ceedings of the Summer Simulation Multi-Conference, pages 1–12, 2017

    2017

  2. [2]

    AttackIQ.https://www.attackiq.com/

    AttackIQ. AttackIQ.https://www.attackiq.com/. Accessed April, 24, 2025

    2025

  3. [3]

    Dynamic risk assessment in cybersecurity: A systematic literature review.Future Internet, 15(10):324, 2023

    Pavlos Cheimonidis and Konstantinos Rantos. Dynamic risk assessment in cybersecurity: A systematic literature review.Future Internet, 15(10):324, 2023

    2023

  4. [4]

    AutoTTP.https://github.com/jymcheong/AutoTTP

    Jym Cheong. AutoTTP.https://github.com/jymcheong/AutoTTP. Ac- cessed November 11, 2024

    2024

  5. [5]

    Spanner: Google’s globally distributed database.ACM Transactions on Computer Systems (TOCS), 31(3):1–22, 2013

    James C Corbett, Jeffrey Dean, Michael Epstein, Andrew Fikes, Christo- pher Frost, Jeffrey John Furman, Sanjay Ghemawat, Andrey Gubarev, Christopher Heiser, Peter Hochschild, et al. Spanner: Google’s globally distributed database.ACM Transactions on Computer Systems (TOCS), 31(3):1–22, 2013

    2013

  6. [6]

    Big game hunting with ryuk: Another lucrative tar- geted ransomware.https://www.crowdstrike.com/en-us/blog/ big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/

    CrowdStrike. Big game hunting with ryuk: Another lucrative tar- geted ransomware.https://www.crowdstrike.com/en-us/blog/ big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/. Accessed January 15, 2025

    2025

  7. [7]

    Damodaran and Jerry M

    Suresh K. Damodaran and Jerry M. Couretas. Cyber modeling & simula- tion for cyber-range events. InProceedings of the Conference on Summer Computer Simulation, SummerSim ’15, pages 1–8, San Diego, CA, USA, 2015

    2015

  8. [8]

    Rand, 1969

    Thomas O Ellis, John F Heafner, and William L Sibley.The GRAIL Project: An experiment in man-machine communications. Rand, 1969

    1969

Show all 60 references
  1. [9]

    Software process development and enactment: Concepts and definitions

    Peter H Feiler and Watts S Humphrey. Software process development and enactment: Concepts and definitions. In[1993] Proceedings of the Sec- ond International Conference on the Software Process-Continuous Software Process Improvement, pages 28–40. IEEE, 1993. 41

    1993

  2. [10]

    Fighting Blue: Why first class threat emulation is critical to joint experimentation and combat develop- ment.American Intelligence Journal, 26(1):24–30, 2008

    Gregory Fontenot and Darrell L Combs. Fighting Blue: Why first class threat emulation is critical to joint experimentation and combat develop- ment.American Intelligence Journal, 26(1):24–30, 2008

    2008

  3. [11]

    FortiTester.https://www.fortinet.com/content/dam/ fortinet/assets/data-sheets/FortiTester.pdf

    Fortinet. FortiTester.https://www.fortinet.com/content/dam/ fortinet/assets/data-sheets/FortiTester.pdf. Accessed April, 24, 2025

    2025

  4. [12]

    Coordination languages and their significance.Communications of the ACM, 35(2):96, 1992

    David Gelernter and Nicholas Carriero. Coordination languages and their significance.Communications of the ACM, 35(2):96, 1992

    1992

  5. [13]

    Hierarchical reinforcement learning for efficient and effective automated penetration testing of large networks.Journal of Intelligent Information Systems, 60(2):281–303, 2023

    Mohamed C Ghanem, Thomas M Chen, and Erivelton G Nepomuceno. Hierarchical reinforcement learning for efficient and effective automated penetration testing of large networks.Journal of Intelligent Information Systems, 60(2):281–303, 2023

    2023

  6. [14]

    Dijkstra

    J¨ org Hoffmann. Simulated penetration testing: From “Dijkstra” to “Turing test++”. InTwenty-Fifth International Conference on Automated Plan- ning and Scheduling, 2015

    2015

  7. [15]

    Lore a red team emulation tool.IEEE Transactions on Dependable and Secure Computing, 20(2):1596–1608, 2022

    Hannes Holm. Lore a red team emulation tool.IEEE Transactions on Dependable and Secure Computing, 20(2):1596–1608, 2022

    2022

  8. [16]

    A sur- vey on the usability and practical applications of graphical security models

    Jin B Hong, Dong Seong Kim, Chun-Jen Chung, and Dijiang Huang. A sur- vey on the usability and practical applications of graphical security models. Computer Science Review, 26:1–16, 2017

    2017

  9. [17]

    Attack graph implementation and visualization for cyber physical systems.Processes, 8(1):12, 2020

    Mariam Ibrahim, Qays Al-Hindawi, Ruba Elhafiz, Ahmad Alsheikh, and Omar Alquq. Attack graph implementation and visualization for cyber physical systems.Processes, 8(1):12, 2020

    2020

  10. [18]

    Practical attack graph generation for network defense

    Kyle Ingols, Richard Lippmann, and Keith Piwowarski. Practical attack graph generation for network defense. In2006 22nd Annual Computer Security Applications Conference (ACSAC’06), pages 121–130. IEEE, 2006

    2006

  11. [19]

    Advanced cyber attack modeling analysis and visualization

    Sushil Jajodia and Steven Noel. Advanced cyber attack modeling analysis and visualization. Technical report, George Mason Univ., Fairfax, V A, 2010

    2010

  12. [20]

    OASIS-STIX™version 2.1

    Bret Jordan, Rich Piazza, and Trey Darley. OASIS-STIX™version 2.1. OASIS Committee Specification, 1, 2020

    2020

  13. [21]

    A taxonomy for attack graph generation and usage in network security.Journal of Information Security and Applications, 29:27– 56, 2016

    Kerem Kaynar. A taxonomy for attack graph generation and usage in network security.Journal of Information Security and Applications, 29:27– 56, 2016

    2016

  14. [22]

    The logical execution time paradigm

    Christoph M Kirsch and Ana Sokolova. The logical execution time paradigm. InAdvances in Real-Time Systems, pages 103–120. Springer, 2012. 42

    2012

  15. [23]

    Characterizing visual programming approaches for end- user developers: A systematic review.IEEE Access, 9:14181–14202, 2021

    Mohammad Amin Kuhail, Shahbano Farooq, Rawad Hammad, and Mo- hammed Bahja. Characterizing visual programming approaches for end- user developers: A systematic review.IEEE Access, 9:14181–14202, 2021

    2021

  16. [24]

    A review of attack graph and attack tree visual syntax in cyber security.Computer Science Review, 35:100219, 2020

    Harjinder Singh Lallie, Kurt Debattista, and Jay Bal. A review of attack graph and attack tree visual syntax in cyber security.Computer Science Review, 35:100219, 2020

    2020

  17. [25]

    A se- mantic approach to improving machine readability of a large-scale attack graph.The Journal of Supercomputing, 75(6):3028–3045, 2019

    Jooyoung Lee, Daesung Moon, Ikkyun Kim, and Youngseok Lee. A se- mantic approach to improving machine readability of a large-scale attack graph.The Journal of Supercomputing, 75(6):3028–3045, 2019

    2019

  18. [26]

    A language for deterministic coordination across multiple timelines

    Marten Lohstroh, Christian Menard, Alexander Schulz-Rosengarten, Matthew Weber, Jeronimo Castrillon, and Edward A Lee. A language for deterministic coordination across multiple timelines. In2020 Forum for Specification and Design Languages (FDL), pages 1–8. IEEE, 2020

    2020

  19. [27]

    Attack planning in the real world

    Jorge Lucangeli, Carlos Sarraute, and Gerardo Richarte. Attack planning in the real world. InWorkshop on Intelligent Security (SecArt 2010), pages 10–18, 2010

    2010

  20. [28]

    Fin12 group profile: Fin12 prioritizes speed to deploy ran- somware against high-value targets.https://www.mandiant.com/sites/ default/files/2021-10/fin12-group-profile.pdf

    Mandiant. Fin12 group profile: Fin12 prioritizes speed to deploy ran- somware against high-value targets.https://www.mandiant.com/sites/ default/files/2021-10/fin12-group-profile.pdf. Accessed January 15, 2025

    2021

  21. [29]

    Business process modeling languages: Sorting through the alphabet soup.ACM Computing Surveys (CSUR), 43(1):1–56, 2010

    Hafedh Mili, Guy Tremblay, Guitta Bou Jaoude, ´Eric Lefebvre, Lamia Elabed, and Ghizlane El Boussaidi. Business process modeling languages: Sorting through the alphabet soup.ACM Computing Surveys (CSUR), 43(1):1–56, 2010

    2010

  22. [30]

    Automated adversary emulation: A case for planning and acting with unknowns.MITRE Corp., McLean, V A, 2018

    Doug Miller, Ron Alford, Andy Applebaum, Henry Foster, Caleb Little, and Blake Strom. Automated adversary emulation: A case for planning and acting with unknowns.MITRE Corp., McLean, V A, 2018

    2018

  23. [31]

    Attack flow: Example flows.https:// center-for-threat-informed-defense.github.io/attack-flow/ example_flows/

    MITRE. Attack flow: Example flows.https:// center-for-threat-informed-defense.github.io/attack-flow/ example_flows/. Accessed November 1, 2024

    2024

  24. [32]

    Attack flow: Muddywater.https:// center-for-threat-informed-defense.github.io/attack-flow/ ui/?src=..%2fcorpus%2fMuddy%20Water.afb

    MITRE. Attack flow: Muddywater.https:// center-for-threat-informed-defense.github.io/attack-flow/ ui/?src=..%2fcorpus%2fMuddy%20Water.afb. Accessed November 1, 2024

    2024

  25. [33]

    CALDERA.https://github.com/mitre/caldera

    MITRE. CALDERA.https://github.com/mitre/caldera. Accessed October, 13, 2024

    2024

  26. [34]

    Cybersecurity: ATT&CK evaluations.https://evals.mitre

    MITRE. Cybersecurity: ATT&CK evaluations.https://evals.mitre. org/. Accessed October 13, 2024. 43

    2024

  27. [35]

    MITRE ATT&CK.https://attack.mitre.org/

    MITRE. MITRE ATT&CK.https://attack.mitre.org/. Accessed Oc- tober, 20, 2024

    2024

  28. [36]

    MITRE ATT&CK groups.https://attack.mitre.org/ groups/

    MITRE. MITRE ATT&CK groups.https://attack.mitre.org/ groups/. Accessed October, 20, 2024

    2024

  29. [37]

    Muddywater attack group.https://attack.mitre.org/ groups/G0069/

    MITRE. Muddywater attack group.https://attack.mitre.org/ groups/G0069/. Accessed November 1, 2024

    2024

  30. [38]

    Wizard-spider group.https://attack.mitre.org/groups/ G0102/

    MITRE. Wizard-spider group.https://attack.mitre.org/groups/ G0102/. Accessed January 15, 2025

    2025

  31. [39]

    Wizard-spider operation flow.https://github

    MITRE. Wizard-spider operation flow.https://github. com/attackevals/ael/blob/main/Enterprise/wizard_spider/ Operations_Flow/Operations_Flow.md. Accessed January 15, 2025

    2025

  32. [40]

    Wizard-spider scenario1.https://github.com/attackevals/ ael/tree/main/Enterprise/wizard_spider/Emulation_Plan/ Scenario_1

    MITRE. Wizard-spider scenario1.https://github.com/attackevals/ ael/tree/main/Enterprise/wizard_spider/Emulation_Plan/ Scenario_1. Accessed January 15, 2025

    2025

  33. [41]

    Taxonomies of visual programming and program visualiza- tion.Journal of Visual Languages & Computing, 1(1):97–123, 1990

    Brad A Myers. Taxonomies of visual programming and program visualiza- tion.Journal of Visual Languages & Computing, 1(1):97–123, 1990

    1990

  34. [42]

    Advances in topological vulnerability analysis

    Steven Noel, Matthew Elder, Sushil Jajodia, Pramod Kalapa, Scott O’Hare, and Kenneth Prole. Advances in topological vulnerability analysis. In2009 Cybersecurity Applications & Technology Conference for Homeland Security, pages 124–129. IEEE, 2009

    2009

  35. [43]

    Mulval: A logic-based network security analyzer

    Xinming Ou, Sudhakar Govindavajhala, Andrew W Appel, et al. Mulval: A logic-based network security analyzer. InUSENIX security symposium, volume 8, pages 113–128. Baltimore, MD, 2005

    2005

  36. [44]

    From BPMN process models to bpel web services

    Chun Ouyang, Marlon Dumas, Arthur HM Ter Hofstede, and Wil MP Van der Aalst. From BPMN process models to bpel web services. In2006 IEEE International Conference on Web Services (ICWS’06), pages 285–

  37. [45]

    Petri nets.ACM Computing Surveys (CSUR), 9(3):223– 252, 1977

    James L Peterson. Petri nets.ACM Computing Surveys (CSUR), 9(3):223– 252, 1977

    1977

  38. [46]

    A graph-based system for network-vulnerability analysis

    Cynthia Phillips and Laura Painton Swiler. A graph-based system for network-vulnerability analysis. InProceedings of the 1998 workshop on New security paradigms, pages 71–79, 1998

    1998

  39. [47]

    Picus.https://www.picussecurity.com/

    Picus Security. Picus.https://www.picussecurity.com/. Accessed April, 24, 2025

    2025

  40. [48]

    Analysis of cyber threat detection and emulation using MITRE attack framework

    P Rajesh, Mansoor Alam, Mansour Tahernezhadi, A Monika, and Gm Chanakya. Analysis of cyber threat detection and emulation using MITRE attack framework. In2022 International Conference on Intelligent Data Science Technologies and Applications (IDSTA), pages 4–12. IEEE, 2022. 44

    2022

  41. [49]

    Rowe, Suresh K

    Paul D. Rowe, Suresh K. Damodaran, and Peter Malinovsky. A coordina- tion model for attack graphs.MITRE Technical Report, MTR230165:1–24, 2023

    2023

  42. [50]

    Sok: The MITRE ATT&CK framework in research and practice.arXiv preprint arXiv:2304.07411, 2023

    Shanto Roy, Emmanouil Panaousis, Cameron Noakes, Aron Laszka, Sak- shyam Panda, and George Loukas. Sok: The MITRE ATT&CK framework in research and practice.arXiv preprint arXiv:2304.07411, 2023

    2023 arXiv

  43. [51]

    SafeBreach Studio.https://www.safebreach.com/ safebreach-studio/

    SafeBreach. SafeBreach Studio.https://www.safebreach.com/ safebreach-studio/. Accessed April, 24, 2025

    2025

  44. [52]

    Pomdps make better hackers: Accounting for uncertainty in penetration testing

    Carlos Sarraute, Olivier Buffet, and J¨ org Hoffmann. Pomdps make better hackers: Accounting for uncertainty in penetration testing. In J¨ org Hoff- mann and Bart Selman, editors,Proceedings of the Twenty-Sixth AAAI Conference on Artificial Intelligence, July 22-26, 2012, Toro...

    2012

  45. [53]

    Automated generation and analysis of attack graphs

    Oleg Sheyner, Joshua Haines, Somesh Jha, Richard Lippmann, and Jean- nette M Wing. Automated generation and analysis of attack graphs. In Proceedings 2002 IEEE Symposium on Security and Privacy, pages 273–

    2002

  46. [54]

    Tools for generating and analyzing at- tack graphs

    Oleg Sheyner and Jeannette Wing. Tools for generating and analyzing at- tack graphs. InInternational symposium on formal methods for components and objects, pages 344–371. Springer, 2003

    2003

  47. [55]

    Ex- tending attack graphs to represent cyber-attacks in communication proto- cols and modern it networks.IEEE Transactions on Dependable and Secure Computing, 2020

    Orly Stan, Ron Bitton, Michal Ezrets, Moran Dadon, Masaki Inokuchi, Ohta Yoshinobu, Yagyu Tomohiko, Yuval Elovici, and Asaf Shabtai. Ex- tending attack graphs to represent cyber-attacks in communication proto- cols and modern it networks.IEEE Transactions on Dependable and Sec...

    2020

  48. [56]

    MITRE ATT&CK: Design and philosophy.MITRE, MP18–0944, 2018

    Blake E Strom, Andy Applebaum, Doug P Miller, Kathryn C Nickels, Adam G Pennington, and Cody B Thomas. MITRE ATT&CK: Design and philosophy.MITRE, MP18–0944, 2018

    2018

  49. [57]

    Cyber risk assessment in small and medium-sized enterprises: A multilevel decision-making approach for small e-tailors.Risk Analysis, 43(10):2082– 2098, 2023

    Arun Sukumar, Hannan Amoozad Mahdiraji, and Vahid Jafari-Sadeghi. Cyber risk assessment in small and medium-sized enterprises: A multilevel decision-making approach for small e-tailors.Risk Analysis, 43(10):2082– 2098, 2023

  50. [58]

    Attack graphs for modeling and simulating sophisti- cated cyber attack

    Travis L Swiatocha. Attack graphs for modeling and simulating sophisti- cated cyber attack. Technical report, Naval Postgraduate School, 2018

    2018

  51. [59]

    A programming model for time- synchronized distributed real-time systems

    Yang Zhao, Jie Liu, and Edward A Lee. A programming model for time- synchronized distributed real-time systems. In13th IEEE Real Time and Embedded Technology and Applications Symposium (RTAS’07), pages 259–

  52. [60]

    loop edge

    Polina Zilberman, Rami Puzis, Sunders Bruskin, Shai Shwarz, and Yuval Elovici. Sok: A survey of open-source threat emulators.arXiv preprint arXiv:2003.01518, 2020. A Proofs Theorem 1.At the end of each line of Algorithm 1, the setsI, bD, bA, Fpartition the nodes of the graphG....

    2003 arXiv

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.