Pith. sign in

REVIEW 3 major objections 4 minor 35 references

An ontological lens on attack trees: Toward adequacy and interoperability

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Attack trees, a widely used security-analysis formalism, are ontologically inadequate: their nodes can mean goals, events, situations, or objects, which undermines the minimal attacks and security metrics computed from them.

desk verdict A well-organized ontological critique of attack trees, but its central claim overreaches: the ambiguity lives in the labels, not in the formal services ATs provide. read the letter →

arxiv 2506.23841 v1 pith:GLX4PRBS submitted 2025-06-30 cs.CR cs.SE

Ítalo Oliveira , Stefano M. Nicoletti , Gal Engelberg , Mattia Fumagalli , Dan Klein , Giancarlo Guizzardi This is my paper
classification cs.CRcs.SE
keywords attacktreesontologicalanalysisCOVERontologyUFOriskmanagementsemanticinteroperabilitysecuritymetricsconceptualmodeling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that attack trees (ATs), a widely used formalism for security risk analysis, are not ontologically adequate: the language has no explicit grounding in a theory of what its nodes and edges denote. Using the Common Ontology of Value and Risk (COVER) as a reference, the paper identifies four shortcomings: ambiguous or overloaded node and gate meanings, missing domain concepts such as vulnerability and stakeholder, no guidance for decomposing a goal, and weak semantic interoperability across tools and datasets. The authors claim that because qualitative and quantitative AT analyses operate directly on the model, these defects can make computed minimal attacks and security metrics unreliable or misleading. The proposed way forward is to ground ATs in a well-founded risk ontology, treat them as one service within a broader ontology-based risk-management modeling framework, and use metadata to trace each AT element back to that ontology.

What carries the argument

The argument is carried by the ontological analysis method: a language's metamodel is systematically compared with a reference ontology, and adequacy requires the mapping between modeling primitives and ontology concepts to be bijective. The reference ontology is COVER, built on UFO, which supplies a theory of risk as relative, experiential, and contextual, with a pattern in which threatening situations trigger dispositions that manifest as risk events. The paper applies this lens to a UML metamodel of static ATs (root, intermediate nodes, leaves, AND/OR gates, metric assignments) and catalogues where the mapping breaks down: construct overload, construct deficit, missing guidance, and broken interoperability. This mechanism lets the authors diagnose all four shortcomings from a single root cause— the absence of an ontological foundation.

What would settle it

Ask two independent groups of security analysts to model the same concrete attack scenario as an attack tree, one group with only the standard syntax and one group given an ontology-based template that forces explicit categorization of threat objects, risk subjects, vulnerabilities, and event types. If both groups produce trees with the same minimal attack sets and the same rankings under standard security metrics, the practical impact of the alleged ontological defects would be shown to be negligible; if the ontology-guided group's trees differ in those outputs, the paper's claim that missing ontological foundations compromise AT services is supported.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that the static AT language fails the isomorphism requirement of ontological analysis: its metamodel cannot be mapped bijectively onto the concepts of COVER/UFO. Concretely, a single node may denote a goal, an intention, an event, an event type, a situation, or an object, while an AND-gate may express mereological composition, causation, intention parthood, or plain logical conjunction. The paper shows that security metrics such as cost, probability, and skill attach to these ambiguous leaves, so the same equation can be read as computing very different quantities depending on the unstated interpretation. It also shows that the language lacks explicit elements for threat objects, risk subjects, assets, and vulnerabilities, which are essential to the ISO risk-management process, and that this lack blocks systematic construction, integration, and interoperability of ATs. The positive claim is that a top-down approach— defining ATs in terms of a reference risk ontology and using them as a service of an ontology-based DSL— would resolve these defects.

Load-bearing premise

The load-bearing premise is that a modeling language is adequate only when each of its constructs maps one-to-one onto a chosen reference ontology such as COVER; if attack trees are instead deliberately abstract Boolean expressions with an operational semantics, the alleged ambiguity becomes a design choice rather than a defect.

Editorial extensions

If this is right

  • Qualitative results such as minimal attack sets are only as meaningful as the labels assigned to nodes; with no machine-readable meaning, two formally identical trees can denote entirely different attacks.
  • Quantitative metrics such as cost, time, probability, and damage attach to an unspecified kind of entity, so the same metric algorithm can yield values that are not comparable across models.
  • Extending the language with new gates or node types (for example, sequential AND or defense nodes) without an underlying ontology tends to increase ambiguity rather than fix it.
  • Attack trees are best used as one service within an ontology-grounded risk-management modeling framework, not as a standalone conceptual modeling language.
  • The same lack of ontological foundations likely affects other risk assessment techniques, including fault trees and Bayesian networks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One consequence the paper leaves implicit: if ATs are defined as projections of a knowledge graph that instantiates a risk ontology, existing AT algorithms could run unmodified on query results, gaining traceability without changing the mathematics.
  • The identity-criteria problem suggests that audit or certification artifacts built from ATs should carry a semantic fingerprint tied to the underlying scenario model, otherwise two graphs with the same shape can be falsely taken to agree.
  • A testable extension would be an empirical inter-analyst study: have independent analysts build attack trees from the same scenario with and without ontology-based guidance, and compare the resulting minimal attack sets. The paper hypothesizes divergence but does not measure it.
  • The analysis could be applied symmetrically to fault trees and Bayesian networks, as the paper hints, potentially yielding a family of risk techniques that share a single well-founded ontology and can therefore be composed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper presents an ontological analysis of static attack trees (ATs), arguing that the AT language lacks an ontological foundation and that this causes four shortcomings: semantic overload of nodes, gates, and metrics (S1); construct deficit relative to a risk ontology (S2); lack of modeling guidance (S3); and lack of semantic interoperability (S4). The analysis is grounded in COVER, a core ontology based on UFO, and uses the Wand–Weber idea that a modeling language should be isomorphic to a reference ontology. The paper illustrates the shortcomings with examples drawn from the AT literature, including a PIN-theft tree and a SCADA example, and proposes a top-down approach in which a well-founded domain-specific language and an ontology-backed knowledge graph support attacks trees as a computational service rather than as a primary modeling notation.

Significance. The paper is a careful conceptual analysis that identifies real ambiguities in how AT nodes, edges, and gates are described and interpreted across the literature. Its strengths are the concrete grounding in cited AT examples, the clear presentation of COVER, and the recognition that node labels carry semantic weight in practice even though they are formally opaque. The proposed direction toward ontology-backed metadata and a service-oriented use of AT algorithms is constructive and relevant for communities working on model-driven security and risk analysis. The paper does not claim to provide a complete solution and it is honest about the parts of the interoperability claim that are only hypotheses. If the central adequacy criterion can be defended, the analysis could help shape future AT extensions and risk-management modeling frameworks.

major comments (3)
  1. [Section 4, first paragraph] The paper adopts the Wand–Weber isomorphism criterion as the rationale for judging AT adequacy, but it does not defend this criterion against the well-established alternative reading of static ATs as abstract Boolean expressions with an operational semantics, which the paper itself presents in Section 2 through the structure function n OR (t AND p) and the definition of semantics as the set of minimal attacks. Under that reading, the six interpretations of the AND-gate listed in Section 4.1 all coincide on the formal services the paper uses to motivate the analysis: minimal attacks, qualitative assessment, and semiring-based metrics are invariant to whether 'intercept transactions' is an event, a proposition, or a subgoal. The paper even concedes in Section 4.1 that a node description 'is merely a label or annotation.' Therefore, S1 as a defect of the language, rather than a property of user interpretation, is not established unless the isomorphism criterion is justified or the paper shows that the ambiguity affects the computed services in a meaningful way. This is load-bearing for the central claim.
  2. [Section 4.2] The construct deficit (S2) is measured against COVER's vocabulary, but the paper does not argue why COVER is the correct or unique reference ontology for attack trees. As the paper itself notes in Section 5, other reference ontologies such as ROSE exist, and a different reference would yield a different list of missing concepts. Without an argument that the listed concepts (vulnerability, stakeholder, asset, etc.) are required for the services that ATs are supposed to provide, S2 is a relative statement about COVER rather than an intrinsic deficiency of ATs. The paper should either justify the choice of COVER as a normative standard for security risk modeling or present evidence that the absence of these concepts leads to incorrect or misleading results in the qualitative or quantitative analyses that ATs support.
  3. [Section 4.4] The human-communication interoperability claim is explicitly introduced as a hypothesis: 'we hypothesize that two persons making an AT separately for describing a given security risk scenario will create completely different ATs.' The paper does not test this hypothesis or provide empirical evidence, and the identity-criteria argument in the same subsection assumes that node descriptions are not part of the formal language. Since the formal semantics give identity criteria based on the Boolean structure and the set of minimal attacks, it is not obvious that two ATs with the same structure but different labels are the 'same' or 'different' in a way that undermines interoperability. This part of S4 is presented as a consequence of the earlier analysis but is speculative, and the paper should either provide evidence or clearly separate this claim from the more concrete data-interoperability and technique-interoperability arguments.
minor comments (4)
  1. [Section 4.1, paragraph on edge and gate ambiguity] The sentence 'An AND-gate would represent necessary contributions to reach a goal' is clear, but the surrounding list would benefit from a summary sentence that distinguishes which of the six readings are ontologically incompatible versus those that coincide on the formal semantics.
  2. [Section 4.2, SCADA example] The phrase 'the attacker should verb placeholder "Incorrect estimates to customers"' appears to be a formatting artifact and should be replaced with a complete verb or rephrased.
  3. [Section 2, Figure 1 description] The sentence 'This is represented by the logical AND-gate that decorates the cryptoattack subgoal' uses 'this' ambiguously; it could refer to the conjunction of the two subgoals or to the requirement that both need to be satisfied.
  4. [Section 4, Figure 2] The UML class diagram is described as 'a representation of the AT symbols in the UML Class Diagram,' but the notation of the diagram is not fully explained in the text; a brief explanation of cardinalities and association names would improve readability.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the analysis applies an explicitly declared, externally sourced isomorphism criterion; the alleged deficits are relative to the chosen reference ontology but are not derived from the conclusion itself.

full rationale

The paper's central derivation is conditional on a clearly stated normative premise: a modeling language's metamodel should be isomorphic to a reference ontology (Sec. 4.0, following Wand-Weber [17] and Guizzardi et al. [18]). From that premise, plus an application of COVER/UFO categories to static AT constructs, the paper derives shortcomings S1-S4. This is a syllogism, not a circular reduction: the conclusion does not appear among the premises, and no fitted parameter or predicted quantity is renamed as a finding. The external examples of ambiguous AT node labels (Bouchti and Haqiq; Kumar et al.) and the formal Boolean semantics of ATs from [8] supply independent content. The paper itself acknowledges that node descriptions are 'merely a label or annotation' (Sec. 4.1), which means the semantic overload it identifies resides in user interpretations; whether that is a genuine defect is a correctness or normative question, not a circularity. Self-citations to COVER [3], UFO [4], and the isomorphism criterion [18] provide the evaluative yardstick, but the yardstick is also grounded in the independent Wand-Weber tradition, and no claim in the paper reduces to an unverified self-citation chain. The reader's concern that a different reference ontology (e.g., ROSE) would yield different deficits is a challenge to the choice of standard, not evidence that the derivation is circular. Accordingly, the paper is not significantly circular; the score of 1 reflects only the acknowledged reliance on the authors' own COVER/UFO framework as the normative reference, without treating that reliance as a load-bearing circular step.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The central claim depends on accepting the UFO/COVER ontology as the norm for risk modeling and the isomorphism criterion for language adequacy. Neither is proven in the paper; both are imported from prior work by the same research community. No numeric free parameters are fitted, and no new entities are postulated.

assumptions (3)
  • domain assumption UFO/COVER is the correct reference ontology for risk.
    The whole analysis evaluates ATs from within UFO/COVER (Section 3), and the authors are among the creators of COVER; no independent justification is offered for preferring it over alternative risk ontologies.
  • domain assumption A language metamodel must be isomorphic to the reference ontology to be adequate.
    Section 4.0 asserts this criterion based on [17,18] without defending it against the alternative that ATs are deliberately abstract Boolean calculi.
  • domain assumption The quoted example ATs are representative of general AT practice.
    The semantic-overload argument is built from selected examples in [20] and [9]; no systematic corpus or user study supports their representativeness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of An ontological lens on attack trees: Toward adequacy and interoperability." pith.science (2026). https://pith.science/paper/GLX4PRBS

@misc{pith2026250623841,
  author       = {Pith},
  title        = {Pith review of: An ontological lens on attack trees: Toward adequacy and interoperability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GLX4PRBS}},
  note         = {Machine review of arXiv:2506.23841}
}
read the original abstract

Attack Trees (AT) are a popular formalism for security analysis. They are meant to display an attacker's goal decomposed into attack steps needed to achieve it and compute certain security metrics (e.g., attack cost, probability, and damage). ATs offer three important services: (a) conceptual modeling capabilities for representing security risk management scenarios, (b) a qualitative assessment to find root causes and minimal conditions of successful attacks, and (c) quantitative analyses via security metrics computation under formal semantics, such as minimal time and cost among all attacks. Still, the AT language presents limitations due to its lack of ontological foundations, thus compromising associated services. Via an ontological analysis grounded in the Common Ontology of Value and Risk (COVER) -- a reference core ontology based on the Unified Foundational Ontology (UFO) -- we investigate the ontological adequacy of AT and reveal four significant shortcomings: (1) ambiguous syntactical terms that can be interpreted in various ways; (2) ontological deficit concerning crucial domain-specific concepts; (3) lacking modeling guidance to construct ATs decomposing a goal; (4) lack of semantic interoperability, resulting in ad hoc stand-alone tools. We also discuss existing incremental solutions and how our analysis paves the way for overcoming those issues through a broader approach to risk management modeling.

Figures

Figures reproduced from arXiv: 2506.23841 by the authors.

Figure 1
Figure 1. A simple AT representing attacks to obtain a digital PIN, from [8]. Syntactically, ATs are rooted directed acyclic graphs (DAGs) with typed nodes [8] [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. A representation of the AT symbols in the UML Class Diagram [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 35 canonical work pages

  1. [1]

    ISO 31000:2018 - Risk management – Guidelines; 2018

    ISO. ISO 31000:2018 - Risk management – Guidelines; 2018

    work page 2018

  2. [2]

    ISO/IEC 31010:2019 - Risk management – Risk Assessment Techniques; 2019

    ISO/IEC. ISO/IEC 31010:2019 - Risk management – Risk Assessment Techniques; 2019

    work page 2019

  3. [3]

    The common ontology of value and risk

    Sales TP, et al. The common ontology of value and risk. In: ER 2018. vol. 11157; 2018. p. 121-35

    work page 2018

  4. [4]

    UFO: Unified foundational ontology

    Guizzardi G, et al. UFO: Unified foundational ontology. Applied ontology. 2022;17(1):1-44

    work page 2022

  5. [5]

    Attack trees

    Schneier B. Attack trees. Dr Dobb’s journal. 1999;24(12):21-9

    work page 1999

  6. [6]

    UMLsec: Extending UML for Secure Systems Development

    J ¨urjens J. UMLsec: Extending UML for Secure Systems Development. In: UML 2002 — The Unified Modeling Language. vol. 2460 of LNCS. Springer Berlin Heidelberg; 2002. p. 412-25

    work page 2002

  7. [7]

    SysML-Sec: A model driven approach for designing safe and secure systems

    Roudier Y , Apvrille L. SysML-Sec: A model driven approach for designing safe and secure systems. In: MODELSW ARD. IEEE; 2015. p. 655-64

    work page 2015

  8. [8]

    Efficient and generic algorithms for quantitative attack tree analysis

    Lopuha ¨a-Zwakenberg M, et al. Efficient and generic algorithms for quantitative attack tree analysis. IEEE Transactions on Dependable and Secure Computing. 2022;20(5):4169-87

    work page 2022

Show all 35 references
  1. [9]

    Quantitative Attack Tree Analysis via Priced Timed Automata

    Kumar R, et al. Quantitative Attack Tree Analysis via Priced Timed Automata. In: FORTE. vol. 9268 of LNCS. Berlin Heidelberg: Springer International Publishing; 2015. p. 156-71

    2015

  2. [10]

    Effective Analysis of Attack Trees: A Model-Driven Approach

    Kumar R, et al. Effective Analysis of Attack Trees: A Model-Driven Approach. In: FASE. vol. 10802. Berlin Heidelberg: Springer; 2018. p. 56-73

    2018

  3. [11]

    Rational Choice of Security Measures Via Multi-parameter Attack Trees

    Buldas A, et al. Rational Choice of Security Measures Via Multi-parameter Attack Trees. In: CRITIS. vol. 4347 of LNCS. Berlin Heidelberg: Springer Berlin Heidelberg; 2006. p. 235-48

    2006

  4. [12]

    Attack Trees with Sequential Conjunction

    Jhawar R, et al. Attack Trees with Sequential Conjunction. In: SEC. vol. 455 of IFIPAICT. Berlin Heidelberg: Springer International Publishing; 2015. p. 339-53

    2015

  5. [13]

    Foundations of attack trees

    Mauw S, Oostdijk M. Foundations of attack trees. In: Information Security and Cryptology-ICISC 2005: 8th International Conference, Seoul, Korea, December 1-2, 2005. Springer; 2006. p. 186-98

    2005

  6. [14]

    Towards ontological foundations for the conceptual modeling of events

    Guizzardi G, et al. Towards ontological foundations for the conceptual modeling of events. In: Concep- tual Modeling: 32th International Conference, ER 2013. Springer; 2013. p. 327-41

    2013

  7. [15]

    Representing a reference foundational ontology of events in SROIQ

    Benevides AB, et al. Representing a reference foundational ontology of events in SROIQ. Applied Ontology. 2019;14(3):293-334

    2019

  8. [16]

    Understanding and Modeling Prevention

    Baratella R, et al. Understanding and Modeling Prevention. In: Research Challenges in Information Science. RCIS 2022. vol. 389–405. Springer; 2022. p. 389-405

    2022

  9. [17]

    Ace on the River

    Wand Y , Weber R. An ontological evaluation of systems analysis and design methods. In: Information Systems Concepts: An In-depth Analysis. Namur, Belgium: Elsevier;. p. 79-107. 7J. von Neumann, quoted by professional gambler B. Greenstein in his autobiography “Ace on the Rive...

    2025

  10. [18]

    On ontology, ontologies, conceptualizations, modeling languages, and (meta) models

    Guizzardi G, et al. On ontology, ontologies, conceptualizations, modeling languages, and (meta) models. Frontiers in artificial intelligence and applications. 2007;155:18

    2007

  11. [19]

    Social Modeling for Requirements Engineering: An Introduction

    Yu E, et al. Social Modeling for Requirements Engineering: An Introduction. Social Modeling for requirements engineering. 2011;760

    2011

  12. [20]

    Modeling cyber-attack for SCADA systems using CoPNet approach

    El Bouchti A, Haqiq A. Modeling cyber-attack for SCADA systems using CoPNet approach. In: 2012 IEEE International Conference on Complex Systems (ICCS). IEEE; 2012. p. 1-6

    2012

  13. [21]

    Enhancing Cybersecurity Proactive Decision-Making Through Attack Tree Analysis and MITRE Framework

    Husseis A, et al. Enhancing Cybersecurity Proactive Decision-Making Through Attack Tree Analysis and MITRE Framework. In: ICCST. IEEE; 2023. p. 1-5

    2023

  14. [22]

    Boosting D3FEND: Ontological analysis and recommendations

    Oliveira ´I, et al. Boosting D3FEND: Ontological analysis and recommendations. In: Formal Ontol- ogy in Information Systems: Proceedings of the Thirteenth International Conference (FOIS 2023). vol. forthcoming. IOS Press; 2023

    2023

  15. [23]

    Ontology pattern languages

    Falbo R, et al. Ontology pattern languages. In: Ontology Engineering with Ontology Design Patterns. IOS press; 2016. p. 133-59

    2016

  16. [24]

    Ontology-based security modeling in ArchiMate

    Oliveira ´I, et al. Ontology-based security modeling in ArchiMate. SoSyM. 2024;23(4):925-52

    2024

  17. [25]

    Explanation, semantics, and ontology

    Guizzardi G, Guarino N. Explanation, semantics, and ontology. Data & Knowledge Engineering. 2024;153

    2024

  18. [26]

    Attack–defense trees

    Kordy B, et al. Attack–defense trees. Journal of logic and computation. 2014;24(1):55-87

    2014

  19. [27]

    Toward an ontology-based modeling for risk management

    Oliveira ´I, et al. Toward an ontology-based modeling for risk management. In: Proceedings of the 18th International Workshop on Value Modelling and Business Ontologies (VMBO 2025); 2025

    2025

  20. [28]

    An Ontology of Security from a Risk Treatment Perspective

    Oliveira ´I, et al. An Ontology of Security from a Risk Treatment Perspective. In: Conceptual Modeling. ER 2022. vol. 13607. Cham: Springer; 2022. p. 365-79

    2022

  21. [29]

    On the semantics of risk propagation

    Fumagalli M, et al. On the semantics of risk propagation. In: International Conference on Research Challenges in Information Science. Springer; 2023. p. 69-86

    2023

  22. [30]

    gUFO: A Lightweight Implementation of the Unified Foundational Ontology (UFO); 2019

    Almeida JPA, et al.. gUFO: A Lightweight Implementation of the Unified Foundational Ontology (UFO); 2019. Available from: http://purl.org/nemo/doc/gufo

    2019

  23. [31]

    Attack trees with sequential conjunction

    Jhawar R, et al. Attack trees with sequential conjunction. In: IFIP International Information Security and Privacy Conference. Springer; 2015. p. 339-53

    2015

  24. [32]

    Foundations of attack–defense trees

    Kordy B, et al. Foundations of attack–defense trees. In: Formal Aspects of Security and Trust: 7th International Workshop, FAST 2010, Pisa, Italy, September 16-17, 2010. Springer; 2011. p. 80-95

    2010

  25. [33]

    Guided design of attack trees: a system-based approach

    Audinot M, et al. Guided design of attack trees: a system-based approach. In: 2018 IEEE 31st Computer Security Foundations Symposium (CSF). IEEE; 2018. p. 61-75

    2018

  26. [34]

    Is my attack tree correct? In: ESORICS 2017; 2017

    Audinot M, Pinchinat S, Kordy B. Is my attack tree correct? In: ESORICS 2017; 2017. p. 83-102

    2017

  27. [35]

    Library-based attack tree synthesis

    Pinchinat S, Schwarzentruber F, L ˆe Cong S. Library-based attack tree synthesis. In: GraMSec 2020

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.