Squeezing State Spaces of (Attack-Defence) Trees l Knapik 1 Wojciech - PowerPoint PPT Presentation

Squeezing State Spaces of (Attack-Defence) Trees l Knapik 1 Wojciech Penczek 1 Micha� Laure Petrucci 2 Teofil Sidoruk 1 1 Institute of Computer Science, Polish Academy of Sciences 2 LIPN, CNRS UMR 7030, Universit´ e Sorbonne Paris Nord LAMAS May 10, 2020 M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 1 / 11

Motivation Attack-Defence Trees [Kordy et al., 2011, Aslanyan and Nielson, 2015] allow for studying interactions between attacker and defender parties: ◮ performance ◮ feasibility An agent-aware model ◮ asynchronous multi-agent systems, an automata-based formalism [Jamroga et al., 2018] ◮ extended with attributes and functions ◮ quantitative and qualitative analysis M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 2 / 11

Attack-Defence Trees Name Cost Time TS (treasure stolen) TS p (police) e 100 10 min TF (thieves fleeing) ST (steal treasure) 2 min p TF b (bribe gatekeeper) e 500 1 h f (force arm. door) e 100 2 h GA (get away) ST GA h (helicopter) e 500 3 min e (emergency exit) 10 min e b f h Condition for TS: init time ( p ) > init time ( ST ) + time ( GA ) M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 3 / 11

Exhaustive analysis ◮ Build the EAMAS by replacing each ADTree node by an automaton ◮ State space explosion Modelling with reduced patterns [Arias et al., 2019] ? a 2 ok A l 1 l 2 · · · l n l A k o 1 a ? A ! A ok ? a 1 nok l 0 ? a 2 nok a 1 a n · · · . . ? a n nok . l ′ ! A nok 1 M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 4 / 11

Exhaustive analysis ◮ Build the EAMAS by replacing each ADTree node by an automaton ◮ State space explosion Modelling with reduced patterns [Arias et al., 2019] ? a 2 ok A l 2 · · · l n l 1 l A k o 1 a ? A ! A ok ? a 1 nok l 0 ? a 2 nok a 1 · · · a n . . ? a n nok . l ′ ! A nok 1 M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 4 / 11

Exhaustive analysis ◮ Build the EAMAS by replacing each ADTree node by an automaton ◮ State space explosion Modelling with reduced patterns [Arias et al., 2019] Goes beyond POR! ? a 2 ok A l 1 l 2 · · · l n l A k o a 1 ? A ! A ok ? a 1 nok l 0 ? a 2 nok a 1 a n · · · . . ? a n nok . l ′ ! A nok 1 M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 4 / 11

Exhaustive analysis ◮ Build the EAMAS by replacing each ADTree node by an automaton ◮ State space explosion Modelling with reduced patterns [Arias et al., 2019] Goes beyond POR! ? a 2 ok A l 1 l 2 · · · l n l A k o a 1 ? A ! A ok ? a 1 nok l 0 ? a 2 nok a 1 a n · · · . . ? a n nok . l ′ ! A nok 1 Patterns state space reduction is not enough! M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 4 / 11

Outline Guarded Update Systems 1 General Definition Properties for Tree Topologies Layered Reduction for Trees 2 Experiments 3 Conclusion & Perspectives 4 M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 5 / 11

Guarded Update Systems Asynchronous product of automata equipped with: ◮ integer variables ◮ guards: boolean formulae over linear terms on variables ◮ updates: assignments obtained by functions over variables ◮ in synchronised transitions, a variable should not be updated more than once GUS synchronisation topology ◮ nodes: individual automata ◮ edges: connect nodes that share a synchronised transition M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 6 / 11

Guarded Update Systems Asynchronous product of automata equipped with: ◮ integer variables ◮ guards: boolean formulae over linear terms on variables ◮ updates: assignments obtained by functions over variables ◮ in synchronised transitions, a variable should not be updated more than once GUS synchronisation topology ◮ nodes: individual automata ◮ edges: connect nodes that share a synchronised transition M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 6 / 11

Properties for Tree Topologies Precedence Actions synchronised with children actions occur before the other ones Root-directed Synchronisation Tree Precedence is satisfied for the whole tree Update separability ◮ a variable is updated in at most one component ◮ it is tested only in the ancestors of this component in the tree ADTrees topologies are root-directed and update-separable M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 7 / 11

Properties for Tree Topologies Precedence Actions synchronised with children actions occur before the other ones Root-directed Synchronisation Tree Precedence is satisfied for the whole tree Update separability ◮ a variable is updated in at most one component ◮ it is tested only in the ancestors of this component in the tree ADTrees topologies are root-directed and update-separable M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 7 / 11

Layered Reduction for Trees ? out 1 ? out 2 v ≥ 0 l 0 l 1 l 2 M F ? in 2 ? in 3 ? in 1 l 0 l 1 l 0 l 1 l 2 M N 1 M N 2 ! out 1 ? in 4 ! out 2 ! in 1 ! in 4 ! in 2 ! in 3 l 0 l 0 l 1 l 2 l 0 v := 1 M C 1 M C 2 M C 3 State space size Full: 14 states, 19 edges Reduced: 12 states, 14 edges M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 8 / 11

Layered Reduction for Trees ? out 1 ? out 2 , d 1 := d 1 + 2 v ≥ 0 l 0 l 1 l 2 M F ? in 3 , d 2 := d 2 + 2 ? in 2 ? in 1 , d 2 := d 2 + 1 l 0 l 1 l 0 l 1 l 2 M N 1 M N 2 ! out 1 ? in 4 , d 2 := d 2 + 2 ! out 2 ! in 1 ! in 4 ! in 2 ! in 3 l 0 l 0 l 1 l 2 l 0 v := 1 M C 1 M C 2 M C 3 State space size Full: 14 states, 19 edges Reduced: 12 states, 14 edges M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 8 / 11

Layered Reduction for Trees ? out 1 ? out 2 , d 1 := d 1 + 2 v ≥ 0 l 0 l 1 l 2 M F ? in 3 , d 2 := d 2 + 2 ? in 2 ? in 1 , d 2 := d 2 + 1 l 0 l 1 l 0 l 1 l 2 M N 1 M N 2 d 2 = 3 , ! out 1 ? in 4 , d 2 := d 2 + 2 d 2 = 3 , ! out 2 ! in 1 ! in 4 ! in 2 ! in 3 l 0 l 0 l 1 l 2 l 0 v := 1 M C 1 M C 2 M C 3 State space size Full: 14 states, 19 edges Reduced: 12 states, 14 edges M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 8 / 11

Layered Reduction for Trees ? out 1 ? out 2 , d 1 := d 1 + 2 v ≥ 0 l 0 l 1 l 2 M F ? in 3 , d 2 := d 2 + 2 ? in 2 ? in 1 , d 2 := d 2 + 1 l 0 l 1 l 0 l 1 l 2 M N 1 M N 2 d 2 = 3 , ! out 1 ? in 4 , d 2 := d 2 + 2 d 2 = 3 , ! out 2 ! in 1 ! in 4 ! in 2 ! in 3 l 0 l 0 l 1 l 2 l 0 v := 1 M C 1 M C 2 M C 3 State space size Full: 14 states, 19 edges Reduced: 12 states, 14 edges M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 8 / 11

Experiments Experimental setup ◮ model-checker IMITATOR (http://imitator.fr) ◮ 2 . 7 GHz Intel Core i7, with 16 GB of memory ◮ timeout of 30 minutes Some case studies applying both reductions vs. patterns vs. full Case study % size % reduction % size % reduction treasure-hunters 47 . 44 % 52 . 56 % 13 . 26 % 86 . 74 % forestall 24 . 97 % 75 . 03 % 2 . 37 % 97 . 63 % iot-dev 40 . 90 % 59 . 10 % 8 . 53 % 91 . 47 % gain-admin No Timeout! M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 9 / 11

Experiments Experimental setup ◮ model-checker IMITATOR (http://imitator.fr) ◮ 2 . 7 GHz Intel Core i7, with 16 GB of memory ◮ timeout of 30 minutes Some case studies applying both reductions vs. patterns vs. full Case study % size % reduction % size % reduction treasure-hunters 47 . 44 % 52 . 56 % 13 . 26 % 86 . 74 % forestall 24 . 97 % 75 . 03 % 2 . 37 % 97 . 63 % iot-dev 40 . 90 % 59 . 10 % 8 . 53 % 91 . 47 % gain-admin No Timeout! M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 9 / 11

Scaling up Experiments Scalability of different reductions (2 child nodes) 10000000 1000000 100000 10000 1000 100 10 1 depth 4 4 6 8 4 6 8 10 4 6 8 10 4 6 8 10 4 6 8 4 6 4 4 width 2 3 3 3 4 4 4 4 5 5 5 5 6 6 6 6 7 7 7 8 8 9 10 ADT nodes 7 9 13 15 11 15 17 23 13 17 19 25 15 19 21 27 17 21 23 19 23 21 23 both S both T patterns S patterns T layers S layers T no reduction S no reduction T M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 10 / 11

Conclusion & Perspectives Summary ◮ A framework for model-checking systems that manipulate data ◮ Layered reduction approach to harness state space explosion ◮ Gains confirmed by extensive experiments on Attack-Defence Trees Future work ◮ Extend the approach to DAGs ◮ Take into account the assignment of agents to ADTree nodes ◮ Study other application domains exhibiting such topologies (e.g. workflows) ◮ Use as a basis for a compositional and parallel analysis M. Knapik, W. Penczek, L. Petrucci, T. Sidoruk Squeezing State Spaces of (AD)Trees LAMAS, May 2020 11 / 11