The study, published in Frontiers in the Internet of Things, presents a threat modelling approach built around dynamic attack graphs, a technique that charts every route an attacker could take across a network to compromise a target. Traditional attack-graph methods were designed for static enterprise networks, where topology changes rarely and graphs can be computed once and consulted indefinitely. The result is often a single, enormous diagram that becomes obsolete the instant a new device appears. In an IoT environment, where whole sub-systems can interconnect dynamically and outside the operator’s control, such static snapshots are dangerously misleading.

The researcher behind the work, Marwa Salayma of Imperial College London’s Department of Computing, tackled the problem by combining attack graphs with a graph database management system called Neo4j. Graph databases store information as nodes connected by edges, mirroring the structure of highly interconnected data such as network topologies. Unlike relational databases, which require expensive join operations with a complexity of O(n^d) to traverse a graph of n nodes and depth d, Neo4j follows the direct edges between related nodes, so query time depends only on the size of the resulting sub-graph rather than the total network. This architectural difference, the study notes, is faster than relational approaches by many orders of magnitude.

To illustrate the challenge, the paper develops a healthcare scenario in which a patient wearing a body sensor network, comprising a smartwatch and a smartphone gateway, visits a clinic. The clinic’s network contains workstations across three floors, a database server holding medical records, routers implementing packet-filtering firewalls, and a connection to the wider Internet. Each device carries real vulnerabilities drawn from the National Vulnerability Database, including CVE-2017-6753 in a web browser, CVE-2021-41635 in an FTP service, and CVE-2009-2446 in the database’s MySQL software. When the patient’s devices enter Bluetooth range of the clinic’s equipment, reachability between the two systems changes, and with it the entire set of possible attack paths.

The approach models this in three layers. First, a network topology graph captures devices, routers, vulnerabilities, and firewall rules as nodes and edges, with attributes recording each device’s accessibility features such as IP, FTP, SSH, or Bluetooth. Second, a reachability graph is generated automatically from the topology, encoding which devices can communicate with which, taking into account whether they share a subnet, whether a direct point-to-point link exists, and whether firewall rules in intervening routers permit the traffic. Third, the attack graph is built from the reachability graph using a logical, exploit-dependency representation in which condition nodes capture pre- and post-conditions of exploits and exploit nodes represent the exploitation of specific vulnerabilities on specific devices.

Crucially, the attack graphs are computed independently of the topology graphs, which allows them to be merged and de-merged as systems interconnect and disconnect. Seven algorithms, implemented as Cypher queries in Neo4j, handle the full lifecycle: generating reachability from topology, generating attack graphs from reachability, merging two topology graphs when one network joins another, updating reachability only for the changed parts, merging attack graphs, and de-merging both when a network leaves. When the patient enters the clinic, new connection edges are created between Bluetooth-enabled devices in range, and the reachability query runs only against those newly created links rather than recalculating the entire network.

The performance gains are striking. Running the reachability query across all devices in the combined environment required 272 milliseconds and 201,529 database hits, whereas restricting the query to a single floor took just 10 milliseconds with 204 hits. When the patient joined the clinic, updating reachability for only the merged portion took 531 milliseconds and 1,681 database hits, a dramatic reduction compared with recalculating everything. Merging the topology graphs took 11 milliseconds, merging the attack graphs 72 milliseconds, and the de-merge operations completed in 3 and 4 milliseconds. The study also shows that the clinic’s attack graph reveals two distinct paths an external attacker could follow from the Internet to the database server, while the patient’s attack graph exposes a single route to the smartwatch through the smartphone’s Bluetooth stack.

Beyond mapping attack paths, the framework implements security metrics directly on the graphs to support risk assessment. The shortest attack path metric counts the minimum number of steps from an attacker’s starting point to the target, reflecting the intuition that attackers prefer the path of least effort and least exposure to detection. The number of attack paths metric counts how many distinct routes exist to a target, estimating the network’s overall exposure. When the patient stands on the clinic’s first floor, the merged graphs reveal eight attack paths between the patient’s smartphone and the clinic’s database server, with lengths ranging from six to ten steps. The shortest path between the smartphone and the database measures six steps.

Neither metric is sufficient on its own, the study cautions. The shortest path can be too coarse, failing to reveal how many equally short routes exist, and improving a network’s security may not change its minimum path length at all. The number of paths ignores the effort each route demands. Analysing multiple metrics together, the paper argues, is essential to avoid misleading conclusions about system risk. The author notes that the framework is designed to accommodate additional path-related metrics, including probabilistic and graph-distance measures, and that future work will extend the approach with Bayesian inference to estimate the impact of compromise on system functionality.

The broader significance lies in what the approach makes possible for defenders of critical infrastructure. Because the topology, reachability, and attack graph models can be extended simply by adding new nodes, relationships, categories, and attributes, with no changes to the database schema, the method scales naturally as environments grow. The author’s stated end goal is the delivery of tools and algorithms that can be used independently for dynamic IoT scenarios or integrated into broader attack-graph analysis and risk evaluation systems developed for enterprise networks. As IoT deployments multiply across hospitals, factories, and smart cities, the ability to redraw the attack map in milliseconds rather than hours could prove decisive in keeping pace with threats that move as fast as the networks themselves.

Subject of Research: Threat modelling in Internet of Things (IoT) environments using dynamic attack graphs

Article Title: Threat modelling in Internet of Things (IoT) environments using dynamic attack graphs

Article References: Salayma, M. (2024). Threat modelling in Internet of Things (IoT) environments using dynamic attack graphs. Frontiers in the Internet of Things, 3, Article 1306465. https://doi.org/10.3389/friot.2024.1306465

Image Credits: AI Generated

DOI: 10.3389/friot.2024.1306465

Keywords: IoT cybersecurity, dynamic attack graphs, threat modelling, Neo4j, graph database, reachability, risk assessment, healthcare security, network topology, Frontiers in the Internet of Things, Threat, modelling