RULE-BASED APPROACH USING THREATGET FOR AUTOMATICALLY GENERATING ATTACK PATHS IN INDUSTRIAL AUTOMATION AND CONTROL SYSTEMS

The rapid development and integration of Internet-based technologies in recent years have become essential for fully automating industrial control systems and enhancing decision-making, precision, and efficiency in managing complex and large-scale production systems. However, due to these remote connections, any vulnerable cybersecurity point could expose the entire system to cyberattacks. Therefore, it is essential and highly needed in such complex systems to identify any possible threats that could be triggered within the system. Additionally, building all possible paths based on the identified threats will be essential to highlight all attack paths that could pave the way for attackers to reach malicious goals. This paper introduces a novel, rule-based approach to determine and build any possible attack paths for critical assets in complex systems such as automated industrial environments. This approach is part of ThreatGet, which deeply investigates all attack steps, emphasizing the violated security prop