I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I would like to know how one could go about creating an attach graph, what use cases they are best suited for, and how to prepare a deliverable with the attach graph with recommendations that I can turn into my boss for further review and analysis.

Any help that you could provide would be greatly appreciated.

  • 1
    are you referring to Attack Trees? (I guess strictly speaking a tree is a subset of a graph, but semantically they just feel different...)
    – AviD
    Apr 4, 2011 at 5:59
  • Besides the wikipedia entry and Bruce Schneier's article, googling also brings a lot of interesting work on the subject.
    – adamo
    Apr 4, 2011 at 7:05
  • @AviD - I am not sure what the differences are between an attack graph and an attack tree. Any help or understanding of the differences would be appreciated.
    – John
    Apr 13, 2011 at 14:39
  • Well I've never heard it called an attack graph, only an attack tree. And, judging from the answers, I'm guessing that's what you meant. As far as data structure go, a tree is a kind of a graph, so...
    – AviD
    Apr 13, 2011 at 16:09
  • Questioner uses "attach graph" twice. I can't edit that to "attack graph" because I'm not sure if it's correct and because it's less than 6 chars. But correct spelling helps search.
    – DanBeale
    Aug 10, 2011 at 12:54

3 Answers 3


I suggest the Microsoft Press book titled "Threat Modeling"

  • 2
    I agree - but it's not really much of an answer here... Wanna give some highlights?
    – AviD
    Apr 5, 2011 at 9:51

While it's not dedicated entirely to thread models, Microsoft's book on the SDL does a fairly in depth talk on the different types of models.


Besides the Microsoft book stuff, you may find interest in "The Beauty and the Beast: Vulnerabilities in Red Hat's Packages" which uses Formal Concept Analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.