Fuzzy Attack Tree: Assessing Cyberattack Risk Using Attack Tree and Fuzzy Logic

Nitin Naik, Paul Jenkins, Paul Grace, Dishita Naik, Jingping Song, Shaligram Prajapat, Durgesh Mishra, Longzhi Yang, Tossapon Boongoen, Natthakan Iam-On

Research output: Chapter in Book/Published conference outputConference publication


Organisations and users have been experiencing significant rises in cyberattacks and their severity, which means that they require a greater awareness and understanding of the anatomy of cyberattacks, to prevent and mitigate their effects. In analysing cyberattacks, there are a number of different approaches that may be used to assess their potential risks and effects. However, these are utilised in specific types of cyberattacks and their analysis, which means they cannot be applied in every situation or cyberattack. Moreover, several other factors may influence the decision to use these approaches, such as cost, complexity, skills and adaptability. As a result, continuous research to design and enhance these approaches is undertaken to produce a generic, cost-effective, easy and adaptable approach. This paper presents one such approach to assess the risk of cyberattacks utilising an attack tree and fuzzy logic. An attack tree is a systematic and illustrative method for describing an attack on a system and analysing its taxonomy and other aspects. Subsequently, the probability and risk of each leaf node in the attack tree are calculated using the proposed formulas. Finally, fuzzy logic enables decision making based on imprecise data and heuristics to obtain the overall risk of attack. This proposed approach comprises systematic steps to accomplish an assessment of any cyberattack and its associated risks in an uncomplicated and effective manner, enabling its prevention and mitigation to be determined. The paper illustrates an application of the proposed approach to assess the risk of an information theft attack on an organisation, which can then be utilised to assess the risk of other cyberattacks.
Original languageEnglish
Title of host publication2023 IEEE International Conference on ICT in Business Industry & Government (ICTBIG)
ISBN (Electronic)9798350343274
ISBN (Print)9798350343281
Publication statusPublished - 19 Mar 2024
EventIEEE 3rd International Conference on ICT in Business Industry & Government - Indore, India
Duration: 8 Dec 20239 Dec 2023


ConferenceIEEE 3rd International Conference on ICT in Business Industry & Government
Abbreviated titleICTBIG 2023


  • cyberattack analysis
  • attack tree
  • Fuzzy Logic
  • Fuzzy Rules
  • Probability of attack
  • Risk of attack
  • Severity of attack
  • Attack Vector
  • Information Theft Attack
  • IT Assets


Dive into the research topics of 'Fuzzy Attack Tree: Assessing Cyberattack Risk Using Attack Tree and Fuzzy Logic'. Together they form a unique fingerprint.

Cite this