Lowest-Cost Attack Path (L-CAP)

Architecture Technology Corporation (ATC) proposes an attack model based on attack paths. An attack path is any sequence of steps in an attack tree that will lead to a successful attack. The model then computes the safety of the program as the minimum cost attack path, "the path of least resistance". That is, the attack path where every other attack path would be more expensive. As part of previous research, ATC has already created a low-fidelity software-protection model that was based on attack paths. That model's purpose was to help guide selection of obfuscating transforms. That model was designed to be very fast to compute and does not produce especially accurate results. For this research, ATC is proposing to use that experience to build a higher fidelity (and more time consuming) model.