🤖 AI Summary
Existing threat detection rules lack formal consistency verification against advanced threat models. Method: This paper proposes a unified modeling and verification framework based on labeled transition systems: for the first time, it jointly maps GTDL-based detection rules and attack trees into the LNT (Language of Nested Transitions) formalism, and leverages the CADP toolset to automate system-level verification and iterative refinement via bisimulation and weak trace inclusion. The approach enables structured trace-semantics–driven parsing of attack trees, ensuring both completeness and precision in detecting threat behaviors. Results: Evaluated on real-world malware cases—including LokiBot and Emotet—the method successfully identified multiple semantic mismatches between detection logic and attack models, demonstrating its effectiveness and scalability. This work establishes the first end-to-end, automated formal verification paradigm for certifying the trustworthiness of detection rules.
📝 Abstract
Threat detection systems rely on rule-based logic to identify adversarial behaviors, yet the conformance of these rules to high-level threat models is rarely verified formally. We present a formal verification framework that models both detection logic and attack trees as labeled transition systems (LTSs), enabling automated conformance checking via bisimulation and weak trace inclusion. Detection rules specified in the Generic Threat Detection Language (GTDL, a general-purpose detection language we formalize in this work) are assigned a compositional operational semantics, and threat models expressed as attack trees are interpreted as LTSs through a structural trace semantics. Both representations are translated to LNT, a modeling language supported by the CADP toolbox. This common semantic domain enables systematic and automated verification of detection coverage. We evaluate our approach on real-world malware scenarios such as LokiBot and Emotet and provide scalability analysis through parametric synthetic models. Results confirm that our methodology identifies semantic mismatches between threat models and detection rules, supports iterative refinement, and scales to realistic threat landscapes.