Modelling fraud detection by attack trees and Choquet integral

Silvia Bortot, Mario Fedrizzi and Silvio Giove

No 2011/09, DISA Working Papers from Department of Computer and Management Sciences, University of Trento, Italy

Abstract: Modelling an attack tree is basically a matter of associating a logical "and" and a logical "or" but in most of real world applications related to fraud management the "and/or"logic is not adequate to effectively represent the relationship between a parent node and its children, most of all when information about attributes is associated to the nodes and the main problem to solve is how to promulgate attribute values up the tree through recursive aggregation operations occurring at the "and/or"nodes. OWA-based aggregations have been introduced to generalize "and" and "or" operators starting from the observation that in between the extremes "or all"(and) and "or any"(or), terms (quantifiers) like "several" "most" "few" "some" etc. can be introduced to represent the different weights associated to the nodes in the aggregation. The aggregation process taking place at an OWA node depends on the ordered position of the child nodes but it doesn't take care of the possible interactions between the nodes. In this paper, we propose to overcome this drawback introducing the Choquet integral whose distinguished feature is to be able to take into account the interaction between nodes. At first, the attack tree is valuated recursively through a bottom-up algorithm whose complexity is linear versus the number of nodes and exponential for every node. Then, the algorithm is extended assuming that the attribute values in the leaves are unimodal LR fuzzy numbers and the calculation of Choquet integral is carried out using the alpha-cuts.

Keywords: Fraud detection; attack tree; ordered weighted averaging (OWA) operator; Choquet integral; fuzzy numbers. (search for similar items in EconPapers)
Pages: 22 pages
Date: 2011-08, Revised 2011-08-31
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://www.unitn.it/files/download/13980/92011.pdf (application/pdf)
Our link check indicates that this URL is bad, the error code is: 404 Not Found (http://www.unitn.it/files/download/13980/92011.pdf [302 Found]--> https://www.unitn.it/files/download/13980/92011.pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:trt:disawp:2011/09

Ordering information: This working paper can be ordered from
DISA Università degli Studi di Trento via Inama, 5 I-38122 Trento TN Italy
http://www.unitn.it/disa

Access Statistics for this paper

More papers in DISA Working Papers from Department of Computer and Management Sciences, University of Trento, Italy Contact information at EDIRC.
Bibliographic data for series maintained by Roberto Gabriele ().