Evaluate the Kettle & Co attack tree: cost an OR-node as the minimum of its children and an AND-node as the sum, then print each branch's cost and the cheapest path to the root goal.

Answer

tree = ('OR', 'card number', [ ('AND', 'from the database', [ ('OR', 'shell on the app server', [(5, 'SQLi'), (9, 'stolen SSH key')]), (12, 'decrypt the blob'), ]), ('AND', 'in transit', [(7, 'on the path'), (25, 'break TLS')]), ('OR', 'ask the user', [(3, 'phish'), (6, 'phone as support')]), ]) def cost(node): if isinstance(node[0], int): return node[0], node[1] op, label, kids = node scored = [cost(k) for k in kids] if op == 'OR': c, path = min(scored) return c, label + ' > ' + path return sum(c for c, _ in scored), label + ' > ' + ' + '.join(p for _, p in scored) for branch in tree[2]: print(branch[0], branch[1], '=', cost(branch)[0]) c, path = cost(tree) print('cheapest:', c, '|', path)

Stallings & Brown 5e ch1 §1.6–1.7; attack trees after [SCHN99], [MOOR01], [MAUW05]