Stochastic Model of the Simple Cyber Kill Chain: Cyber Attack Process as a Regenerative Process

Abstract

The proposed model extends the Markov model of the simple cyber kill chain already published in the literature by assumption of any continuous probability distribution of adversaries’ and defenders’ activity time. The description of the chain is based on the cyber kill chain concept initially introduced by Lockheed Martin’s researchers as the intrusion kill chain. The model includes the assumption of repeatability of cyber-attacks. On this basis, the stationary probabilities of staying of the attack process in individual phases were determined.