As I see it, there are three ways of handling the TTCs in the simulation:

• Score: When performing an attack step, the attacker gets the TTC as a penalty.
  • This can either be the expected value, sampled once at the start of the simulation or sampled each time.
• Success Probability: When performing an attack step, the attacker has a success probability which is proportional to the TTC distribution.
• Time Ticker: When performing an attack step, the attacker spends once TTC unit towards completing the attack step. The attacker will complete the attack step once exceeding the TTC mandated by the TTC distribution associated with the attack step
  • This can be done probabilistic (the attacker having spent X TTC time units has Y probability of succeeding according to the TTC distribution). It can also be done by sampling a TTC (from the TTC distribution) each time the attacker chooses the attack step and checking if time spent on the time step exceeds the sampled value. These two methods should be equivalent. Another solution would be to sample the TTC-values at the start of the simulation and having them fixed for the duration of the simulation. The attacker would then have to choose the attack step X times before completing it.

I think the underlying questions here are:

1. What aspects of time in the hacking process are we seeking to model, in terms of a strategic simulation?
2. What sources of variability do the TTCs represent?

• Is there variability due to the exploit having some randomness in its utilization? Or is there variability because the hacker does not act as a machine? Or is it a combination of both?

Preferably the simulator should be able support all these methods, unless/until it has been shown by research, that one of these options are superior.

Thanks for writing it out. I almost assumed the third (time ticker) option.

Supporting all would be ideal, but if we can get everyone to agree that one of them is enough for their needs that could be a starting point.

We should bring your points to the next mal sim meeting.