  Joint safety and security analysis of cyber-physical systems is a necessary
step to correctly capture inter-dependencies between these properties.
Attack-Fault Trees represent a combination of dynamic Fault Trees and Attack
Trees and can be used to model and model-check a holistic view on both safety
and security. Manually creating a complete AFT for the whole system is,
however, a daunting task. It needs to span multiple abstraction layers, e.g.,
abstract application architecture and data flow as well as system and library
dependencies that are affected by various vulnerabilities. We present an AFT
generation tool-chain that facilitates this task using partial Fault and Attack
Trees that are either manually created or mined from vulnerability databases.
We semi-automatically create two system models that provide the necessary
information to automatically combine these partial Fault and Attack Trees into
complete AFTs using graph transformation rules.
