  Attack Trees are a graphical model of security used to study threat
scenarios. While visually appealing and supported by solid theories and
effective tools, one of their main drawbacks remains the amount of effort
required by security experts to design them from scratch. This work aims to
remedy this by providing a method for the automatic generation of Attack Trees
from attack logs. The main original feature of our approach w.r.t existing ones
is the use of Process Mining algorithms to synthesize Attack Trees, which allow
users to customize the way a set of logs are summarized as an Attack Tree, for
example by discarding statistically irrelevant events. Our approach is
supported by a prototype that, apart from the derivation and translation of the
model, provides the user with an Attack Tree in the RisQFLan format, a tool
used for quantitative risk modeling and analysis with Attack Trees. We
illustrate our approach with the case study of attacks on a communication
protocol, produced by a state-of-the-art protocol analyzer.
