# February 17, 2023

# Reviewer 1
## Recommendation
Revise and Resubmit "New"

## General Comments
1. The characters in figure 2 can be larger.
2. There should be more detailed introduction about attack and compliance graphs.

## Additional Questions
1. Which category describes this manuscript?: Research

2. How relevant is this manuscript to the readers? Explain under Public Comments.: Relevant  
___

1. Please explain how this manuscript advances the field of research and/or contributes something new to the literature.: This manuscript employs synchronous firing to mitigate the state space explosion of attack and compliance graphs. This method shorters the generation time of the graphs and decreases the number of the states.

2.  Is the manuscript technically sound? Please explain your answer under Public Comments below.: Appears to be - but didn't check completely
___

1. Are the title, abstract, and keywords appropriate? Please explain under Public Comments below.: Yes

2. Does the manuscript contain sufficient and appropriate references? Please explain under Public Comments below.: References are sufficient and appropriate

If you are suggesting additional references they must be entered in the text box provided.  All suggestions must include full bibliographic information plus a DOI.
If you are not suggesting any references, please type NA.:

3. Does the introduction state the objectives of the manuscript in terms that encourage the reader to read on? Please explain under Public Comments below.: Could be improved

4. How would you rate the organization of the manuscript? (Is it focused? Is the length appropriate for the topic?) Please explain under Public Comments below.: Satisfactory

5. Please rate the readability of the manuscript. Please explain under Public Comments below.: Difficult to read and understand

6. Should the supplemental material be included? (Click on the Supplementary Files icon to view files): No, it should not be included at all

7. If yes to 6, should it be accepted:

## Manscript Rating
Excellent

# Reviewer 2
## Recommendation
Revise and Resubmit "New"

## General Comments
1) The introduction of Section IV is vague and lacks necessary examples. Such as the process of synchronous exploit firing and the scheme of grouping.
2) The content and innovation points of the paper are less.
3) In the experimental part, only one set of indivisible features is used to measure the performance of the synchronous firing, which can be increased appropriately. In addition, how accurate is the state space generated by this method?
4) The references can be increased appropriately.

## Additional Questions
1. Which category describes this manuscript?: Practice / Application / Case Study / Experience Report

2. How relevant is this manuscript to the readers? Explain under Public Comments.: Interesting - but not very relevant
___

1. Please explain how this manuscript advances the field of research and/or contributes something new to the literature.: In this paper, the problem of state space explosion of large-scale attack graph and compliance graph in the generation stage is studied. A synchronous Exploit Firing method is proposed to accelerate the process of graph generation. In order to make full use of the inseparable features  to reduce invalid enumerations, this method first introduces group token to the exploit design, and makes corresponding adjustments to the parser and database. Secondly, the compound operation is implemented on the RAGE’s graph generator, and the hash scheme is modified to support the insertion of new states. Finally, the paper gives some explanations for the status update in the graph generation process. In the experimental part of the paper, 13 nodes and multiple vehicle service combinations are used to analyze the efficiency of graph generation and the result show that the proposed method has good performance.

2.  Is the manuscript technically sound? Please explain your answer under Public Comments below.: Appears to be - but didn't check completely
___

1. Are the title, abstract, and keywords appropriate? Please explain under Public Comments below.: Yes

2. Does the manuscript contain sufficient and appropriate references? Please explain under Public Comments below.: References are sufficient and appropriate

If you are suggesting additional references they must be entered in the text box provided.  All suggestions must include full bibliographic information plus a DOI.
If you are not suggesting any references, please type NA.: nothing.

3. Does the introduction state the objectives of the manuscript in terms that encourage the reader to read on? Please explain under Public Comments below.: Could be improved

4. How would you rate the organization of the manuscript? (Is it focused? Is the length appropriate for the topic?) Please explain under Public Comments below.: Could be improved

5. Please rate the readability of the manuscript. Please explain under Public Comments below.: Readable - but requires some effort to understand

6. Should the supplemental material be included? (Click on the Supplementary Files icon to view files): No, it should not be included at all

7. If yes to 6, should it be accepted:

## Manscript Rating
Good

# Reviewer 3
## Recommendation
Revise and Resubmit "New"

## General Comments
1. The introduction is not clear enough. In this section, the author introduces the problems of the current compliance graphs, however, the authors do not point out clearly which problems that will be solved in this paper.
2. For solving these disadvantages of current compliance graphs, what are the contributions of this paper?
3. The authors introduce many disadvantages of compliance graphs in current works, however, what is the exactly problem that the authors will be solved in this paper should also be introduced in detail.

## Additional Questions
1. Which category describes this manuscript?: Technology

2. How relevant is this manuscript to the readers? Explain under Public Comments.: Relevant
___

1. Please explain how this manuscript advances the field of research and/or contributes something new to the literature.: This work introduces a mitigation technique called synchronous firing, where graph users and designers
can prevent the generation of infeasible states by firing exploits simultaneously through joining inseparable
features like time. This feature does not invalidate the integrity of the resulting attack or compliance graph
by altering the exhaustiveness or permutation checking of the generation process, but rather jointly fires
exploits through their defined inseparable features.

2.  Is the manuscript technically sound? Please explain your answer under Public Comments below.: Yes
___

1. Are the title, abstract, and keywords appropriate? Please explain under Public Comments below.: Yes

2. Does the manuscript contain sufficient and appropriate references? Please explain under Public Comments below.: References are sufficient and appropriate

If you are suggesting additional references they must be entered in the text box provided.  All suggestions must include full bibliographic information plus a DOI.
If you are not suggesting any references, please type NA.: NA

3. Does the introduction state the objectives of the manuscript in terms that encourage the reader to read on? Please explain under Public Comments below.: Could be improved

4. How would you rate the organization of the manuscript? (Is it focused? Is the length appropriate for the topic?) Please explain under Public Comments below.: Satisfactory

5. Please rate the readability of the manuscript. Please explain under Public Comments below.: Easy to read

6. Should the supplemental material be included? (Click on the Supplementary Files icon to view files): Does not apply, no supplementary files included

7. If yes to 6, should it be accepted:
## Manscript Rating
Good