# Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment
## 3 Results  
### TRADES Tool Extension  
Figure 1 shows the _TRADES Tool_ metamodel extension, designed to provide references to external knowledge bases in order to trace the origin of imported threats and security controls. This involves new concepts, designated in magenta, and their interrelations as well as relations to existing concepts, which appear in yellow. An \"ExternalElement\" abstract class conveys the concept of linking to external references. The class includes three attributes: source, for naming the external source of the element (e.g., CAPEC or ATT&CK); link, to provide a direct link to a pertinent record of the external source; and sourceID, to uniquely identify the source. When importing threats, the identifier of CAPEC or ATT&CK (\"Capec\" or \"Attack\", respectively) is also added as a prefix to the threat ID, together with its original identification number in each catalogue. Two additional classes are then specified: \"ExternalThreat\", which is typed as the TRADES \"Threat\" class/concept as well as the newly introduced \"ExternalElement\" and is used for expressing externally sourced threat elements, and \"ExternalControl\", which is typed as the TRADES \"Control\" class/concept as well as the newly introduced \"ExternalElement\" and is used for expressing externally sourced security control elements. An existing relation--\"mitigatedThreats\"--is allowed from Control elements to Threat elements (with a cardinality of [0..\"], i.e., there can be any number of relations between the elements) and--by inheritance--is also allowed from ExternalControl elements to ExternalThreat elements. The extended metamodel definitions are also used for generating model-based representations:  
1. Unique symbols are used to differentiate externally sourced threat and control elements from those that are not externally sourced. Figure 2 shows this extended _TRADES Tool_ notation. 2. A dedicated \"Properties\" view shows the additional attribute of an external element to the user, as well as allows accessing the information source (if applicable). Figure 3 shows an example of this view for a specific threat element adopted from CAPEC. The name, CAPEC identification number and description are shown, as well as the designation of CAPEC as the source. Also, the \"link\" section offers a direct, clickable link to the threat as it appears on the CAPEC online website. This provides the user with pertinent information as well as the means to further research the originating knowledge base. _TRADES Tool_ is also extended with dialogues for importing catalogues into the security modeller's working environment. Figure 4 showcases the dialogue for importing OSCAL catalogues (used in our work to import NIST SP800-53 security controls). It allows the user to select the catalogue source between a built-in catalogue (currently a specific version of the NIST SP800-53 is embedded) and an external catalogue file. Figure 1: TRADES metamodel extension to support external references. Figure 2: Representation of externally defined vs. user-defined elements. CAPEC attack patterns, ATT&CK techniques and NIST SP800-53 security controls are all available as catalogues for the _TRADES Tool_ modelling environment. A total of 559 CAPEC attack patterns exist in the automatically generated CAPEC TRADES catalogue, containing all CAPEC attack patterns of the current version--version 3.9. A total of 354 ATT&CK attack patterns exist in the automatically generated ATT&CK TRADES catalogue, containing all ATT&CK techniques relating to Enterprise (201), Mobile (72) and Industrial Control Systems (81) of the current version--version 14.1. Also, all 106 ATT&CK mitigation techniques appear in the ATT&CK TRADES catalogue (43 Enterprise mitigations, 12 Mobile mitigations and 52 Industrial Control Systems mitigations, with 1 mitigation--M1013--shared between Enterprise and Mobile). The entire NIST SP800-53 catalogue in its up-to-date revision (5.1.1) is available, directly imported from its OSCAL XML file [17] into the modelling environment.