## 2 Cyber Threat Intelligence and Active Buildings
### Cybersecurity and CTI in Active Buildings  
Without going into many details, we summarise what kind of CTI and CTI sources we expect that active buildings will inherit or reuse from related technologies. There is a wealth of contributions on cybersecurity of smart grids [5; 58], microgrids [25; 26; 59; 60], in IoT [6], and smart metering [61] that can directly apply for active buildings. [PERSON] et al. [62] discussed cybersecurity issues, threat modelling, and risk assessments in so called cyber-physical energy systems (CPES), again strongly relatable to active buildings. [PERSON] et al. [63] discussed threats, actors, and cyber-attacks across domains citing databases, methodologies, and threat related taxonomies and frameworks. Common protective measures such as cybersecurity awareness, risk communication, networking firewalls, and IDS across levels in home/building management systems. In business/enterprise levels, analysts depend on accurate measurements and historic data to perform medium/long planning efforts. We suggest further reading about the cybersecurity underpinnings behind the active buildings from [PERSON] et al. [64], where its authors detail a roadmap for tackling cyber-attacks in this architecture. To appreciate some of the knowledge that one could find inspecting CTI on active buildings, we describe some of the known vulnerabilities that have been found across the years on the fields which they extend or can be a part of. Previous work discussed malicious interventions in power grids and industrial control systems (ICS) over the years [65]. ICSs are particular CPSs allowing remote, automated control of industrial systems. Those incursions caused extensive damage and financial losses, sometimes blacking out entire regions or incapacitating information systems. As an example, the Stuxnet malware acquired the control of nuclear facilities in Iran and induced physical damages to turbines with catastrophic damage [66; 67; 68; 69; 70]. Another malicious incursion called BlackEnergy [71; 72] employed DoS attacks in SCADA systems in ICS. Furthermore, the Industroyer or Crashoverride [73; 74] also targeted ICS as a malware that corrupted switches, breakers, and substation communication protocols and was responsible for a power grid failure in Ukraine. The Dragonfly [75] allowed adversaries to access and gain unauthorised control over critical systems whereas Wannacy [76; 77] targeted information systems at healthcare facilities (mostly hospitals), banks, and universities and demanded ransomware so administrators could resume operations. More recently, the Trisis [78] malware successfully attacked equipment employed in energy, oil, and gas control systems. Other research dealt with a combined analysis of BlackEnergy, Crashoverride, and Trisis [79], whereas [PERSON] et al. [80] discussed the history of ICS cyber incidents. There are significant initiatives to deal with the above malicious incursions. MITRE, a US based organisation, has developed the adversarial tactics, techniques, and common knowledge (ATT&CK) framework [81] and defined'matrices' (namely enterprise and mobile domains) to help stakeholders understand the tactics, techniques, and procedures (TTP) deployed by attackers. MITRE has also introduced a similar initiative for applying ATT&CK to industrial control systems (ICS) called ATT&CK for ICS [82], due to observed particularities in these systems. The ATT&CK framework superseded the CAPEC (Common Attack Pattern Enumeration and Classification) [83], and we witness academic and industrial partners engaging with reporting efforts to mitigate cyber-attacks. The framework is a valuable resource to help security officers to counteract cyber-attacks with threat-informed defences. ATT&CK differs from classic Cyber Kill Chain(r) [84] pioneered by Lockheed Martin [85] in the sense that it identifies and maps adversarial actions that could happen without any order. [PERSON] et al. [86] has created a method for translating ATT&CK matrix threats directly into NIST's cybersecurity framework.