## 4 Attack Path Generation Rules
### Knowledge Base  
As stated before, the attack path identification follows certain rules. However, to generate the rules, it is necessary to define the KB as a foundation for the rule set generation. The KB includes a set of predicate symbols to describe a predicate within the rule set. These will mainly constitute domain elements attributes (e.g., the attributes of assets), along with predicates used in the reasoning process. The list is not exhaustive, and the KB and quantifiers can be extended to capture a more complete or different view of the domain.  
Symbols: The following symbols are used for the KB rule set generation:  
* Vul denotes Vulnerability which links with an asset;
* Asset denotes specific assets of the overall healthcare ecosystem and possible cyber dependencies with other assets including Hosting, ExchangingData, Storing, Controlling, Processing, Accessing, Installing, Trusted, Inclusion, Interaction, and Connected;
* TA and TAP denotes Threat Actor and Threat Actor Profile, respectively with capability VeryHigh, High, Moderate, Low, and VeryLow, threat require for an attack;
* AV denotes Access Vector with Local Network, Adjacent Network, Local and Physical;
* Vuln_PR denotes Privileged Required as a level of privileges, i.e., None, Low, and High, before successfully exploiting a vulnerability by a Threat Actor;
* Vuln_AC denotes Attack complexity in terms of certain conditions, i.e., Low and High, beyond the attacker's control that must exist in order to exploit the attack;
* Vuln_UI denotes the user interaction, i.e., None and Required, excluding the threat actors for an attack;* TUP denotes the Target User Profile, i.e., High, Medium, and Low, that assists an attacker to execute an attack;
* Vuln_Exp denotes vulnerability exploitability level, i.e., High, Medium, and Low, based on the exploitability properties;
* Vul_Exp_Fea denotes specific exploitability features of the vulnerability.  
The following relationship symbols are used for the KB rule set generation:  
Connected relation defines the connectivity between two assets due to the dependency or through the related vulnerabilities. Asset dependencies and inherent vulnerabilities within the asset are considered for the connected relation. Additionally, connectivity can be also achieved if the assets are in the same network. The KB for the connected relation is given below.  
Connected using assets dependency.  
* \(\forall\)asset1,asset2 ExchangingData(asset1,asset2) \(\vee\) Storing(asset1,asset2) \(\vee\) Configuring(asset1,asset2) \(\vee\) Updating(asset1,asset2) \(\vee\) Accessing(asset1,asset2) \(\vee\) Installing (asset1,asset2 \(\Rightarrow\) Connected (asset1,asset2) \(\wedge\) Connected(asset2,asset1)  
Connected using vulnerability.
* \(\forall\)vuln1,vuln2,asset1,asset2 Connected(vuln1,asset1, vuln2,asset2) \(\Rightarrow\) Connected (vuln2,asset2, vuln1,asset1)  
Accessible relation denotes threat actors with specific profiles that can access the asset using a specific access vector required for a confirmed vulnerability.  
* \(\forall\)vuln, asset,TA vuln_AV0 \(\wedge\) TAP0 \(\Rightarrow\) Accessible(vuln,asset,TA)  
Exploitable relation denotes threat actors that exploit a specific vulnerability on an asset. The threat actor needs to access the asset for exploitation using the appropriate profile that links with the required base metric values.  
* \(\forall\)vuln,asset,TA Accessible(vuln,asset,TA) \(\wedge\) (vul_UI) \(\vee\) vul_PR) \(\vee\) vul_AC(0) \(\Rightarrow\) Exploitable(vuln,asset,TA)  
Attacked relation denotes when a threat actor successfully attacks an asset based on a specific vulnerability exploitation and certain profile. Therefore, threat actor accessibility and vulnerability exploitability are required for an attack.  
* \(\forall\)vuln,asset,TA Accessible(vuln,asset,TA) \(\wedge\) Exploitable(vuln,asset,TA) \(\Rightarrow\) Attacked (vuln,asset,TA)