## 3 A Base STIX Model for Active Buildings
As introduced above, an important point to consider is that practical models are not supposed to be _final_, at least because CTI changes over time, e.g., new vulnerabilities are found or new services or protocol versions are implemented. In particular, Figure 4 shows the continuous modelling effort for devising a comprehensive STIX model for active buildings. This could be viewed as a cyclical process where cybersecurity officers consider the infrastructure, the feeds, the intelligence, and the adversarial behaviours. The centre of the figure shows the services of active buildings and what some key devices that it manages to support their sustainable operation. The rightmost part of Figure 4 highlights the potential attack surface of active buildings as well as the required STIX elements to compose a CTI solution that encompasses the cyber-physical elements coupled with adversarial actions plus available intelligence streams. Changes in infrastructure will demand low effort (only when new devices or equipment ingress the network) whereas CTI-based information and adversarial behaviour will necessitate continuous updating, to keep up with potential malicious incursions that are documented in cybersecurity feeds or community reports. Conscious that models cannot be final, we prepared a base model for active buildings that at least captures all their peculiarities, in the sense that if elements are removed, then it reduces to systems that are usually addressed differently. An example can be that of removing a power generation source inside the building, e.g., solar panels; if removed, the building would not have the capacity to provide energy to its neighbours (on average), as opposed to what active buildings do. Figures 5 and 6 shows the base STIX model for two active buildings cooperating as energy agents exchanging contextual data and energy altogether (compared with how they are drawn by the official STIX visualiser in Figure A1 in Appendix A). Future deployments of active buildings should also address incorporating CTI feeds into this proposition, as it is a valuable tool to thwart cyber-attacks in preparedness efforts and cybersecurity hardening practices. The former shows a graph view from the official STIX visualizer, while the latter is a simplified graph manually reconstructed to simplify its description. We shall proceed explaining a representative model to study the incorporation of CTI into active buildings. For this model, we will work with the following definitions for two active buildings (namely Active Building#1 - AB#1 and Active Building#2 - AB#2 having different components. For instance, AB#1 is called \"Greenwich Building\" with an EV charger  
Figure 4: Modelling effort for Active Buildings encompassing infrastructure, intelligence, and feeds, all coupled with adversarial behaviours. The STIX model shown in the figure details the infrastructure behind the active buildings and it combines with CTI data and potential observed TTPs for a malicious actor (in this example, by APT Group 1, a fictitious group that operates by installing malware in smart buildings). It is worth noticing that this base example only shows basic elements required to understand the possibilities enabled by the tool. Advanced analysis should encompass the totality (or almost) of the attack surface and points that may be used by cyber-attackers for exploring vulnerabilities. Feed the Model with Real-Time CTIAmong the features of cyberaCTIve, one is to log modifications to the STIX model as _events in a timeline_. This allows for basic forensic analysis on the model, e.g., in our case the model of an active building. Unfortunately, cyberaCTIve [30] does not implement any automation for feeding the model with real-time incidents. So, we extended the tool to allow an _external_ source of CTI to augment the STIX model (Observation: we shall release this extension as open-source in due course, adjusting it to include a link to it in the final version of this paper.).