# Cyber-Attack Scoring Model Based on the Offensive Cybersecurity Framework
## 4 Cyber-Attacks Evaluation
### Scoring Procedure  
We collected almost 150 reports with analyses of attacks and websites using the links that had already been collected by the APT Group list [5]. Then, we searched each paper for cyber-attack techniques using the keyword-base addressed in Section 3 (Offensive Cybersecurity elements). Finally, we calculated the cyber-attack score based on the offensive cybersecurity elements. Figure 3 and Algorithm 1 shows the overall scoring procedure. Additionally, one cyber-attack group can perform various cyber-attack operations. In this case, we selected representative cyber-attack operations for each cyber-attack group. We used the Lockheed Martin Cyber Kill-Chain process to identify the cyber-attack techniques for each step [34]. MITRE ATT&CK evaluations showed the scoring result for some APT groups such as APT3, APT29, and Carbanak+FIN7. This evaluation was based on the 20 attack stages; however, it only focused on the malware itself rather than mapping the overall chain of the cyber-attack. Thus, our scoring approach differs from that used in the ATT&CK evaluation. \begin{table}
\begin{tabular}{c c} \hline \hline
**Cyber-Attack** & **Techniques Used** \\ \hline Encryption: Custom Cryptographic Protocol, Data Compressed, Data Encoding, Data Encrypted, Obfuscated Files or Information, Standard Cryptographic Protocol \\ Network: Commonly Used Port, Connection Proxy, Exfiltration Over Alternative Protocol, Exfiltration Over Command and Control Channel, Fallback Channels, Multiband Communication, Spearbishing Attachment, Standard Application Layer Protocol, Uncommonly Used Port \\ Web: Drive-by Compromise \\ Malware: Access Token Manipulation, Account Manipulation, Application Window Discovery, Bootstrap, Brute Force, Command-Line Interface, Credential Dumping, Data from Local System, Data Staged, Disabling \\ Lazarus Group & Security Tools, Disk Content Wipe, Disk Structure Wipe, File and Directory Discovery, File Deletion, Hidden Files and Directories, Input Capture, New Service, Process Discovery, Process Injection, Query Registry, Registry Run \\ Keys/Startup Folder, Remote File Copy, Resource Hijacking, Scripting, Service Stop, Shortcut Modification, System Information Discovery, System \\ Network Configuration Discovery, System Owner/User Discovery, System \\ Shutdown/Reboot, System Time Discovery, Timestomp, Windows Admin \\ Shares, Windows Management Instrumentation \\ System: Compiled HTML File, Exploitation for Client Execution, Remote \\ Desktop Protocol, User Execution \\ Used tools: AuditCred, BADCALL, Bankshot, FALLCHILL, HARDRAIN, \\ HOPLIGHT, KEYMARBLE, Mimikatz, neths, Proxysvc, RATANKBA, \\ RawDisk, TYPEFRAME, Volgmer, WannaCry \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Cont. Figure 3: Overall scoring procedure. In addition, our approach provides a more comprehensive description of cyber-attack techniques to arrive at a cyber-attack score. ```
1:Input : Data source-malware analysis report
2:Output : Cyber-attack scoring
3:\(N\leftarrow\) number of cyber-attack cases
4:Element[score] \(\gets\) 0
5:for\(k\gets 1\) to Ndo
6: keyword \(\gets\) keyword file
7:if\(content==\) keyword then
8: score \(\gets\) score + 20
9: element[score] \(\leftarrow\) score
10:endif
11:endfor
12:Return element[score]
```  
**Algorithm 1** Generating score for each cyber-attack. We evaluated cyber-attacks at two levels to calculate the score. Level 1 uses the top offensive cybersecurity elements for each cyber-attack with cyber kill chain phases. We identified the offensive cybersecurity elements that were used in each cyber-attack case. For this purpose, we analyzed the cyber-attacks and mapped them with the Lockheed Martin Cyber Kill-Chain. The Cyber Kill-Chain has seven phases and a total of five cybersecurity high-level elements. We awarded 20 points to each cybersecurity element. Combining the cyber-attack techniques used in each of the offensive cybersecurity model, the cyber-attack complexity is expressed as follows.