## 2 Background and Related Work
### Related Work  
[PERSON] et al. [15] interfaced the attack planner's knowledge base with both MITRE common vulnerabilities and exposures (CVE) and the National Institute of Standards and Technology (NIST) national vulnerability database (NVD) using the BRON framework [26] to create a detailed attack tree. [PERSON] et al. [27] proposed a model-based semi-automated attack tree generation method considering attack motive and functional dependency to solve the labor-intensive attack path generation problem required for vehicle cyber security risk analysis. [PERSON] et al. [16] proposed Attack Dynamics, an automated attack graph generation framework finding attack paths that can identify attack types using MITRE common attack pattern enumeration and classification (CAPEC) and MITRE common weakness enumeration (CWE). [PERSON] et al. [28] presented attack graphs causing plant shutdowns in nuclear power plants, vehicular network systems, and ICS using models considering system and security attributes, implementing cyberattack scenarios from the graphs. [PERSON] et al. [13] experimented with analyzing the impact of multi-level cyberattacks on the safety of cyber-physical systems (CPS) using discrete event simulations (DES). In this experiment, the navigation system of an autonomous ship is expressed with the modeling language AltaRica, and attack sequences are automatically extracted to indicate all events affecting the system. [PERSON] et al. [14] proposed an automatic generation method of attack sequences based on MITRE ATT&CK's tactics/techniques to add various and realistic attack sequences to the ICS dataset. [PERSON] et al. [17] proposed APTGen for generating a targeted attack dataset to solve the problem of accelerating incident response and lack of attack sequence information. APTgen generated an attack sequence using MITRE ATT&CK's tactics/techniques and created a dataset based on eight real-world cases. In [PERSON] et al. [29], CAgen, a framework generating attack sequences for cyber-physical energy systems such as power grids, is proposed. CAgen was based on an electric high-risk failure (EHFS) scenario; CAgen started with generating the attack tree, mapped CWE/CVE, and added details to the attack sequence. [PERSON] et al. [30] proposed an attack graph-based risk management framework developed for maritime supply chains. This framework used parameters such as attacker location and maximum propagation length in the attack path search process and adopted a priority algorithm to identify non-recursive attack paths. [PERSON] et al. [31] proposed a seven-stepped attack path generation method considering the characteristics of medical information infrastructure. The attack vectors were created by adding parameters to the MITIGATE method. This framework used existing proven frameworks such as CVE/CVSS in the attack path generation process. It developed a knowledge base of nine parameters through rule-based reasoning to identify the attack path. [PERSON] et al. [32] proposed a method of searching and analyzing attack paths targeting the CPS environment. The proposed method identified the importance of the attack path by considering the risk estimation of each component of CPS and the importance to the system through DREAD. [PERSON] et al. [33] proposed a method for predicting attacks from attack vectors identified through a rule-based inference approach. The attack path consisted of four steps, and the attack path was created as a vulnerability chain. The generated attack path was used as an input value for the collaborative filtering recommendation system, and a predicted attack was derived. GENICS Framework: A Strategy for Generating Attack Scenarios in Industrial Control Systems Cybersecurity Exercises  
In this section, we propose GENICS, a framework to generate cyberattack scenarios. This framework systematically derives attack scenarios that can occur in the ICS environment by using the existing cybersecurity-related knowledge bases.