## 4 Attack Path Generation Rules
### Variables  
The propagation rules determine the possible vulnerabilities that an attacker can exploit for the implementation of a successful attack campaign. Asset dependency, vulnerability exploitability, threat actor profiles and target user profiles are key parameters for propagation rules. A European funded project, named 'A Dynamic and Self-Organized Artificial Swarm Intelligence Solution for Security and Privacy Threats in Healthcare ICT Infrastructures' (AI4 HEALTHSEC) [24] works towards developing a solution to enhance the identification and analysis of threats and cyberattacks on healthcare information infrastructures (HCII). The project AI4 HEALTHSEC considers a number of attributes for the attack propagation rule set, which are presented below. **Asset dependency:** An asset within a healthcare ecosystem may have a number of dependencies in order for the related healthcare service to be delivered within the HCII. For instance, an insulin pump needs to inject insulin into the patient's body. The cyber-asset pair enfolds a source cyber-asset and a destination cyber-asset. There are two infrastructures necessary for the transfer and processing of cyber resources, i.e., communications (transmission of big data and information) and IT (use and processing of big data). The dependency type is capable of defining in which manner a cyber-asset pair is interdependent within the healthcare service. To fulfil this, the following cyber dependency types are considered:  
Figure 3: Attack path generation and analysis process. exchanging, storing, controlling, processing, accessing, and installing. Additionally, there are also physical dependencies among the assets when one asset is physically connected with another asset. **Vulnerability exploitability:** Each asset includes a single or multiple vulnerabilities that could be exploited for a given attack path to materialize. Additionally, there are dependencies among the assets that allow us to exploit the vulnerabilities from an entry point asset to a target asset. The attacker needs to identify the entry point asset vulnerabilities that could be discovered and exploited to initiate the attack and then use the target point asset vulnerability to complete the attack path. Therefore, there is a dependency among the assets for the attack path generation. **Threat actor profile:** The threat actor profile indicates the capability, skills, and motives of an attacker for an attack campaign. Depending on the skill and sophistication, there are variations in the threat actor profile. It is necessary to identify the threat actor profile for the attack path generation. The threat actor profile considers two variables:  
* Threat actor capability: Defines the attackers' necessary skill, goals supplication, resources required to execute an attack. It includes five given scales (very low, low, moderate, high, and very high);
* Attack access vector: Define the necessary access path for an attack campaign. There are four different access vectors for executing an attack: **Local--**A vulnerability is exploitable with only local access; **Adjacent--**A vulnerability is exploitable with adjacent network access; **Network--**A vulnerability is exploitable with network access; **Physical--**A vulnerability is exploitable with physical access. **Target user profile:** Threat actors are targeting various users for an attack campaign. The AI4 HEALTHSEC cyberattack path discovery method considers the target user profile that assists the threat actor to execute the attack. The actors involved in the overall healthcare ecosystem, such as healthcare practitioners, nurses, admin workers and IT service workers, could be targeted by a threat actor. The target user profile considers user context such as knowledge and skill (high, medium, and low) for running various healthcare services, applications, and maintenance operations.