## 2 Background and Related Work
### Step 3: Modeling Cyberattack Scenarios  
An attack tree is constructed based on the information analyzed for cyberattack scenarios in the attack scenario modeling step. At this step, the scenario developer assumes all attacks that can occur in the target system and expresses the paths to achieve the attacker's goal defined above as an attack tree. To this end, we augment and modify the standard attack tree to present the previously analyzed information. Figure 2 is an example of an attack tree for an ICS; the nodes have a hierarchical structure. The attack tree recursively comprises several partial attack trees under a single root node. A partial attack tree is a part of the overall attack tree and comprises assets to be targeted for a specific attack goal and nodes containing attack information. By this definition, each node represents an attack procedure, which is a single step of the attack scenario. In the attack tree, the attack's ultimate target is located at the root node. In nodes below the root, techniques of MITRE ATT&CK for Enterprise/ICS required to achieve the attack's goal are expressed along with assets. There may be multiple ways to achieve a single goal, which is why there may be multiple partial attack trees under a single root node. The attack tree, starting from the leaf node to the root node, each node represents an attack that an attacker should carry out. \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Technique** & **Event Message** \\ \hline Hardware additions & Drive creation events \\ Exploitation of remote services & Network traffic log \\ Program download & Application log \\ Unauthorized command message & Process history log \\ \hline \hline \end{tabular}
\end{table} 
Table 3: An example event message for attack causing damage to the PLC’s control process. Figure 2: An example of the attack tree for cyberattack. As shown in Figure 3, each node except the root node includes a target (information on the asset where the attack is conducted), action (malicious action on the asset), and attack information (attack technique, CVE vulnerability, CWE weaknesses, and mitigation) are specified. The attack tree is constructed from the root node to the leaf node. We introduce the Purdue model to hierarchically configure the attack tree according to the structure of ICS. Since the attacker's ultimate target is located at the root node, we take devices at a lower level (close to level 0) as the root node in the Purdue model. Then, according to the Purdue model, the attack tree is formed by sequentially arranging the upper layer devices. Table 4 shows the devices according to the hierarchy of the Purdue model. For example, assume the following attack sequence: PC in internal network -> EWS -> PLC -> field device. For this scenario, the attack tree is layered from level 0 to level 3 as follows, according to the Purdue model. Also, if the initial attack starts from the HMI, the attack tree is composed only from level 0 to level 2. Progressing from the leaf node to the root node in the attack tree means the cyberattack proceeds from the initial access to the attack target. When an attack moves from a lower node to an upper node, there may be optional attack techniques to improve or enhance the attack's success rate. We introduce three operators to systematically express these attack techniques in the attack tree (see Table 5). The enter operator makes an essential attack technique to enter an attack target (asset) in a partial attack tree and is represented as a leaf node of the partial attack tree. The Subsequent operator lists subsequent attack techniques that should be performed to achieve the attack goal after the attacker enters the attack asset. The Subsequent operator places these attack techniques in order between the leaf node and the upper node of the partial attack tree. Lastly, the select operator does not have to be performed, but attack techniques that can be selectively performed to increase the success rate or advance the attack are listed.