# Mapping Automated Cyber Attack Intelligence to Context-Based Impact on System-Level Goals
## 3 Proposed Method
### Classification of Distributions
#### 3.2.1 Exponential Correlation  
We propose exponential distributions to be used when the detection of an attack has an easy or medium difficulty. This choice is grounded in the properties of exponential distributions, which are suitable for modelling time-to-failure due to their'memory-less' nature [31], making them appropriate for certain IoT devices that do not accumulate damage over time. However, we acknowledge that different types of cyber attacks and operational contexts might benefit from alternative distributions. For instance, Weibull [32] distributions could model scenarios with varying failure rates, and Gaussian [33] distributions might be suitable for modelling normally distributed operational abilities. The exponential distribution was selected because it effectively captures the rapid changes in operational status under attack scenarios.  
As Figure 1 (Equation (1)) and Figure 2 (Equation (2)) show, the curve remains high on the probability of being operational until we are highly confident that the attack is occurring. That is, the machine classification algorithms used to detect these attacks are confident in their output. Given the attack is likely to be detected early, we can wait until we are highly confident before reducing the probability that the goal will succeed. Notice that there are three lines on the chart. These relate to decay rates based on damage potential. Slow decay (top line) is for low-damage attacks, rapid decay (bottom line) is for high-damage attacks. The decay variance captures the increased reduction in probability in correlation  
\begin{table}
\begin{tabular}{l l} \hline \hline \multirow{2}{*}{Damage Potential} & Low = attack has minor impact on the device; \\  & Medium = attack could lead to significant disruption on the device; \\  & High = attack completely prevents the device from fulfilling its task. \\ \hline \multirow{4}{*}{Detection Difficulty} & Easy = attack is detected at an early stage or can be predicted; \\  & Medium = attack can be detected but requires well-curated and \\  & managed methods for detection; \\  & Hard = attack is only likely to be detected once it begins to impose \\  & a major impact. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Elements and evaluation in the proposed model.  
with increased confidence that the attack is happening and the extent of damage potential. Also notice that there are two ways to map the change in probability. Figure 1 reduces the probability to zero for the high-damage decay line when the confidence is 100%, while the slow-decay line only ever reaches around 60%. This indicates that some attacks may not ever reduce the probability of success to zero--for instance, low-damage probing attacks. Figure 2 is used for cases when all forms of decay will eventually reduce the probability of device success to zero.  
\[f(x)=-kx^{2}+0.99,x\in[0,1],f(x)\in[0,1],k=1,0.8,0.6 \tag{1}\]  
Figure 1: Exponential correlation by different Damage damage potential—not to zero (low-damage attacks (top line (green)) to high-damage attacks (bottom line (blue)).  
Figure 2: Exponential correlation by different damage potential—to zero (low-damage attacks (top line (green)) to high-damage attacks (bottom line (blue)).  
\[f(x)=-x^{k}+0.99,x\in[0,1],f(x)\in[0,1],k=2,4,8 \tag{2}\]