## 3 A Base STIX Model for Active Buildings  
Part of our effort is generating a tentative base STIX model that captures the most peculiar parts of active buildings. We argue that even a real-world model would not be final, as some parts would need continuous updates, e.g., the CTI database, adversarial behaviour and feeds, as opposed to other parts that seldom (but still) change or are upgraded, e.g., the infrastructure. We show how even a base model for active building looks complicated if illustrated by the traditional automated graph visualisers for STIX models; however, we provide a (manually) simplified graph to effectively describe the components of our base model. Alternatively, the same simplicity is offered by cyberaCTlve through its dashboard view, where groups are clearly marked, as well as relations are organised in a way that do not visually overlap and are much easier to manipulate. We discuss all these details later in this section. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Scope** & **Concern** & **Key Concept** & **Approach** & **Observation** \\ \hline [44; 45] & Active & Definition & Decarbonisation & Position & Authors have commented on the role of active buildings to support the wider grid. \\ \hline [46; 47; 48] & buildings & nZEB & Frameworks & Position & Commentary on frameworks and discussion of what entails nZEB buildings. \\ \hline [53; 54; 55] & Microgrid & Fault detection & Analysis & Simulation & Penetration of photo voltaic devices and implications in microgrids, discussing regulatory aspects and fault detection. \\ \hline [56; 57] & Failure diagnosis & Online diagnosis & Data analysis & Employed anomaly detection techniques including machine support vectors. \\ \hline [5, 58] & Smart grid & General & Survey of surveys & Protective measures, techniques, models and frameworks to support cybersecurity. \\ \hline [64] & Active buildings & Roadmap & Analysis & Discussion of a roadmap to tackle cybersecurity in active buildings. \\ \hline [6, 61] & Smart meters & & & Protective measures to components in critical infrastructure. Discussion on cybersecurity guiding principles, methodologies, and approaches to defend against attacks. \\ \hline [65] & Cybersecurity & ICS & Grid & Analysis & Issues for protecting power grids. \\ \hline [80] & & Analysis & Historical & Commentary on history of incidents. \\ \hline [50, 51] & APT & Analysis & Detection & Combating APTs in critical infrastructure. \\ \hline [66; 67; 68; 74] & & Stuxnet & Analysis & Detailed description of attacks to electrical power grids involving large-scale ICS. \\ \hline [73, 75, 76] & Attacks & ICS & Analysis & Other attacks in ICS and power grids with large impact to customers and stakeholders. \\ \hline [10, 12] & & LCA & Simulation & Coordinated load changing attacks involving swarms of infected IoT in high-wattage equip. \\ \hline [19; 32] & Terminology & Application & Position & Survey of technical CTI and threat based approaches to work with intelligence. \\ \hline [63] & Taxonomy & Application & Survey & Discussion on threats, actors, and cyberatacks across domains citing databases, methodologies, and threat frameworks. \\ \hline [33] & Cyber Threat & Analysis & Statistics & Survey & It shows how CTI adoption has changed over the years as organisations became aware. \\ \hline [37] & Intelligence & Assessment & Automation & Analysis & Authors have used meta-data to train regression models for automation of sources. \\ \hline [39] & Comparisons & Threats & Analysis & Analysis of threat intelligence sources and standards (STIX, TAXII, CybOX). \\ \hline [30] & Tools & Visual & Implementation & A visual front-end to cope with STIX-based models and model management features. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Selected state-of-the-art of cybersecurity for leveraging CTI in CPS (including active buildings).