# Cyber-Attack Scoring Model Based on the Offensive Cybersecurity Framework
## 4 Cyber-Attacks Evaluation
### Dataset  
We used datasets that contain cases of two types of cyber-attacks: fileless cyber-attacks and APT group cyber-attacks. We chose ten recent fileless cyber-attacks listed in Table 5 from the dataset to evaluate our scoring model. The ten selected fileless cyber-attacks were Poweliks, Pozena, Duqu 2.0, Kovter, Petya, Sorebrect, WannaCry, Magniber, Emotet, and GandCrab. We also selected APT Group and Operation from the APT group list [5]. In this study, we first investigated six nations: China, Russia, North Korea, Iran, Israel, and nations in the Middle East. These countries and regions have 87, 20, 9, 9, 2 and 17 cyber-attack groups, respectively, as listed in Table 6. We selected the APT groups of China, Russia, North Korea, and Iran because they are known publicly. Even though China has the most cyber-attack groups, the mere number of cyber-attack groups does not indicate a nation's cyber-attack capabilities. For example, in comparison to China, Israel has only two cyber-attack groups. China has a smattering of small cyber-attack groups, however Israel's Unit 8200 group is known to be the most powerful group. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Nations** & **Counts** & **APT Groups Common Name** \\ \hline \multirow{9}{*}{China} & \multirow{9}{*}{87} & Comment Crew, APT2, UPS, IXESHE, APT16, Hidden Lynx, Wekby, Axiom, Winnti Group, Shell Crew, Naikon, Lotus Blossom, APT6, APT26, Mirage, NetTraveler, Ice Fog, Beijing Group, APT22, Suckfly, APT4, Pitty Tiger, Scarlet Mimic, C0d0 so, SVCMONDR, Wisp Team, Mana Team, TEMP.Zhenbao, SPIVY, Mofang, DragonOK, Group 27, Tonto Team, TA459, Tick, Lucky Cat, APT40, PassCV, BARIUM, LEAD, Iron Group, Anchor Panda, Big Panda, Electric Panda, Eloquent Panda, Emissary Panda, Foxy Panda, Gibberish Panda, Goblin Panda, Hammer Panda, Hurricane Panda, Impersonating Panda, Judgement Panda, Karma Panda, Keyhole Panda, Kryptonite Panda, Mustang Panda, Night Dragon, Nightshade Panda, Nomad Panda, Pale Panda, Pirate Panda, Poisonous Panda, Predator Panda, Radio Panda, Sabre Panda, Spicy Panda, Stone Panda, Temperpanda, Test Panda, Toxic Panda, Union Panda, Violin Panda, Wet Panda, Calypso, Tropic Trooper, APT41, Poison Carp, AVIVORE, APT-C-01, DarkUniverse, Taskmasters, GALLIUM, RANCOR, ChinaZ, APT-C-37, APT-C-27 \\ \hline \multirow{2}{*}{Russia} & \multirow{2}{*}{20} & Sofacy, APT29, Turla Group, Energetic Bear, Sandworm, FIN7, FIN8, Inception Framework, TeamSpy Crew, BuhTrap, Carberb, FSB 16 th \& 18 th Centers, Cyber Berkut, WhiteBear, GRU GTSST (Main Center for Special Technology), VOODOO BEAR, TEMP:Veles, Zebrocy, SectorJ04, FullofDeep \\ \hline \multirow{2}{*}{
\begin{tabular}{c} North \\ Korea \\ \end{tabular} } & \multirow{2}{*}{9} & Lazarus Group, Group13, DarkHotel, Andariel, Kimsuki, NoName, OnionDog, TEMP:Hermit, \\  & & & \\ \hline \multirow{2}{*}{Iran} & \multirow{2}{*}{9} & Cutting Kitten, Shamoon, Clever Kitten, Madi, Cyber fighters of Izz Ad-Din Al Qassam, Chafer, Prince of Persia, Sima, Oilrig \\ \hline \multirow{2}{*}{Israel} & \multirow{2}{*}{2} & Unit 8200, SunFlower \\ \cline{2-2} \cline{4-4}  & & \multirow{2}{*}{17} & Molerats, AridViper, Volatile Cedar, Syrian Electronic Army (SEA), Cyber Caliphate Army (CCA), Ghost Jackal, Corsair Jackal, Extreme Jackal, Electric Powder, APT-C-23, APT-C-27, Dark Caracal, \\ \cline{1-1}  & & & \\ \hline Total & 144 & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Cyber-attack group dataset.