## 4 Evaluation
### Case Study: Triton  
In this section, we conduct a case study using Triton [3], a cyberattack conducted against a Saudi Aramco facility. The Triton attack case was selected as a case study due to its pivotal role in exposing significant vulnerabilities and risks within industrial control systems. Notably, the Triton attack employed novel techniques to compromise equipment that was previously considered secure. The inclusion of this case study in our research is deliberate; it serves to demonstrate the efficacy of our proposed methodology in detecting and responding to unexpected attacks. We confirm that Triton's attack scenario is reproduced through GENICS. This, in other words, means that GENICS can generate realistic cyberattack scenarios for a given ICS environment. In addition, by adopting realistic scenarios in cyber incident response exercises, training participants' experiences can be enhanced.  
**Preparation**. In the case of the Triton case, the attack is conducted against the SIS of the Aramco facility. In this case, the main assets targeted for attack are the EWS, HMI, and the Triconex Tricon [37].  
**Threat analysis**. We identify Triton's threats as:  
* Goal: Causing economic damage due to facility shutdown.
* Target: Triconex 3008.
* Impact: Facility shutdown, safety control system disablement, SIS shutdown.  
**Attack information identification**. Attack information identification in GENICS is performed through MITRE ATT&CK. Table 14 shows Triton's attack techniques disclosed in MITRE ATT&CK. In MITRE ATT&CK, 18 attack techniques exploited by Triton to shut down the SIS are identified. This includes techniques to modify the control logic and download malicious code to the SIS to perform adversarial actions. In addition, Triton's malware includes a function to identify control devices, propagate itself, change file names, and disable integrity checks to bypass the detection. Building upon the identified Triton attack techniques, the GENICS framework amalgamates these with other tactical methods to delineate a comprehensive set of attack techniques for the development of training scenarios in cybersecurity exercises.  
**Modeling Cyberattack Scenarios**. GENICS models attack scenarios through the attack tree. The attack tree is constructed based on the attack information identified through  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & [13] & [16] & [29] & [32] & **Proposal Scheme** \\ \hline Generation scenarios targeting ICS & O & X & O & O & O \\ Identifying assets & O & O & O & O & O \\ The basis for attack techniques & O & O & O & X & O \\ The basis for Vulnerability & X & O & O & X & O \\ Scenario modeling for each asset & O & X & O & X & O \\ Quantification & X & X & O & O & O \\ \hline \hline \end{tabular}
\end{table}
Table 13: Comparison between the methods for generating cyberattack scenarios.  
MITRE ATT&CK. Figure 9 shows the result of attack scenario modeling based on the attack information. The initial access techniques utilized by Triton are not identifiable in the current version of the MITRE ATT&CK framework. We address this gap by constructing attack trees using alternative initial access techniques found within MITRE ATT&CK. While each attack tree incorporates different techniques, they ultimately converge on the objective of launching an attack against the SIS and inducing a shutdown.  
Figure 9: Attack tree for SIS Shutdown Scenario.