# Cyber-Attack Scoring Model Based on the Offensive Cybersecurity Framework
## 3 Offensive Cybersecurity Framework
### Malware  
A considerable amount of research has been devoted to uncovering malware techniques. Representative research is the form of ATT&CK. [PERSON] and [PERSON] [31] explained malware techniques based on the ATT&CK step. Techniques used during the malware execution step include: \"Execution through API (CreateProcessA function)\", \"using Rundl32\", \"Command-Line Interface (cmd.eev)\", \"Service Execution (register or execute as a service)\", \"PowerShell\", and \"Windows Management Instrumentation (WMI)\". Persistence techniques are \"Registry Run Key\", \"New Service\", \"Modify Existing Service\", \"Hooling\", \"Schedule Task\", and \"Image File Execution Options Injection\". Techniques for Privilege Esscalation include Process Injection and Access Token Manipulation. [PERSON] et al. [32] proposed a malware threat assessment using a fuzzy logic paradigm.  
[PERSON] et al. [33] described the behavior of malware as: persistence, configuration, process injection, information stealing and injection, network communications, backconnect, screenshot and video capture, and anti-analysis. Anti-analysis uses obfuscation, packing, cryptor, and protector techniques to confuse analysis malware. In the same way that bullets are important in war, malware is also crucial ammunition in cyber-attacks. Malware uses a wide variety of technologies, and unlike other elements, the stage at which the malicious code is executed is very complicated. According to [PERSON] et al. [33], obfuscation and packing is a technique for hiding malware, and recently, the DLL Side-loading technique has been  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Top 10** & **2010** & **2013** & **2017** \\ \hline A1 & Injection & Injection & Injection \\  & & Broken & \\ A2 & Cross-Site Scripting (XSS) & Authentication and & Broken Authentication \\  & & Session Management & \\ A3 & Broken Authentication & Cross-Site Scripting (XSS) & Sensitive Data Exposure \\  & and Session Management & & \\ A4 & Insecure Direct Object & Insecure Direct Object & XML External Entities \\  & References & References & (XXE) \\  & Cross-Site Request & Security & \\ A5 & Forgery (CSRF) & Misconfiguration & \\ A6 & Security & Sensitive Data Exposure & Security Misconfiguration \\  & Misconfiguration & Missing Function Level & \\ A7 & Insecure Cryptographic & Access Control & Cross-Site Scripting (XSS) \\  & Failure to Restrict URL & Cross-Site Request & \\ A8 & Access & Forgery (CSRF) & Insecure Deserialization \\  & Insufficient Transport & Using Known Vulnerable & Using Components with \\  & Layer Protection & Components & Known Vulnerabilities \\ A10 & Unvalidated Redirects & Unvalidated Redirects & Insufficient Logging and \\  & and Forwards & and Forwards & Monitoring \\ \hline \hline \end{tabular}
\end{table}
Table 3: OWASP Top 10 (From 2010 to 2017).  
utilized. We constructed the technology and stages used by malicious code based on the MITRE ATT&CK. At the ATT&CK stage, the technology focused on malicious codes was quantified, and Execution, Persistence, Privileges Escalation, Defense Evasion, Credential Access, Lateral Movement, Command and Control, Exfiltration, and Impact were selected as representative technologies as listed in Table 4.