## 2 Background and Related Work
### Step 2: Attack Information Identification  
In the attack information identification step, the assets identified in the previous step are mapped to MITRE ATT&CK tactics. We should determine whether a given asset can be utilized in the specific tactic of MITRE ATT&CK. Then, one should assign the attack techniques and vulnerabilities to the asset according to the tactics. The attack information (assets, attack techniques, vulnerabilities) for each asset defined in this step is used for attack tree modeling (i.e., nodes) in the next step. Table 1 is an example of mapping attack tactics of MITRE ATT&CK for ICS to representative assets used in ICS. The attack tactics mapped with each asset can identify the attacker's action on each asset. MITRE ATT&CK provides cybersecurity incidents observed in the past. Therefore, if there is an incident case similar to the scenarios' overview, the attack techniques to be used in the scenario can be easily identified based on the case. Figure 1: Overview of GENICS Framework for Generating Attack Scenario. Using an internal network PC as an example, Initial Access can collect virtual private network (VPN) credentials and use them to gain access to the internal network for an attack. Execution may involve using a command-line interface. An attacker can use xp_cmdshel and Powershell on an MS-SQL server to execute commands. Persistence may involve hardcoding a username or password. A hardcoded password on a database server can be used to propagate an attack to other systems. Privilege Escalation can involve exploiting a vulnerability in software to gain elevated privileges. Vulnerilities such as [34] can be used to perform privilege escalation on Windows systems. Evasion can involve disguising a malicious file as a legitimate file to avoid raising suspicion. Evasion may involve disguising a malicious file as a legitimate file in order to avoid suspicion. Collection can be the act of gathering information to prepare for a subsequent action, such as sniffing a network \begin{table}
\begin{tabular}{c c} \hline \hline
**Asset** & **Attack Tactic** \\ \hline \multirow{8}{*}{Internal network PC} & Initial Access \\  & Execution \\  & Persistence \\  & Privilege Escalation \\  & Collection \\  & Command and Control \\  & Discovery \\  & Lateral Movement \\ \hline \multirow{8}{*}{HMI} & Initial Access \\  & Lateral Movement \\  & Execution \\  & Persistence \\  & Privilege Escalation \\  & Expansion \\  & Collection \\  & Command and Control \\  & Inhibit Response Function \\  & Impair Process Control \\  & Impact \\ \hline \multirow{8}{*}{EWS} & Initial Access \\  & Lateral Movement \\  & Execution \\  & Persistence \\  & Lateral Movement \\  & Inhibit Response Function \\  & Impair Process Control \\  & Impact \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Mapping between assets and MITRE ATT&CK’s tactics. through a man-in-the-middle. Command and Control could be Ingress Tool Transfer. This is when an attacker sends a tool or a file to be used in an attack from an external source, which can propagate a malicious file to the attack vector. Discovery can include the act of learning about a user. An attacker can obtain a valid account from the target's system or through compromised account information. Lateral Movement involves the propagation of an attack to other networks. An attack can move from the external network to the internal network by hijacking a session that allows the attacker to access the internal network from the external network. Table 2 is an example of assets that can be used in a scenario causing damage to the PLC's control process and information on attack techniques/vulnerabilities accordingly. Note that not all assets are exploitable or vulnerable to any particular attack technique. For example, when attacking the Triconex safety instrumented system (SIS) developed by Schneider Electric, the malware used in Triton [3], an attack on an oil and gas facility, uses the SIS's application programming interfaces (APIs) to execute malicious shellcode.