## 6 Conclusions  
Appropriate security controls should be established to respond to cyberattacks in the ICS environment. Due to the nature of the ICS environment, it is challenging to check security controls, so the current security level of the facility should be confirmed through cybersecurity exercises. Realistic attack scenarios against the ICS environment should be assumed for these cybersecurity exercises to be conducted properly. However, currently, there is a lack of research to generate highly reliable attack scenarios. In this paper, we propose GENICS, a framework generating attack scenarios for practical cybersecurity exercises in an ICS environment. GENICS leverages well-known knowledge bases such as MITRE ATT&CK and CVE to derive attack scenarios against ICS facilities. In addition, GENICS systematically expresses the attack procedures for ICS facilities through an attack tree and quantifies each procedure. This supports the reliable attack scenario for each asset on the path from the entry point to the attack target in the ICS environment. This can ensure training effectiveness and contribute to an improved participant experience. However, GENICS is limited in that vulnerabilities should be used to quantify derived scenarios.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Attack Technique and Vulnerability** & **D** & **R** & **E** & **A** & **D** & **Tot** & **Avg.** \\ \hline Exploitation for Privilege Escalation (T0890) & 5.9 & 10 & 6.5 & 5 & 4 & 31.4 & 6.28 \\ (CVE-2018-7522) & 5.9 & 5 & 8.75 & 5 & 10 & 34.65 & 6.93 \\ \hline Modular Firmware (T0839) & 3.6 & 10 & 6 & 5 & 2 & 26.6 & 5.32 \\ (CVE-2021-22747) & 5.9 & 10 & 8.75 & 5 & 10 & 39.65 & 7.93 \\ \hline External Remote Services (T0822) & 5.9 & 10 & 7 & 9 & 10 & 10 & 46 & 9.2 \\ (CVE-2010-2568) & 6 & 10 & 10 & 10 & 10 & 46 & 9.2 \\ \hline Exploitation of Remote Services (T0866) & 6 & 10 & 10 & 10 & 10 & 46 & 9.2 \\ (CVE-2020-1472) & 6 & 10 & 10 & 10 & 10 & 46 & 9.2 \\ \hline Denial of Service (T0814) & 6.9 & 10 & 10 & 10 & 10 & 46.9 & 9.38 \\ (CVE-2015-5374) & & & & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 14: Quantification of [PERSON]’s Attack Techniques as Disclosed in MITRE ATT&CK.  
In future work, we intend to overcome this limitation and research the automation of generating exercise attack scenarios.  
Conceptualization, I.S. and S.J.; methodology, I.S., S.J. and D.K.; validation, D.K. and M.G.L.; writing--original draft preparation, I.S., S.J., D.K. and M.G.L.; writing--review and editing, S.J.; visualization, I.S. and D.K.; supervision, J.T.S. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the Nuclear Safety Research Program through the Korea Foundation of Nuclear Safety (KoFONS) using the financial resource granted by the Nuclear Safety and Security Commission (NSSC) of the Republic of Korea (No. 2106058, 40%). This work was partly supported by the Korea Institute of Energy Technology Evaluation and Planning (KETEP) grant funded by the Korea government (MOTIE) (20224B10100140, 40%) and this work was supported by the Gachon University research fund of 2023 (GCU-202308140001, 20%).  
Not applicable.  
The raw data supporting the conclusions of this article will be made available by the authors on request.  
The authors declare no conflicts of interest.