## 3 The Proposed Attack Path Discovery
### Cyberattack Path Generation and Analysis Process
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{2}{c}{**Threat Actor Capability Scale**} & \multicolumn{2}{c}{**Description of Scale**} \\ \hline
**Qualitative** & **Semi-Quantitative** & **Description** & **Exploitability Features** & **Metrics** \\ \hline \multirow{4}{*}{Very High} & \multirow{4}{*}{80–100} & TA has a very sophisticated level of expertise, & \multirow{4}{*}{\begin{tabular}{c} TA has a very sophisticated level of expertise and is well-resourced for the required access vector and attack \\ complexity. TA can generate opportunities to support multiple successful, continuous, and coordinated attacks. \\ \end{tabular} } & Availability of all features & PR = required level \\  & & & & \\  & & & & \\ \hline \multirow{4}{*}{High} & \multirow{4}{*}{60–80} & TA has a sophisticated level of expertise, & \multirow{4}{*}{\begin{tabular}{c} Availability of all features \\ = PoC and Weaponized \\ Exploit, arbitrary code \\ execution \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} PR = required level \\ Entry point asset \\ AV = required level \\ \end{tabular} } \\  & & & & \\ \hline \multirow{4}{*}{Medium} & \multirow{4}{*}{40–60} & TA has moderate resources, expertise, and & \multirow{4}{*}{\begin{tabular}{c} Availability of some \\ features = PoC and \\ Weaponized Exploit, \\ arbitrary code execution \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} PR = required level \\ Entry point asset \\ Av = required level \\ Av = required level \\ \end{tabular} } \\  & & & & \\ \hline \multirow{4}{*}{Low} & \multirow{4}{*}{20–40} & TA has limited resources, expertise, and & \multirow{4}{*}{\begin{tabular}{c} Availability of some \\ features = PoC and \\ Weaponized Exploit, \\ arbitrary code execution \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} PR = not required level \\ Entry point asset \\ AV = not required level \\ AV = not required level \\ \end{tabular} } \\  & & & & \\ \hline \multirow{4}{*}{Very Low} & \multirow{4}{*}{0–20} & TA has very limited resources, expertise, and & \multirow{4}{*}{\
\begin{tabular}{c} No Availability = PoC and \\ Weaponized Exploit, \\ arbitrary code execution \\ \end{tabular} } & \multirow{4}{*}{
\begin{tabular}{c} PR = not required level \\ Entry point asset \\ AV = not required level \\ Av = not required level \\ \end{tabular} } \\  & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Threat actor exploitation capability. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multicolumn{2}{c}{**Threat Actor’s Exploitation Capability**} & \multirow{2}{*}{**Very Low**} & \multirow{2}{*}{**Low**} & \multirow{2}{*}{**Medium**} & \multirow{2}{*}{**High**} & \multirow{2}{*}{**Very High**} \\
**IVL** & & & & & \\ \hline Very Low & VL & VL & L & L & M \\ Low & VL & L & L & M & H \\ Medium & L & L & M & H & H \\ High & L & M & H & H & VH \\ Very High & M & H & H & VH & VH \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Cumulative exploitability vulnerability level. Once IoC is gathered, then it is necessary to correlate the evidence using the PoC. A PoC is a specific location such as an asset that is compromised by a threat actor. At this stage, it is necessary to determine the common PoC based on the vulnerability and its exploitability within the overall healthcare information infrastructure. The PoC allows us to correlate the IoC to formulate the evidence-based vulnerability chain and reproduce the attack path. The reproducibility also depends on the threat actor's capability to exploit the related vulnerabilities for a successful attack campaign. It is also necessary to determine the level of exploitability for a specific attack path based on the IoC and threat actor's exploitation capability. **Step 7.4--**Prioritise Attack Path: This is the final sub-step of the proposed method that aims to prioritise the attack paths.