## 2 Background and Related Work
### Step 4: Quantifying Cyberattack Scenarios  
The attack scenario quantification step determines which scenario is more appropriate for exercises with the CVE information, CVSS score, and DREAD. Various attack scenarios can be derived through the attack tree. Since each scenario has different characteristics, a criterion is needed to select the most suitable scenario for exercises. In this step, we evaluate the vulnerabilities assigned to the nodes in the attack tree, quantify each node (attack procedure) with a score, and then derive an attack scenario based on these scores. To quantify the attack procedure, nodes are evaluated by scoring for categories (damage potential, reproducibility, exploitability, affected users, and discoverability) of DREAD using CVSS, which means the severity of CVE vulnerabilities allocated to nodes. In order to calculate the score through the CVSS and DREAD, we utilize the CVE vulnerability information assigned to each node of the attack tree in the previous step. However, since it is difficult to identify CVE vulnerabilities related to some MITRE ATT&CK's techniques (i.e., native APIs), scenario developers can calculate DREAD scores based on their expertise or may not be included in the score calculation. **Damage potential**. DREAD's damage potential represents the expected damage to a system or asset if a particular vulnerability is successfully exploited. We adopt the impact score within the base scores of CVSS to score this category. The impact metric of CVSS represents the impact of a vulnerability on a system and comprises three subcategories: confidentiality, integrity, and availability impact. The CVSS scores for the given vulnerability are found in the NVD database. We can adopt the impact score within the CVSS scores provided by this database. If the NVD database does not provide scores for the vulnerability, the scenario developer can evaluate the impact of vulnerabilities on the confidentiality, integrity, and availability of assets. We record the level of damage potential assessed against the vulnerability in the form shown in Table 7.  
**Reproducibility**. DREAD's reproducibility is evaluated by considerations such as the effort, time, and technical resources required for an attacker to exploit the vulnerability. If a vulnerability can be easily reproduced, it has a high score. Conversely, reproducibility would be low if many resources and expertise were required to exploit a vulnerability. We adopt the attack complexity as the CVSS item corresponding to DREAD's reproducibility. In CVSS, the attack complexity is a binary evaluating metric: low and high. Reproducibility \begin{table}
\begin{tabular}{c c c} \hline \hline
**DREAD** & **CVSS** & **Scoring** \\ \hline Damage & potential & Impact metric \\ \hline \hline \end{tabular}
\end{table} 
Table 7: A scoring format for evaluating the damage potential of the CVE vulnerability. has an inverse evaluation of attack complexity, as the lower the complexity of an attack, the more difficult it is to reproduce it. If the vulnerability is difficult to reproduce, it is qualitatively rated as 'low' and quantitatively assigned a score of 5. On the other hand, if the vulnerability is easily reproducible, it is evaluated as 'high' and quantitatively given a score of 10. Quantitative scores may vary depending on the scenario developer's view. Scenario developers can utilize Table 8 to evaluate the vulnerabilities' reproducibility. **Exploitability**. The exploitability evaluates how easily a vulnerability can be exploited. The high exploitable vulnerabilities do not require advanced skills or resources. On the other hand, vulnerabilities requiring conditions such as expertise or tools have low exploitability. We use the CVSS's exploitability metric to evaluate the exploitability of vulnerabilities. CVSS's exploitability is evaluated by integrating the attack vector, attack complexity, privileges required, and user interaction.