## 2 Background and Related Work  
### Background  
#### 2.1.1 MITRE Adversarial Tactics, Techniques and Common Knowledge  
MITRE ATT&CK [8] is an open-access knowledge base that subdivides and structures attacks from the attacker's point of view based on data derived from actual security incidents. MITRE ATT&CK provides integrated information on tactics used by attackers to achieve goals and techniques for achieving tactics and is classified into enterprise, mobile, and ICS depending on the field. It is mainly used for defining attacks with attack trees,graphs, paths, and sequences in threat modeling [13; 14; 15; 16; 17]. In this paper, GENICS refers to tactics/techniques of MITRE ATT&CK for enterprise and ICS for attack identification in cyberattack scenarios. MITRE ATT&CK for enterprise provides 14 tactics and 227 techniques, and MITRE ATT&CK for ICS provides 12 tactics and 92 techniques. MITRE ATT&CK for enterprise/ICS includes a total of 16 tactics, and detailed explanations are as follows.  
Reconnaissance, such as active scanning, is a method by which an attacker collects information about a target organization or system. Resource development is a method by which an attacker develops or acquires tools, malware, and vulnerabilities necessary for an attack, such as establishing accounts. The initial access is how an attacker gains access to a system or network, such as hardware additions or supply chain compromise. Execution is a method that adversely affects the system by executing malicious codes or actions, such as execution using native application programming interfaces (APIs). Persistence is a method by which an attacker exists in the system or activates a specific function to maintain access permissions, such as account manipulation or activation of external remote services. Privilege escalation is a method of obtaining higher privileges within the system by extending the initial privileges acquired by the attacker, such as securing valid accounts. Defense evasion (evasion), like debugger evasion, is a method by which attackers circumvent security systems and tools to avoid detection and response. Credential access, like brute force, is a method by which an attacker obtains valid credentials within the system. The discovery, like network sniffing, is a method in which an attacker performs exploration within the system to obtain information about the architecture and environment of the target system. The lateral movement, like replication through removable media, is a method in which an attacker moves within a system to expand access permissions or find vulnerable systems. The collection is a way to collect information targeted by an attacker, such as screen capture. The command-and-control method is when an attacker remotely transmits and controls commands to a malicious code or system, such as proxy communication. The inhibit response function, like denial of service, is a method by which an attacker hinders or interferes with the target organization's ability to respond to security. The exfiltration, like exfiltration over alternative protocol, is a method of leaking data or information an attacker steals to the outside. The impair process control, such as spoof reporting messages, is a method by which an attacker manipulates a process or control system in a system to disrupt or damage its operation. Lastly, the impact, like data manipulation, is a method by which an attacker exerts a destructive influence on the system to achieve the final goal.