# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 1 Introduction
Although a number of studies have been performed to deal with the scalability problem of CAPEC [3, 5, 6], they all require manual practise, assessment of the applicability of cyber attack patterns, and cannot efficiently incorporate CAPEC behavioural patterns into security attack analysis. Analysing potential attacks plays an important role in the design of secure CPS. This process facilitates the detection of attacks, which ultimately guides the formulation of essential security requirements. Furthermore, it provides insight into the necessity and rationale behind the implementation of specific security mechanisms. In our previous study, we have presented a comprehensive framework for monitoring security attack events across multiple realms [7]. The framework consists of the following elements: vulnerability model (VM), attack-mechanism model (AM), behavioural model (BM), and event model (EM). Each component of the framework is described below. **Vulnerability Model (VM)**: This model captures the type of attack pattern, as well as potential threats and asset types. An asset is anything that has value to an organisation. Assets can be tangible (physical) or intangible (non-physical). Security concerns, such as confidentiality, integrity, availability, and accountability of an asset, can be associated with the business, application, or infrastructure context. **Attack-Mechanism Model (AM)**: This model captures goal models, domain assumptions, attack mechanisms, and task operationalisations that are used in cyber attacks by taking advantage of CPS weaknesses with the intent of achieving negative social and technical impacts. The lack of adversaries during the design of a secure system creates a challenge for security development and engineering [8]. Adversaries are anti-stakeholders that compromise the system. For example, threats are indirectly discovered because of adversaries, whose goals, potentials, and behaviours define the threats to a system. **Behavioural Model (BM)**: This represents and captures the runtime behaviour of an attack strategy, providing the runtime attack behaviour of security attacks. In this model, the attack-mechanism Model(AM) was employed to generate attack behaviours. Event Model (EM): This model captures events derived from the attack-mechanism and behavioural models (BM and AM). **Runtime Attack Model**: The BM provides annotations of fundamental system behaviour and derives runtime attack models from design-time attack models to support attack-event monitoring. Addressing multi-stage attacks on CPS has proven to be challenging due to the vulnerability of their components to cyber-attacks. Addressing these attacks continues to be a challenging unresolved issue, as each component bears its own complexities and vulnerabilities, requiring an integrated security solution [9]. Designing a security solution for CPS is more challenging compared to software systems due to the additional consideration of the interaction between CPS components (such as sensing, communication, and computing components) and the physical environment [10]. CPS components that are exposed to increased risk and vulnerability to attack can be exploited by malicious actors. This vulnerability arises from the fact that these components, such as sensors, operate within an open and inherently insecure environment. Consequently, security threats such as unauthorised information disclosure, transmission of falsified data, and violations of authentication and/or authorisation protocols must be carefully considered. The research in the area of security patterns has made significant advancements in the collection and organisation of these patterns. However, their practicality and usefulness in real-world scenarios is limited. In their study, ref. [11] proposed the concept of attack patterns as a means to consolidate and utilise the attack knowledge derived from multiple instances of attacks. The primary objective of this approach is to facilitate the analysis of security requirements.