## 2 Related Work
### Cyber Attack Classification and Modeling Resources  
The ATT&CK model is a cyber adversary behavior model that reflects the attack life cycle of an attacker [15]. It defines tactics that correspond to the target of the enemy attack, and presents the ATT&CK matrix, which defines techniques as a concrete method for achieving the attack purpose. This model systematically explains the attack activity that an attacker performs inside a network after the exploit phase in the cyber kill chain model in terms of tactics, techniques, and procedures (TTP). The ATT&CK matrix is available for Windows, Mac, and Linux platforms. In addition, the PRE ATT&CK model has been proposed to classify the types of actions to select attack objects, obtain information, and perform infiltration actions [16].  
The common attack pattern enumeration and classification (CAPEC) lists and categorizes the contents of known attacks [17]. That is, it classifies an attacker's attack patterns that penetrate security vulnerabilities. It is provided by MITRE and each attack pattern is assigned an identifier. Each attack pattern provides an attack procedure, attack essentials, countermeasures, and other related attack patterns. The attack patterns listed in the CAPEC comprises attack methods to exploit hardware or software vulnerabilities.  
Common vulnerabilities and exposures (CVE) was established and operated by MITRE in 1999 as a standard for attack vulnerabilities [18]. It was then systematically organized by the National Institute of Standards and Technology in the U.S. by developing the national vulnerability database. The CVE identifier consists of the CVE character, the year in which the vulnerability was found, and a unique value that can be used to identify publicly known vulnerabilities.  
Common platform enumeration (CPE) is a standardized method for naming software applications, operating systems, and hardware platforms [19]. The CPE value comprises seven fields: <part>, <vendor>, <produce>, <version>, <update>, <edition>, and <language>, some of which can be left blank. The <part> field is divided into application, hardware platform, and operating system.  
The common vulnerability scoring system (CVSS) identifies the key features of a vulnerability and provides a method for generating a score that reflects the severity of the vulnerability. The CVSS can provide standardized vulnerability scores and an open framework as well as prioritize risks. The CVSS is categorized into version 2.0 and version 3.0 depending on the difference in the metric and scoring method [20].  
Proposed Hierarchical Multi-Stage Cyber Attack Scenario Modeling Based on G&E Model and Analysis System  
We herein propose a hierarchical multi-stage attack scenario modeling method based on the G&E model. The G&E model can express various goals of an attack and damage effects without being limited to specific types. In recent years, cyber attacks have not been composed of a single attack, but have evolved into a combination of various attacks to achieve the final goal. The hierarchical multi-stage cyber attack scenario modeling method combines the G&E model to construct a unit attack, and the multi-stage configuration of unit attacks achieves the final goal of a cyber attack. The proposed method enables the organization of complex scenarios systematically and facilitates the intuitive understanding of cyber attack progress.