# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 5 Experiment and Result
### Security Attack Behaviour Analysis of DDoS  
**Vulnerability Model (VM):** This model captures type of attack patterns, potential threats, and type of asset in which an asset is a potential target for cyber attacks. VM consists of the following sub-elements: **threat**, **vulnerability**, **asset**, **attack pattern**, **antecedent**, **consequent**. **(1) threat**: An adversary exploits a deadlock condition in the target software in order to induce a denial of service. This attack can be categorised as a forced deadlock attack pattern. Additionally, the adversary may employ a parallel-attack pattern by manipulating timing and state. The specific target of this attack is the software itself. **Attack-Mechanism Model (AM)**: This model captures design strategies, different attack pattern mechanisms. More importantly, it builds attack mechanisms by employing goal models, domain assumptions, attack mechanisms, and task operationalisation artifacts. Each attack pattern captures knowledge about how specific parts of an attack are designed and executed, providing the adversary's perspective on the problem and the solution, and gives guidance on ways to mitigate the attack's effectiveness. AM model depends on VM model since it prepares its attacking mechanism based on the threat explored in VM model as shown in Figure 5. However, threats can be refined not only linearly but also iteratively. The second sub-attack mechanism consists of three sequential steps. Prior to initiating an attack, the attacker must acquire a comprehensive understanding of the targeted system. After that, they launch a specific operation within the system. Finally, they investigate whether the target condition reveals a deadlock condition. **Assumption within the domain:** Assuming that the target host has an application programming interface (API) that allows attacker access, and the target programme is currently in a deadlock state. In the fourth task or activity, the attacker must begin the exploratory phase by initiating the first action and then proceeding to initiate a second action. The objective of this task is to verify if the programme is in a state of deadlock. **Behavioural Model (BM)**: To understand how attackers fulfill their target by compromising security concerns such as confidentiality, integrity, availability, and accountability, one has to analyse how the threat environment is behaving within the system, how the adversaries can compromise, and how the system behaves under multi-stage attacks, as well as recognise system behaviours to facilitate such analysis. This model captures fundamental system behaviours such as sequential, interleaving, multiplicity, alternative instances of attack goal models, sub-goals, domain assumptions and tasks (mechanisms). **Runtime Attack Model**. The BM model provides annotations of fundamental system behaviour, derives runtime attack models from design-time attack models in order to support attack event monitoring. Alternative system behavior expresses that the system needs to satisfy a goal, and depending on the type of obstacle faced, a change in behaviour is  
Figure 4: Meta-level attack and Design-time attack model. expected to happen, and multiple instance annotates running system behaviours that could have more than one instance, and the instances can be ordered in sequence (sequential) or they can occur concurrently (interleaved). **Sequential**: The attack pattern known as \"Forced Deadlock\" can be annotated with the following behavioural annotations: (G2, G3#, and G4#). These annotations indicate that the sub-attack mechanism \"Get familiar with system\" must be achieved first, followed by the instances of \"Trigger an action\" and \"Explore if the target condition has a deadlock condition\". **Interleaving**: The formal behavioural annotation for the action of (triggering an action) is denoted as (T2#DA1), which represents the interleaved fulfilment of the (target host exposing an API to the user) and the triggering of the first action followed by the initiation of a second action.