# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 2 Research Baseline
### Cyber-Physical Systems  
The rapid pace of cyber developments has resulted in a lack of consensus regarding the understanding of cyberattacks and their consequences [34]. The present study adopts the definition of a cyberattack provided by [35], which encompasses a wide range of \"offensive actions\" that have an impact on the cyber infrastructure of an organisation. Offensive action includes both active attacks, such as DDoS attacks, and passive attacks, such as cyber-exploitation, which involves unauthorised information gathering [29]. Cyberattacks on the cyberinfrastructure may target processes, hardware, and users. There are various cyberattack techniques, such as syntax attacks (using malware) and semantic attacks (using social engineering techniques) to gain access to targeted cyberinfrastructure [29; 34]. The definition of \"offensive action\" encompasses both social and non-digital actions, such as the physical targeting of hardware components [35]. Cyberattacks have multiple components and are understood at different levels of abstraction, leading to ambiguity in academia and organisation practises [36]. Numerous taxonomies have been developed to classify various aspects of attacks in recent decades [29]. According to [37], cyberattack frameworks typically include five components: goal, attack-source, target, attack vector, impact. The authors identify three dimensions of these components: adversarial, methodological, and operational, to differentiate their qualities better. In this context, adversarial refers to the threat actor and their strategic and operational objectives for the attack. Methodological refers to the techniques used by threat actors to achieve their goals. Finally, the operational dimension refers to the impact of the cyberattack on the targeted infrastructure. The operational dimension of cyberinfrastructure includes two types of impact: impact on the targeted system networks or impact on information assets [37]. According to [22], a cybersecurity incident involves compromising the confidentiality, integrity, and availability of systems, networks, and other IT resources. The AVOIDIT cyberattack taxonomy [38] is a well-known and often-used framework in the academic literature. It can be argued that this framework primarily emphasises the operational dimension of cyberattacks. A classification framework was introduced in [38], consisting of four classifiers designed to classify attacks. The following are the classifiers:  
* Attack Vector: An attack vector constitutes the type of vulnerability that the attacker might use to obtain access to the cyber infrastructure
* Operational Impact: Operational impact can be defined as the activities undertaken by an attacker having gained access to the targeted organisation's cyberinfrastructure
* Informational Impact: Can be defined as the effect cyberattacks have had on sensitive and otherwise protected systems and information assets
* Target: High-level understanding of the concept and, thus, classifies incidents based on components like network and software or software system  
Moreover, a classifier was added to categorise incidents based on preferred defensive measures. An attack vector refers to the specific path that is used to gain access to the targeted component. This definition aligns with MITRE's concept of \"initial access\" [39] ([[https://attack.mitre.org/](https://attack.mitre.org/)]([https://attack.mitre.org/](https://attack.mitre.org/)), accessed on 6 June 2023). In contrast to MITRE, [PERSON] et al. emphasise a broad understanding of exploited vulnerabilities rather than attacker tactics and techniques in cyberattacks. The impact is described using operational and informational impact classifiers [38]. Operational impact encompasses compromised system or network functionality, including \"web compromise\", \"installed malware\", and \"denial of service\". An additional classifier, informational impact, describes how the attack impacts the informational resources within the cyber infrastructure.