# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 1 Introduction  
Over the past decade, various sectors within society have experienced a rapid process of digitalisation. One significant trend involves the migration of crucial information resources and organisational procedures from physical to digital platforms. The implementation of novel socio-technical solutions has brought about numerous advantages by significantly enhancing operational efficiency in both corporate and governmental organisations, thereby altering the landscape of information and process management. However, it has also presented novel challenges. The increasing reliance on systems and networks has led to a greater vulnerability in essential service providers, such as government agencies and healthcare organisations, to incidents that disrupt their operations [1]. Cybersecurity incidents that affect the cyberinfrastructure, which includes the network and system resources of important service providers, can cause major impacts to essential digital operations. Consequently, this disruption indirectly hampers the organisation's capacity to effectively deliver services to its stakeholders. In addition to the general public, various other organisations are also involved. This prompts inquiries into the extent to which cyberattacks can inflict damage on organisational systems and networks, as well as indirectly impacts organisational functions and society as a whole([[https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022)]([https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022)), accessed on 19 December 2023). Cyber-physical systems(CPS) security breaches have cost large organisations multi-million dollar losses, and this cost is rising [2]. These breaches are caused by CPS's complexity and heterogeneity in people, processes, technology, and infrastructure. These heterogeneous components raise many security concerns and increase the attack surface compared to homogeneous software systems. These breaches are caused by trusted insiders (inadvertent or malicious), malware, SQL injections, hijacked devices, etc. Due to the increased number of attacks, CPS are the ideal target for multistage attacks, as attackers can combine atomic attack actions with different components to launch more dangerous attacks [3]. Failing to consider diverse attacks when designing CPS can make them vulnerable. This trend is attributed to the relatively low risks involved and the potential for significant gains. In the present era, the advent of state-of-the-art technological developments in areas including cloud computing, artificial intelligence, and the Internet of Things has introduced new vulnerability and, as a result, presented considerable cybersecurity obstacles. The advancements have increased the importance of addressing the cyber threat landscape faced by vital service providers and the potential repercussions of attacks targeting them. ([[https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022)]([https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022)), accessed on 19 December 2023)  
Targeted security analysis requires identifying likely attack strategies. The lack of knowledge about impending attacks makes operationalisation analysis difficult because analysts cannot realistically identify how attackers might attack a system, resulting in false positives or negatives during security analysis. As the security community has summarised practical attack knowledge in 559 attack patterns, i.e., common attack pattern enumeration and classification (CAPEC), we plan to remedy the knowledge gap. [PERSON] et al. argue that the formidable magnitude and span of CAPEC might deter individuals from participating [4], thus, analysts exhibit reluctance in employing such patterns.