## 5 Proposal Experiment and Attack Models
### Attack Models  
Currently, cyberattacks are considered one of the Internet's key concerns. Different attack tools are grouped into the Internet by computer virus categories and target the computer device linked to the Internet. A growing danger of attack may be caused by a criminal enterprise focused on connecting illegal objectives such as distributing spam messages or collecting sensitive data that an unauthorised individual cannot otherwise access [39]. However, there is a growing diversity of malware that affects protection techniques as well as classic security systems, such as antivirus scanners which deliver ineffective results. Consequently, hundreds of Internet hosts may be affected due to malware [40]. The article discusses the claims that malware exploration is a coherent discussion of the characteristics that separate malware into various categories and is considered an efficient and effective malware study. Malicious software is divided into complex and diverse actions based on various modifications to advanced network connections. Malware connections between different and the same families share similar behaviour, and their patterns, which are also the same, are based on certain modifications that may capture the specific machine [40]. Our task is to explore this malware's sharing pattern as it is an automated analysis, and its basic goal is to provide a reliable structure that will help identify the malware community based on their actions. Figure 8: Screenshots from some tools used in the experiment for (**a**) ADP Subsystem; (**b**) RAD Subsystem. Besides attack style, the most complicated malware analysis is an event-based model based on the simple technique of representing the information about discrete event systems. Several attacks may be analysed into basic components based on complex scalable event sequences. There is also another justification to use the event-based model that some researchers use in the methodology design evaluation stage, as it offers a working environment for the fundamental research and assessment goals used to follow the research process [41]. For example, the internet's surface level could be attacked by the user as if it were a drive-based attack. Drive-by-download is considered an easy way to spread malware. Hackers are constantly searching for vulnerable websites and considering the creation of malicious HTTP or PHP code scripts that could be used in these websites to capture data. These kinds of states could be installed from any website by a machine, and it could take the form of an IFRAME that redirects the victim to download a particular site that is managed by criminals [42]. The event driver download arrangement is attacked; Figure 9 could reflect this situation. After exploring malicious software code, it could be executed as a resistance subscription, ending up with the static scan's single object. However, a web browser may analyse the behaviour detection component and provide information about blocks and malicious activity. We created two attack models in order to measure our proposal's efficiency in achieving its main goal of attack detection, as well as to test the validity of having immutable data in these kinds of systems. The first attack model is the event-based model, which represents the attacks that may affect the existing event or event details. The second attack model is the behaviour-based model, which represents the attacks that affect the system behaviour layout. Therefore, we injected the proposal with both of these attack models during runtime to perform our validation testing. The preliminary results show that the proposal was able to detect both attack models based on the selected detection modes related to the detection mechanisms. As mentioned in the previous section, we proposed three detection modes that utilise two proposed detection mechanisms.