## 2 Related Work
### Hierarchical Multi-Stage Cyber Attack Scenario Modeling  
We herein propose a hierarchical multi-stage cyber attack scenario modeling method, as shown in Figure 2. The philosophy of this modeling method is that attack scenarios can be constructed to be extremely short or extremely long and complex, and should be able to express the desired attack goals and damage effects. Stages in the scenarios define the subgoals to achieve the end goal and can be long and complex. Depending on the success and failure of the current stage, progress to the next stage can be set. Attack graphs also have this concept, but only focus on the view of connected nodes. A unit attack is a payload of a stage, which describes a series of actions for specifying the stage. In particular, the goals and effects are composed of a combination of G&E models. The components of the stage are presented in Table 2. Label indicates the name of the Stage. Minimum Delivery Delay is the time to wait after the start of the Stage and can simulate an attacker's start-up time of attack. Unit Attack Payload refers to the Unit Attack called on the Stage. The Execution Condition comprises the execution conditions of the other stage and the current stage to be referenced. Destination is a field that defines a cyber attack target. Success is a field that defines the success condition of the stage. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**G\&E \#** & **Name** & **Explanation** & **Attributes** \\ \hline \multirow{2}{*}{\(1\)} & \multirow{2}{*}{Social Engineering} & Attackers use to gain an initial foothold & CVE List, File Open Probability, \\  & & within a network & Included Malicious Actions \\ \hline \multirow{2}{*}{\(2\)} & \multirow{2}{*}{Reconnaissance} & Gain knowledge about the system and & Scan Range, Target Device, Start Time, \\  & & internal network & Inter-arrival time, Packet size, Duration \\ \hline \multirow{2}{*}{\(3\)} & \multirow{2}{*}{Privilege Escalation} & Obtain a permissions on a system & CVE List, Gain Privilege Probability, \\  & & or network & Privilege Type \\ \hline \multirow{2}{*}{\(4\)} & \multirow{2}{*}{Forgery} & An action that impacts the integrity & Target File, CVE List, Forgery \\  & & of something & Probability, Included Malicious Actions \\ \hline \multirow{2}{*}{\(5\)} & \multirow{2}{*}{Denial of Service} & \multirow{2}{*}{Flooding Attack was attempted} & Flooding Type, Target Device, \\  & & & Inter-arrival time, Packet size, Start \\  & & & Time, Duration \\ \hline \multirow{2}{*}{\(6\)} & \multirow{2}{*}{Command \& Control} & Attackers communicate with systems & \\  & & under their control within a target & C\&C Server, Interval, Included \\  & & network and send controlled code on a & Malicious Actions \\  & & local or remote system & \\ \hline \multirow{2}{*}{\(7\)} & \multirow{2}{*}{Exfiltration} & An attempt was made to exfiltrate & CVE List, Info-leak Probability, Leak \\  & & information and especially remove files & Interval, Packet Size, Start Time, \\  & & and information from a target network & Duration \\ \hline \multirow{2}{*}{\(8\)} & Destroy Device & System destruction was attempted & Target Device, Start Time, Duration \\ \hline \multirow{2}{*}{\(9\)} & \multirow{2}{*}{Spreading} & Worm propagation attack & CVE List, Infection Probability, \\  & & was attempted & Included Malicious Actions, Interval, \\  & & & Target Mode \\ \hline \multirow{2}{*}{\(10\)} & Resource Consumption & CPU/Memory resource consumption & \\  & Consumption & was attempted & Start Time, Duration, Usage \\ \hline \(11\) & Unknown & It is an unknown attack & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Explanation and attributes of G&E models. The components of the unit attack are shown in Table 3. Label indicates the name of a unit attack. G&E is the name of the G&E model. To express the goals and effects, a combination of G&E models called in the unit attack is described. Execution Condition consists of the name of the other G&E model to be referenced and the current G&E execution condition.