# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 8 Conclusions  
The analysis of IT incident reports from Swedish service providers to MSB indicates that denial-of-service attacks and disruptions have the most significant effect on operations and information. Among the 254 cyberattacks analysed, a significant number did not result in any apparent direct or indirect impacts. In many cases, social engineering attacks had minimal immediate impacts. While the occurrence of social engineering for initial access and user attacks is declining, it still remains widespread. Instances of malware infection are minimal. The IT incident reports revealed a limited number of malicious incidents that compromised the information resources of significant service providers. The experiment has categorised the attack patterns according to the domain and method of attack. **Mechanism-Based Attack**: The attack patterns are structured hierarchically, taking into account the commonly utilised mechanisms for exploiting vulnerabilities. The attack patterns encompassed within this category exemplify the diverse methodologies employed in targeting a system. Nevertheless, the aforementioned attacks do not adequately depict the resultant ramifications or objectives. **Domain-Based Attack**: The attack patterns are organised in a hierarchical manner, taking into consideration the attack domain. Attacks encompassing various techniques, including social engineering, supply chain, communication, physical security, and others, are classified within this category. We performed a behavioural attack pattern analysis using the Asfalia framework, specifically developed for monitoring and analysing security events in CPS. The analysis was performed using IT incident reports obtained from critical service providers to MSB. The use of the framework was essential in order to make the analysis and documentation of security events, behavioural models, and their annotations possible, given the significant scale of the scenario. The analysis of attack patterns resulted in the identification of five security attacks, seven vulnerabilities (also known as threats), ten attack patterns, and ten parallel attack patterns. Furthermore, the framework effectively specified a comprehensive set of 24 attack mechanisms, 32 specific tasks, 23 behavioural annotations, 10 domain assumptions, and 35 security events. The analysis indicates that the security incidents used in the experiment can be categorised into specific attack patterns based on their behaviours, such as password recovery exploitation, authentication abuse, buffer overflows, cross-site scripting, phishing, and brute force attacks. Our framework offers the benefit of assisting security analysts in their analysis of security events and the creation of security solutions for essential service providers. More precisely, the VM captures the malicious individuals and weaknesses and then analyses the target of the attack using a specialised approach specific to the domain. The AM constructs an attack model by exploiting the adversaries specified in the VM. The behavioural model (BM) provides annotations for the (VM) and (AM). In (EM), events are derived from behavioural models. There is a need for research on incident severity using indirect impact indicators. The incidents were categorised based on the type of component. Studying how DDoS attacks contribute to the prolonged duration of critical service downtime would be noteworthy. The experimental results indicate that the primary limitation of the current framework is the requirement for users to have a high level of proficiency in both modelling and security. Further experiments will include different combinations of users, including individualswith proficiency in modelling but little knowledge in security, as well as those with expertise in security but limited knowledge in modelling. Hence, it is important to enhance Asfalia prior to undertaking a further evaluation. Conceptualization, E.S., O.P. and F.B. ; Methodology, E.S. ; Formal analysis, E.S. ; Validation, E.S. and O.P. ; Supervision, O.P. and F.B.