## 2 Related Work  
### Cyber Attack Modeling  
Cyber attack is modeled by various methods, such as the attack graph approach, attack tree approach, cyber kill chain modeling approach, diamond model, and simulation approach [3]. The attack graph approach is a typical approach for modeling cyber attacks. The attack graph method is a method of graphing all possible paths that an attacker can attack by using information of hosts in a network. Research is underway to detect the most vulnerable or the most likely of the attack paths generated. In addition, research is being conducted to evaluate security risks based on attack graphs. The authors of [4] introduced NetSPA tools that analyze firewall rules and vulnerabilities to construct attack graphs. NetSPA is a tool that derives a number of methods to attack vulnerable hosts behind a firewall. Using Vulnerability scans, Vulnerability databases, Firewall rules, and Topology information, reachability can be automatically calculated and an attack graph can then generated. However, it is difficult to create a full attack graph as the network size grows. The authors of [5] proposed a bidirectional-based search strategy to improve the efficiency of attack graph generation and reduce system resource consumption. It defines the minimum cost to strengthen a network and combines the attack graph and genetic algorithm to suggest an optimized network. In [6], the authors suggested a framework that implements attack graph generation, real-time event analysis techniques, attack effect assessments, and the anytime approach for attack graph building and analysis. [PERSON]'s suggestion in [7] is also based on the construction and analysis of attack graphs. [PERSON] transformed raw security data into attack graphs to provide a common operating picture and a concrete understanding of how individual and combined vulnerabilities affect the overall network security. Generating attack graphs is computationally complex especially for large networks [3]. Note that existing attack models have scalability issues for large network systems and predicting possible attack paths and patterns in large network systems is challenging [8]. The attack tree is another typical approach for modeling cyber attacks. In [9], cyber attack is represented in the form of a tree. The attack tree constitutes a cyber attack scenario by constructing the final cyber attack target as the root and sub-targets as leaves. In [10], an attack model based on an attacker's intent was proposed to determine the role of an individual intrusion detection system (IDS) in a distributed IDS environment. An attack tree based on cyber attack modeling can derive various attack scenarios to achieve the final attack target. However, the more complex the attack scenario, the more difficult it is to identify and describe an attacker's intent. The cyber kill chain is derived from the conventional military term--kill chain. A kill chain is a continuous process from detecting a target to destroying it. Cyber kill chain modeling has been used for many years by the U.S. Department of Defense (DoD), and this model defines an attack as a chain of actions [3; 11]. The cyber kill chain has been proposed by various models including Lockheed Martin's cyber kill chain model, the U.S. DoD's cybersecurity kill chain model, and Gartner's attack chain model. In particular, Lockheed Martin has developed a cyber kill chain model that comprises seven steps: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives [12]. The model is malware-focused and centers on the advanced persistent threat (APT) attack. Most cyber kill chain models use a simplified approach at the conceptual level, and there exist limitations in fine-tuning for various attack types or modeling complex attacks in a scalable manner. The diamond model is a novel model for cyber intrusion analysis [13]. The model comprises four main components: adversary, infrastructure, capability, and victim, all of which are connected in a diamond shape.