# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 7 Related Work  
[PERSON] et al. use BPMN constructs to represent security-related concepts and model secure business process models [41], whereas [PERSON] et al. suggest an extension of the UML activity diagram to model security requirements as part of the business process model [42]. A rigorous procedure is suggested by [43] for the purpose of extracting and examining security requirements from business process models. The vast majority of effort is devoted to analysing software security requirements using techniques like attack tree [12], misuse case [44], and obstacle analysis [14]. Moreover, several proposals have been proposed to analyse and model attack scenarios, outlining steps to investigate how attackers execute an attack. Within the domain of the literature, there are numerous past studies that have focused mainly on devising techniques for simulating attack scenarios.  
For instance, researchers used attack trees [12] and graphs [13] as a means to capture and represent attack scenarios. Unlike our approach, these efforts are somewhat constrained in their ability to precisely define the methods used in attack strategies. Security patterns have been acknowledged as an effective approach to designing system security. As a result, more than dozen security methodologies have been suggested, all of which are based on security patterns [45]. [PERSON] et al. introduce a comprehensive pattern-driven security approach [30] that is specifically designed for general distributed systems. This approach is based on a substantial collection of well-documented security patterns [33].  
This methodology encompasses both the stage of gathering and analysing requirements and the stage of designing in the software development lifecycle. During the requirement analysis stage, the first step is to gather secure use cases by identifying activities that involve misuse. In order to fulfil these secure scenarios, they next identify appropriate security solutions by employing security patterns. Once the security solutions have been selected for the design phase, they implement security solution frameworks. These frameworks include high-level security patterns and micro process patterns, which are used to create the design of the security system. A further study has been conducted to analyse and conceptualise threats, such as STRIDE [3]. However, STRIDE falls short in capturing the intentions of attackers and has certain limitations when it comes to addressing multi-stage attacks. Unlike this work, there have been several explicit proposals aimed at understanding the underlying motives of attackers by using anti-goals, as suggested by [14]. Alternative methodologies, surpassing the works of [14,15], have been suggestedfor analysing security analysis by considering the perspective of an attacker and thoroughly analysing the malicious intentions of adversaries.  
Our approach exhibits resemblances to these approaches in terms of attack models, anti-goal refinement, and the construction of attack scenarios. However, our approach improves this by examining behavioural models of security attack scenarios and applying them to construct runtime attack models. Furthermore, our approach simplifies the building of runtime behavioural models and the identification of security events for the purpose of monitoring security attacks.