# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 2 Research Baseline
### Asfalia Framework  
This section presents the Asfalia framework that supports the monitoring of security attack events for CPS, and the framework spans the three realms of a CPS. Moreover, the framework supports cross-realm analysis and monitoring, which spins off security events across realms. Our models focus on realm-specific adversaries, meaning that they span the three realms of a CPS (cyber, physical infrastructure, and social). We also analysed the interdependent relationships among realm-specific attack models. The AM depends on the VM model in revealing realm-specific vulnerabilities, and the vulnerabilities captured by (the VM) spin off and provide inputs to the next realm (AM). Thus, a suitable attack mechanism is selected by taking advantage of the weaknesses of the VM. More detailed information can be found in [7]. The Asfalia analysis process consists of the following steps.  
**Vulnerability Model (VM)**: This model captures the attack patterns, potential threats, and type of asset, in which an asset is a potential target for cyber attacks. The VM consists of the following sub-elements.  
**Threat**: This is the potential for abuse of an asset that will cause harm in the context of the problem.  
**Vulnerability**: This is a weakness in the system that an attack exploits.  
**Asset**: This is anything that has value to an organisation, and it can be tangible (physical) or intangible (non-physical) with respect to the target of the attack.  
**Attack pattern**: This is defined as a generic description of a deliberate, malicious adversary that frequently occurs in a specific context [40]. It describes the common elements and techniques used in attacks against vulnerable CPS components. These patterns generalise reusable attack knowledge from frequent adversaries to facilitate security requirements analysis for the system-to-be. An attack pattern consists of the general goal of the attack, the antecedent, the steps to carry out the attack, and the consequent.  
**Attack-Mechanism Model (AM)**: This model captures design strategies for different attack pattern mechanisms. More importantly, it builds attack mechanisms by employing goal models, domain assumptions, attack mechanisms, and task operationalisation artefacts. Each attack pattern captures knowledge about how specific parts of an attack are designed and executed, providing the adversary's perspective on the problem and the solution and guidance for mitigating the attack's effectiveness. The AM depends on the VM since it prepares its attacking mechanism based on the threat explored in the VM. However, threats can be refined not only linearly but also iteratively.  
**Behavioural Model (BM)**: Building a complete behavioural model for very complicated systems such as CPS, with many complex and heterogeneous states, is often challenging [7]. To understand how attackers fulfill their target by compromising security concerns such as confidentiality, integrity, availability, and accountability, one has to analyse how the threat environment behaves within the system, how adversaries can compromise the system, and how the system behaves under multi-stage attacks, as well as recognise system behaviours to facilitate such analysis. This model captures fundamental system behaviours such as **sequential**, **interleaving**, **multiplicity**, and **alternative** instances of attack goal models, sub-goals, domain assumptions, and tasks.  
**Event Model (EM)**: This model captures events derived from behavioural models (BM). These events could be grouped into observable and non-observable events from an event-log perspective. We focus mainly on observable events.