## 2 Related Study
### Representativeness of the Four Attack Types  
Each type of malware--Industroyer, Triton, NotPetya, and BlackEnergy3--targets vulnerabilities within specific security layers, exemplifying cross-industry risks. For example, Industroyer's SCADA-focused attacks are directly relevant to power grid security, while Triton's SIS infiltration poses severe risks for energy and chemical sectors. Studies by [PERSON] and [PERSON] [28] and [PERSON] et al. [29] confirm similar methodologies and attack patterns in finance and transportation, illustrating how these cases embody cross-industry vulnerabilities and serve as essential threat models for critical infrastructure resilience planning. The selection of these cases is based on their documented impact, recurrence, and adaptability across sectors, providing a foundational framework for understanding critical infrastructure vulnerabilities. These attacks exemplify critical vulnerabilities in modern energy infrastructure, evidenced by their economic, operational, and infrastructural impacts. Their selection underscores the urgent need to understand and defend against the specific threats posed to essential systems within the energy sector [28; 29]. Industroyer is a sophisticated malware that targeted Ukraine's power grid in 2016, resulting in a power outage that affected 225,000 households by exploiting vulnerabilities in SCADA systems. This attack highlights the increasing danger of cyberattacks on critical national infrastructure. Although the exact economic losses were not calculated, it is estimated that millions of dollars were lost due to the suspension of essential services such as healthcare, industrial operations, and transportation during the outage. Restoring the power grid took several days, adding further costs for cybersecurity response and infrastructure improvement. A similar incident occurred in Ukraine in 2015, with estimateddamages of USD 100 million. Industroyer demonstrates the vulnerability of SCADA systems, which play a crucial role in national infrastructure, particularly during times of heightened geopolitical tensions. These types of attacks can also affect other critical infrastructures such as airports, seaports, and hospitals, posing significant risks to national security [30]. Triton is a highly dangerous malware that targeted the Schneider Electric Triconex SIS in a 2017 attack on a petrochemical plant in Saudi Arabia. This malware aimed to disable the SIS, which is a crucial system designed to ensure the safe operation of industrial equipment, potentially leading to catastrophic physical damage and loss of life. Although the exact economic impact of the attack was not fully calculated, experts estimate that if the attack had succeeded, it could have resulted in billions of dollars in damages. The attack posed a serious risk of explosions or environmental disasters, with the potential to destroy the entire facility. The Triton incident exposed critical vulnerabilities within global energy infrastructure, particularly in high-risk sectors such as oil, gas, and chemicals. Strengthening the security of SISs is essential to prevent future incidents that could lead to catastrophic consequences [31]. NotPetya, a wiper malware that emerged in 2017, was specifically designed to destroy data by exploiting the EternalBlue vulnerability, which enabled it to spread rapidly across networks. It primarily targeted critical infrastructure, including Ukraine's power grid, financial institutions, and global logistics companies. The attack caused more than USD 10 billion in damages worldwide, severely impacting both government agencies and large corporations, such as MAERSK, FedEx, and Merck. MAERSK alone reported losses of USD 300 million, with Merck suffering similarly. NotPetya stands as one of the most clear-cut examples of the destructive potential of cyberattacks, demonstrating the widespread damage they can inflict.