# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 1 Introduction
These proposals outline steps that can be taken to investigate the methods employed by attackers during an attack. Within the existing collection of the literature, various proposals have been put forth with the aim of presenting methods for representing attack scenarios. For instance, researchers have utilised attack trees [12] and graphs [13] as viable approaches to capture attack scenarios. In contrast to our approach, these efforts exhibit certain limitations in terms of providing explicit details regarding the execution of attack strategies. Further study has also been carried out to analyse and model threats like STRIDE [4], but these efforts are somewhat limited in their ability to handle multi-stage attacks and fail to account for the intentions of the attacker. Several proposals, such as [14], have been explicitly addressed to capture the reasoning behind attacker actions using anti-goals, in contrast to this work. An attacker's perspective and the adversary's malicious intentions have been proposed for security analysis in similar ways to [14, 15]. Our approach aligns with these approaches in terms of attack models, anti-goal refinement, and the construction of attack scenarios. However, our approach goes beyond this by analysing behavioural models of security attack scenarios and using them to generate runtime attack models. This study has the potential to provide valuable insights into the patterns and advancements within the field of cybersecurity and is crucial for developing a comprehensive and evidence-based understanding of the potential threats. However, there is a lack of research investigating the impacts of cyberattacks on significant service providers. Furthermore, there is a lack of sufficient investigation into the nature of the impact that these attacks have had on the cyberinfrastructure of organisations, as well as the frequency with which incidents lead to adverse consequences beyond the digital realm. This trend can be partially attributed to the inherent challenges associated with the collection of data associated with the incidents that take place. A significant amount of the research on cyberattacks relies on sources such as media reports, open-source intelligence, and interviews with professionals [2, 3, 4, 16, 17]. At the same time, it has been determined by entities such as the European Union Agency of Cybersecurity (ENISA) that publicly reported incidents represent only a fraction of the total, implying that a significant number of incidents remain undetected or unreported (ENISA, 2022, Rue de la Loi 107, 1049 Brussels, Belgium). The absence of research focused on the characterisation and consequences of malicious activity directed at significant service providers can be considered problematic from various viewpoints. According to [9, 18], it was argued that this trend may have implications for the organisations' capacity to effectively assess risk. This is due to a limited understanding of the probability and characteristics of potential attacks [9, 18]. The lack of research into the adverse effects of cyber attacks hinders the researchers' ability to understand the organizational and societal implications of these malicious activities [19, 20]. Objectives of this study: (1) Analyse the specific characteristics of cyber security threats that specifically target prominent service providers in Sweden. (2) Analyse cyber attack patterns and their corresponding cyber security solutions using Asfalia [7]. This study analyses cyber security incident reports submitted to MSB to enhance the understanding of cyberattacks on critical service providers in Sweden. The study aims to address the following research questions (RQs). * Research Question (RQ1:) What is the impact of multi-stage attacks on the cyberinfrastructure of critical service providers? * Research Question (RQ2): How do critical service providers analyse multi-stage cybersecurity attacks in order to defend against them? The remaining parts of this paper are structured as follows.