# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 6 Discussion
### Behavioural Attack Pattern Analysis  
Research Question 2: identifying potential attacks on a system is a vital aspect in developing secure systems, as it allows for determining the necessary security requirements. Analysing attacks in CPS provides a substantial challenge due to their ubiquitous occurrence. These systems contain individuals, entities, software systems, and tangible infrastructures. The Asfalia framework facilitates the analysis of attack patterns for critical service providers, covering the three realms of CPS. In addition, the framework facilitates cross-realm analysis and monitoring, allowing for the detection of security events that occur across different realms. Our models specifically target adversaries that are specific to each realm, encompassing the three realms of a CPS (cyber, physical infrastructure, and social). We conducted an analysis of the interconnected relationships between attack models specific to different domains. The (AM) relies on the (VM) to reveal vulnerabilities that are specific to a particular realm. The vulnerabilities identified by the VM are then transferred to the next realm, which is the AM, and serve as inputs. Therefore, an appropriate attack strategy is chosen by exploiting the vulnerabilities of the VM. **Attack pattern**: This refers to a broad description of an intentional and malicious opponent that often arises within a particular setting. This paper discusses the typical elements and techniques employed in cyberattacks targeting vulnerable components of (CPS). These patterns extrapolate reusable knowledge about common adversaries to aid in the analysis of security requirements for the system under consideration. An attack pattern comprises the overarching objective of the attack, the initial phase, the sequential actions to execute the attack, and the consequent outcome. Every attack pattern incorporates information regarding the design and execution of specific attack components, offering insights into the adversary's viewpoint on the issue, as well as guidance on how to minimise the impact of the attack. The (AM) relies on the (VM) as it formulates its offensive strategy by analysing the vulnerabilities discovered within the VM. Nevertheless, threats can be enhanced not only in a linear manner but also through iterative processes. Hence, a thorough analysis of an attack requires an assessment of the strategic components related to the individuals and organisations involved, encompassing social and organisational factors. Furthermore, it is essential to consider the technical factors that affect software systems and physical infrastructure. This endeavour requires a significant level of expertise in security, which presents difficulties in terms of obtaining it. We initially concentrated on analysing the process of identifying an assailant's tactics by conducting a methodical analysis of their malicious intentions. Each attack strategy includes one or more anti-goals that define the malicious intentions of attackers, offering understanding into what and when they might intend to initiate an attack. Although both the AVOIDIT and cyber harm taxonomy use advanced classifiers to classify attacks, it is possible that the categories they use are too abstract, which can lead to a lack of effective differentiation of attack characteristics. The gap was leveraged by utilising the Asfalia framework to analyse the attack characteristics and behaviours. Identifying attack strategies that are likely to be put into action is highly important in the context of targeted security analysis. However, a limited understanding of the future attacks presents a significant barrier to the analysis and implementation process. Analysts cannot precisely determine the techniques that potential attackers might use to attack a system, leading to the presence of either incorrect indications of attacks or missed indications of attacksduring the security analysis.