## 2 Materials and Methods
### Theory of Threat Modeling
#### 2.4.2 Threat Model  
One of the essential parts of threat modeling is building an up-to-date threat database that consists of a wide range of cyber threats based on the state-of-the-art. This database supports the risk analysis process to deeply investigate all possible threats that could be initiated from one or multiple existing security vulnerabilities in the system model. The threat database holds the threat model which contains known flaws, vulnerabilities, and weaknesses to be used for analysis in order to detect threats inside the system model. Potential dangers can be found by automatically comparing the threat model with the system model [3]. Using a database for storage and a rule-based technique for anti-pattern representation, a suitable threat model can be defined. Anti-patterns are used to mimic common configuration problems and are described by domain experts with a domain-specific language (DSL). The phrase anti-pattern refers to a pattern that should not be present in the system. They reflect well-known setup concerns, such as communication over trust boundaries, a lack of encryption while using wireless connection, or a missing of tamper protection in case of physical attacks.  
In our study, we built a comprehensive threat database for IoT and CPS application domains based on the IEC 62443 security standard. The newly developed database consists of many potential threats inspired by the standard to give a complete image of the present and future security issues. This database mainly focuses on parts 3-3 (i.e., system requirements) and 4-2 (i.e., component requirements). Figure 3 illustrate the number of developed threats according to the coverage of these two parts (i.e., system requirements--part 3-3 and component requirements-part 4-2) of the standard.  
According to our estimations, we addressed over 90% of the security requirements that could be used to define a set of potential threats from the IEC 62443-3-3 standard, as illustrate in Figure 3a. In addition, about 88% of the security requirements in IEC 62443-4-2 are utilized to identify a set of potential threats that may be encountered, as depicted in Figure 3b.  
Figure 3: Threat coverage of developed threat database according to the IEC 62443 security standard. (**a**) The coverage of threat database according to IEC 62443 part 3-3 (i.e., system requirements). (**b**) The coverage of threat database according to IEC 62443 part 4-2 (i.e., component requirements).  
The threat modeling approach can be summarized in five main steps [3]. Figure 4 illustrates these steps in terms of how the threat modeling approach includes designing the whole system with all security-related information until all potential threats are addressed.  
The diagram shows that the process of threat modeling begins with building the entire system model, including all of the relevant security information that must be integrated into the design of the system. After that, the next step is to perform a threat analysis in order to determine the possible threats that already exist and how they can exploit any security vulnerabilities that may be present. In order to provide clear knowledge of the best risk treatment plan for addressing identified threats, it is essential to evaluate every threat that has been identified. In addition, all of the identified threats can be mitigated by keeping the system model up to date with appropriate security measures. Consequently, the threat analysis (i.e., step 2) shall be performed to examine the effectiveness of the previously applied security measures and determine new potential risks could be propagated due to the newly updated measures or if any existing ones need more security concerns.