Comparing models of offensive cyber operations

Abstract

The purpose of this paper is to find, formalise, and compare models of the offensive cyber operations process available in the open scientific literature. Seven models were sufficiently well described for formalisation using Structured Analysis and Design Technique (SADT) notation. Finally, a canonical model has been constructed by rational reconstruction. Although the model has not yet been tested, it has been reviewed by subject matter experts. The paper describes the search methodology, the SADT analysis, the shortcomings of each model, rational reconstruction, and the canonical model. Further work will include elaborating the canonical model to identify the resources needed to set up a Cyber Security Operations Centre with offensive capabilities and to cross-compare the model with the literature on attack ontologies.