Design of Threat Response Modeling Language for Attacker Profile Based on Probability Distribution

Threat modeling and simulation (TMS) was aimed at dynamically capturing the features of attacks, which is a challenging job in complex Industrial Internet Things (IIoT) control systems due to complicated relationships among attacks. Recently, Meta Attack Language (MAL) showed its powerful TMS capabilities for representing However, existing methods pay less attention impact changes threat profiles on key attack techniques. This paper proposes novel method called response language (TRMLang) IIoT TRMLang obtains attacker information through an automated analysis cyber intelligence (CTI) build dynamic profiles. Furthermore, it merges probabilistic graphs improve performance. The experimental results demonstrate that can represent evaluate security conditions with two cases by Lazarus Group SEGRID smart grids.