AttackModels.com

The Attack Models Library

This library is a curated starting point. It prioritizes primary sources, widely used knowledge bases, and standards that organizations actually reference. Each item here is useful because it can be mapped into a model, a detection, a control, or a test plan.

Technique and Tactic Knowledge Bases

MITRE ATT&CK provides a shared vocabulary for adversary behavior. Its ICS matrix extends that vocabulary into industrial environments where the attacker is targeting controllers and processes.

• ATT&CK for ICS Matrix
• ATT&CK Data and Tools

Attack Patterns, Weaknesses, and Vulnerabilities

These three layers form a practical chain: patterns describe how attacks happen, weaknesses describe root causes, and vulnerabilities describe specific instances in products. A mature attack model uses all three.

• CAPEC: Common Attack Pattern Enumeration and Classification
• CWE: Common Weakness Enumeration
• CVE: Common Vulnerabilities and Exposures
• NVD: National Vulnerability Database
• CVSS v3.1 Specification

Representing and Sharing Models

If you want your models to power automation, you need machine readable formats. STIX is commonly used for expressing cyber threat and observable information, and TAXII is used for sharing it between systems.

• OASIS STIX 2.1
• OASIS CTI Resources (STIX and TAXII)

Attack Trees and Attack Graphs

For computed path analysis and design time reasoning, start with the classic references, then move into tooling and domain specific extensions.

• Attack Trees (Schneier, 1999)
• Attack Graph Generation (Sheyner, Jha, Wing, 2002)
• MulVAL (Ou et al., 2005)