Relational Framework of Cyberattacks: Empirical Evidence from Multistage Incidents

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Current static cyberattack taxonomies struggle with complex, multistage threats.
• There is a need for more dynamic and flexible classification models for cyber threats.

Purpose of the Study:

• To propose a relational taxonomy of cyberattacks based on documented incidents.
• To encode direct transitions between eight cyberattack groups using a dependency matrix and directed graph.
• To ensure traceability to the MITRE ATT&CK framework.

Main Methods:

• Developed a relational taxonomy grounded in documented cyberattack incidents.
• Utilized a dependency matrix and directed graph to represent transitions between eight attack groups.
• Validated the taxonomy with an independent expert panel assessing clarity and utility.

Main Results:

• Identified consistent transition patterns and reproducible escalation routes across cyberattack groups.
• Pinpointed critical intervention points linked to specific detection and control activities.
• Provided an operational map for cyberattack progression and intervention strategies.

Conclusions:

• The relational taxonomy clarifies cyberattack escalation paths and interdependencies.
• It strengthens alignment between security monitoring, incident response, and threat intelligence.
• Offers an operational structure for anticipating escalation and focusing on critical monitoring points.