Attack Patterns Research Articles

Application of GIS Criminalistics Techniques in the Analysis of Urban Terrorism

A common myth about terrorist attacks is that they are random incidents that can occur anywhere in the world. While it is true that such attacks can happen globally, they usually exhibit discernible spatiotemporal patterns that could be analysed using criminalistics techniques, methods, and analytic tools. Numerous studies have shown that analysing the spatial and temporal patterns of terrorist attacks can uncover the modus operandi of terrorist organisations and shed light on their strategic objectives. By identifying the operational methods of specific terrorist groups, it becomes theoretically possible to create models that predict the spatiotemporal dispersion of their movements and actions. Such models can potentially indicate sites of future attacks, including bombings, arsons, assassinations, hijackings, abductions, sabotage, kidnappings, and more.The paper aims to examine and provide a concise explanation of why the application of criminalistic techniques is possible in the prediction of distinct aspects of urban terrorism.

Development of algorithms for early detection of cyberattacks on networks using machine learning

Critical infrastructure protection and national security are enhanced by the security and reliability of networks. Various types of information circulate on these networks, ranging in classification from open to closed. The consequences of cyberattacks on these networks can be severe, including reputational damage, financial loss, operational disruption and data leakage. Traditional security methods, such as firewalls and anti-virus software, are becoming less effective against modern and ever-changing cyber threats. As a result, powerful network intrusion detection systems (IDS) have become indispensable for proactive detection and mitigation of cyber attacks. Machine learning has become a viable method for creating adaptive intrusion detection tools that can detect new and complex attack patterns. By learning from huge labelled network traffic datasets, ML models can understand the subtle patterns and differentiating features of normal and abnormal or malicious traffic flows. This allows them to detect possible cyber threats and intrusions that traditional signature-based IDSs cannot detect. Extracting discriminative features and training appropriate classification models from such data is a challenging task. In the presented study, we analyse the effectiveness of ML algorithms for detecting cyberattacks, in particular distributed denial of service (DDoS) attacks, in network traffic data. In the presented study, a network attack detection system is developed using ML and deep learning (DL) models and experimented on the CICIDS2017 dataset. The main objectives of the study are to develop a strategy for extracting valuable information from raw network streams; to study the impact of data preparation on the false positive rate; and to conduct a comparative analysis of ML models for cyberattack detection. The main goal of the study is to provide an understanding of the development of a reliable adaptive network intrusion detection system using ML approaches that increase cybersecurity capabilities and protect against future cyberattacks.

CAPEC ontology generator

CAPEC is an effort coordinated by MITRE Corporation. Its aim is attack pattern database structured in taxonomies. CAPEC is available as XML document from its project site. CAPEC structure and content are under permanent change and development. It is still not mature database but may be never will.CAPEC, CWE, and CVE are databases devoted to attacks, weaknesses, and vulnerabilities. They refer each other forming a knowledge ecosystem in cybersecurity area.Traditional approach for knowledge presentation as information does not work well with conceptualizations under dynamics of this ecosystem and particularly of CAPEC. In this paper, an alternative approach to CAPEC knowledge presentation is proposed, as ontology. First, CAPEC structure and content are discussed and then ontology structure is introduced. CAPEC as ontology opens doors to ``open world'' concept that is more adequate to ecosystem dynamics.CAPEC ontology is programmatically generated from CAPEC database.CAPEC ontology generator in implemented in Python.

Analysis of Internet of Things to Enhance Security Using Artificial Intelligence based Algorithm

Exploring creative methods to secure IoT networks is vital due to the enormous security concerns created by the rapid proliferation of the Internet of Things (IoT). To increase the security of the IoT, this study examines the use of artificial intelligence (AI), specifically deep learning (DL) as well as machine learning (ML) techniques. Three state-of-the-art DL algorithms—Long Short-Term Memory (LSTM), Deep Belief Networks (DBN), Convolutional Neural Networks (CNN)—along with three ML methods—CatBoost, LightGBM, and XGBoost—are examined. These algorithms are renowned for their capability to handle big, as well as unbalanced datasets. This work test how well each algorithm can identify anomalies, categorize attacks, and forecast vulnerabilities using an IoT security dataset, such as CICIDS 2017 as well as IoT-23. The research evaluates algorithms by comparing their accuracy and training time. Classification tasks are where CatBoost and LightGBM really good, but when it comes to sequential data and complicated attack patterns, DL algorithms like CNN and LSTM are good. To provide the groundwork for creating AI-driven security solutions optimised for IoT systems, this research sheds light on the benefits and drawbacks of each method.

SDN-Driven Security Framework for DDOS Attack Detection and Mitigation

The rising complexity and persistence of Distributed Denial of Service (DDoS) attacks, particularly low-rate variants, present significant challenges in detection and mitigation within Software-Defined Networking (SDN) environments. Existing detection systems often flood networks with alerts, burdening security personnel and delaying timely mitigation. Furthermore, many solutions are designed and tested in simulated conditions, limiting their real-world applicability. To address these challenges, we propose an SDN-based security framework enhanced with automated monitoring, detection, and mitigation capabilities, optimized for slow-rate DDoS attacks. Our framework was rigorously evaluated on a physical testbed, achieving mitigation efficiencies between 91.66% and 100% under varied attack conditions, thus proving its robustness in practical settings. Additionally, we introduce the SDN-SlowRate-DDoS dataset, designed to assist researchers and industry professionals in developing and testing intrusion detection solutions in more realistic scenarios. To further improve DDoS defense in SDN, we incorporate an ensemble online machine learning model that dynamically adapts to evolving attack patterns, enhancing accuracy across attack types and outperforming traditional models with a detection rate of 99.2% on benchmark datasets. This dual approach leverages both real-world testing and adaptive machine learning, advancing proactive DDoS threat management in SDN environments

Advanced deep learning framework for detecting SQL injection attacks based on GRU Model

SQL injection attacks are a major danger to data security in application systems, leveraging weaknesses to illicitly access and change sensitive data. Traditional detection methods, such rule-based systems and supervised machine learning, struggle to adapt to new SQL injection attack strategies. This study presents an Enhanced Deep Learning Framework for SQL Injection Detection utilizing the Gated Recurrent Unit (GRU) model to overcome constraints. To discover new attack patterns, the proposed framework uses a dynamic learning process instead of static detection methods. By examining SQL query sequences, the model can distinguish between legal and malicious interactions without predefined rules or reinforcement learning. The framework's performance is assessed using a broad dataset of valid and malicious SQL queries. Experiments show a considerable increase in detection accuracy, reaching 96.65% with little false positives. The proposed system is resilient and adaptable to address the complexity of modern SQL injection threats. The results demonstrate the effectiveness of deep learning, particularly the GRU model, in detecting SQL injection attacks. This research enhances database security and lays the groundwork for future cyber-security methods in web-based applications.

Activation of PAA at the Fe-Nx Sites by Boron Nitride Quantum Dots Enhanced Charge Transfer Generates High-Valent Metal-Oxo Species for Antibiotics Degradation.

Advanced oxidation processes (AOPs) based on peracetic acid (PAA) offer a promising strategy to address antibiotic wastewater pollution. In this study, Fe-doped graphitic carbon nitride (g-C3N4) nanomaterials were used to construct Fe-Nx sites, and the electronic structure was tuned by boron nitride quantum dots (BNQDs), thereby optimizing PAA activation for the degradation of antibiotics. The BNQDs-modified Fe-doped g-C3N4 catalyst (BNQDs-FCN) achieved an excellent reaction rate constant of 0.0843 min-1, marking a 21.6-fold improvement over the carbon nitride (CN)-based PAA system. DFT calculations further corroborate the superior adsorption capacity of the Fe-Nx sites for PAA, facilitating its activation. Charge transfer mechanisms, with PAA serving as an electron acceptor, were identified as the source of high-valent iron-oxo species. Moreover, the BNQDs-FCN system preferentially targets oxygen-containing functional groups in antibiotic structures, elucidating the selective attack patterns of these highly electrophilic species. This research not only elucidates the pivotal role of high-valent iron-oxo species in pollutant degradation within the PAA-AOPs framework but also pioneers a wastewater treatment system characterized by excellent degradation efficiency coupled with low ecological risk, thereby laying the groundwork for applications in wastewater management and beyond.

An optimized ensemble model with advanced feature selection for network intrusion detection.

In today's digital era, advancements in technology have led to unparalleled levels of connectivity, but have also brought forth a new wave of cyber threats. Network Intrusion Detection Systems (NIDS) are crucial for ensuring the security and integrity of networked systems by identifying and mitigating unauthorized access and malicious activities. Traditional machine learning techniques have been extensively employed for this purpose due to their high accuracy and low false alarm rates. However, these methods often fall short in detecting sophisticated and evolving threats, particularly those involving subtle variations or mutations of known attack patterns. To address this challenge, our study presents the "Optimized Random Forest (Opt-Forest)," an innovative ensemble model that combines decision forest approaches with genetic algorithms (GAs) for enhanced intrusion detection. The genetic algorithms based decision forest construction offers notable benefits by traversing a wider exploration space and mitigating the risk of becoming stuck in local optima, resulting in the discovery of more accurate and compact decision trees. Leveraging advanced feature selection techniques, including Best-First Search, Particle Swarm Optimization (PSO), Evolutionary Search, and Genetic Search (GS), along with contemporary dataset, this research aims to enhance the adaptability and resilience of NIDS against modern cyber threats. We conducted a comprehensive evaluation of the proposed approach against several well-known machine learning models, including AdaBoostM1 (AbM1), K-nearest neighbor (KNN), J48-Decision Tree (J48), multilayer perceptron (MLP), stochastic gradient descent (SGD), naïve Bayes (NB), and logistic model tree (LMT). The comparative analysis demonstrates the effectiveness and superiority of our method across various performance metrics, highlighting its potential to significantly enhance the capabilities of network intrusion detection systems.

Assessing of software security reliability: Dimensional security assurance techniques

Security plays a crucial role in ensuring the reliability of software systems, making a secure and dependable security framework vital for safeguarding software integrity. However, evaluating the dynamic and multifaceted aspects of security presents significant challenges, as various security metrics and factors complicate the assessment of reliability. This study advances the core concepts of software security through the application of security assurance techniques, including vulnerability scanning, code review, penetration testing, threat assessment, control evaluation, mitigation, risk assessment, and configuration review. In the context of the Software Security Reliability Model (SSRM), a framework was developed to enhance software security assurance across different stages. A comprehensive systematic literature review was conducted to identify security challenges, and the STRIDE and DREAD methodologies were applied to model security threats effectively. Additionally, a mathematical CVSS scoring method was utilized for risk assessment. The synthesis of diverse security methods, tools, attack patterns, and systems was analyzed, identifying 15 critical software security terms: authentication, authorization, encryption, access control, network security, application security, data security, incident response, compliance, threat intelligence, privacy protection, third-party risk, cloud security, endpoint security, and identity management. The findings highlight these terms as key contributors to improving software security reliability.

Corrosion attack in existing reinforced concrete structures: in-field investigation and analysis of naturally corroded bars

Corrosion of steel bars is a major issue for the management of existing reinforced concrete structures, since affecting many ageing structures and infrastructures and introducing risk for safety and reliability, as well as high maintenance costs. Intervention strategies should be planned and carried out according to the effective state of deterioration and to the expected evolution of performances over time. The critical parameters needed to evaluate these performances are the intensity and pattern of the corrosion attack, referring to both extension and depth of the attack. However, this information is rarely available and hard to predict when dealing with real structures. This paper presents a field investigation on existing corroded structures characterized by different environmental conditions. Corroded bars were removed from structural elements, the corrosion patterns were studied, and then the bars were tested to determine their mechanical properties. The objective of this study is to increase the knowledge of the effects of corrosion in natural environments and to propose a method to relate easy-measurable environmental conditions with the characteristics of the expected corrosion attack, which need to be further validated.

UsfAD based effective unknown attack detection focused IDS framework

The rapid expansion of varied network systems, including the Internet of Things (IoT) and the Industrial Internet of Things (IIoT), has led to an increasing range of cyber threats. Ensuring robust protection against these threats necessitates the implementation of an effective Intrusion Detection System (IDS). For more than a decade, researchers have delved into supervised machine learning techniques to develop IDS to classify normal and attack traffic. However, building effective IDS models using supervised learning requires a substantial number of benign and attack samples. To collect a sufficient number of attack samples from real-life scenarios is not possible since cyber attacks occur occasionally. Further, IDS trained and tested on known datasets fails in detecting zero-day or unknown attacks due to the swift evolution of attack patterns. To address this challenge, we put forth two strategies for semi-supervised learning-based IDS where training samples of attacks are not required: (1) training a supervised machine learning model using randomly and uniformly dispersed synthetic attack samples; (2) building a One Class Classification (OCC) model that is trained exclusively on benign network traffic. We have implemented both approaches and compared their performances using 10 recent benchmark IDS datasets. Our findings demonstrate that the OCC model based on the state-of-art anomaly detection technique called usfAD significantly outperforms conventional supervised classification and other OCC-based techniques when trained and tested considering real-life scenarios, particularly to detect previously unseen attacks.

The Rise of AI-powered Cybercrime: a Data-driven Analysis of Emerging Threats

The integration of artificial intelligence (AI) in cybercrime represents a transformative shift in the global threat landscape, introducing unprecedented challenges to cybersecurity frameworks. This comprehensive article examines the dramatic 238% surge in AI-powered cyber attacks during 2023, resulting in global damages exceeding $8.5 billion. Through analysis of 100,000 malware samples, 50,000 documented incidents, and 2,500 attack patterns across Fortune 500 companies, this study quantifies the impact of AI integration in cyber attacks. Key findings reveal that AI-enhanced attacks achieve a 67% higher success rate while reducing operational complexity by 72%. The article demonstrates concerning trends across four critical domains: automated attacks, AI-enhanced phishing (showing an evolution from 2.9% to 8.7% success rate), malware evolution, and deepfake-based fraud. The article also presents actionable mitigation strategies, including AI-based security solutions that demonstrate a 97.8% improvement in response efficiency, reducing incident response times from 6 hours to 8 minutes. This article provides a framework for organizations to strengthen their security posture against emerging AI-powered threats through systematic implementation of advanced defense mechanisms and strategic investment in AI-enhanced security solutions.

A dual-tier adaptive one-class classification IDS for emerging cyberthreats

In today’s digital age, our dependence on IoT (Internet of Things) and IIoT (Industrial IoT) systems has grown immensely, which facilitates sensitive activities such as banking transactions and personal, enterprise data, and legal document exchanges. Cyberattackers consistently exploit weak security measures and tools. The Network Intrusion Detection System (IDS) acts as a primary tool against such cyber threats. However, machine learning-based IDSs, when trained on specific attack patterns, often misclassify new emerging cyberattacks. Further, the limited availability of attack instances for training a supervised learner and the ever-evolving nature of cyber threats further complicate the matter. This emphasizes the need for an adaptable IDS framework capable of recognizing and learning from unfamiliar/unseen attacks over time. In this research, we propose a one-class classification-driven IDS system structured on two tiers. The first tier distinguishes between normal activities and attacks/threats, while the second tier determines if the detected attack is known or unknown. Within this second tier, we also embed a multi-classification mechanism coupled with a clustering algorithm. This model not only identifies unseen attacks but also uses them for retraining them by clustering unseen attacks. This enables our model to be future-proofed, capable of evolving with emerging threat patterns. Leveraging one-class classifiers (OCC) at the first level, our approach bypasses the need for attack samples, addressing data imbalance and zero-day attack concerns and OCC at the second level can effectively separate unknown attacks from the known attacks. Our methodology and evaluations indicate that the presented framework exhibits promising potential for real-world deployments.

Research on adversarial attack and defense of large language models

Abstract. Large language models (LLMs) have made excellent progress in text and image understanding and generation. However, with the wide range of applications of these models in various industries, the issue of their security, especially the defense against adversarial attacks, has become a focus of research. This study focuses on exploring the adversarial attacks faced by LLMs and their defense strategies, especially the design and optimization of defense mechanisms. Through literature review and case studies, this paper analyzes in detail the white-box and black-box attack patterns against LLMs, including model inversion, backdoor attacks, and token-based strategies. In response to these attacks, this paper proposes a series of defense strategies, including preventive measures such as data augmentation, adversarial training and model regularization, as well as real-time attack detection and response strategies such as anomaly detection and adversarial sample detection techniques. The core of this research is to improve the robustness and trustworthiness of LLMs, providing the necessary guarantees for their integration and sustainability in multiple industrial applications. In addition, this paper proposes future research directions, highlighting the importance of developing advanced defense systems, promoting interdisciplinary research and exploring new applications for LLMs. This research provides valuable insights into understanding and improving the security defense mechanisms of LLMs, which is essential for maintaining the security and user trust of these models.

Watch Out for the Inherent Vulnerabilities in Developing Multi-tenant Cloud-FPGA: Communication Protocols

As FPGAs are being deployed in the cloud infrastructure for acceleration, the technology of multi-tenant FPGA has emerged as a topic of interest. This development has drawn considerable attention to its security issues. While previous research primarily focused on the security of applications, there has been limited exploration of the vulnerabilities inherent in FPGA IPs. In our work, we examine the vulnerabilities of two widely used data transmission protocols in modern FPGAs: the Advanced eXtensible Interface (AXI) and Peripheral Component Interconnect Express (PCIe). Our experiments, conducted with commercial FPGA development kits, launched fault injection attacks through the shared power distribution network (PDN). Through non-invasive electromagnetic (EM) trace measurement, we characterize the voltage fluctuation across various attack patterns. Subsequently, we simulate real-world data transfers using two crafted datasets with different statistical characteristics. The experimental results demonstrate the unique security vulnerabilities of the current AXI and PCIe protocols in the context of a multi-tenant cloud-FPGA. In response to such vulnerability, we further propose two defense strategies: InChAXI that utilizes integrity checking for AXI-based data, and FCPCIe that employs frequency scaling for PCIe-based data. The performance evaluation demonstrates that our proposed defenses can significantly reduce the fault injections on the AXI-based data transmission by 705 times with small overheads – 0.5% in hardware footprint and 7.9% in latency, respectively. On the other hand, FCPCIe effectively prevents the fault injection attack during the PCIe-based data transmission by reducing the user clock frequency, while incurring a 10.13% overhead on data throughput.

Detecting and Analyzing Network Attacks: A Time-Series Analysis Using the Kitsune Dataset

Network security is a critical concern in today’s digital world, requiring efficient methods for the automatic detection and analysis of cyber attacks. This study uses the Kitsune Network Attack Dataset to explore network traffic behavior for IoT devices under various attack scenarios, including ARP MitM, SYN DoS, and Mirai Botnet. Utilizing Python-based data analysis tools, we preprocess and analyze millions of network packets to uncover patterns indicative of malicious activities. The study employs packet-level time-series analysis to visualize traffic patterns and detect anomalies specific to each attack type. Key findings include high packet volumes in attacks such as SSDP Flood and Mirai Botnet, with the Mirai Botnet attack involving multiple IP addresses and lasting over 2 hours. Notable attack-specific behaviors include high traffic on port -1 and targeted traffic on specific ports like 53195. The SYN DoS and Mirai Botnet attacks are characterized by their prolonged durations, suggesting significant disruption. Overall, the study highlights distinctive attack patterns and underscores the importance of understanding these characteristics to enhance detection and response mechanisms.

A dynamic provenance graph-based detector for advanced persistent threats

Advanced Persistent Threats (APTs) pose a major cyber threat due to their stealthy, long-term nature and intricate complexity, making them particularly challenging to detect. Provenance graphs map interactions between system entities as directed, heterogeneous networks, offering rich semantic information valuable for threat identification. However, most existing approaches rely on static graph analysis, overlooking the critical dynamics of evolving threats. Dynamic graph analysis offers the potential to capture both temporal and structural insights, but current methods focus on single-perspective learning, failing to fully exploit the inherent relationships and evolving patterns within the data. To address this gap, we propose CGL-AD, a Contextualized Graph Learning APT Detector. CGL-AD leverages temporal graph learning to capture subtle temporal changes and overall structural transformations over time. It then integrates hash-based data stream frequency estimation techniques to identify local topological alterations, subsequently feeding these rich embeddings into a powerful sequence learning model. Experimental results on three widely used datasets: Streamspot, Camflow-apt and Shellshock datasets demonstrate that CGL-AD significantly outperforms existing methods. Specifically, CGL-AD outperforms the best baseline FLASH on these datasets by 1.5%, 3.7%, and 5.6% respectively in terms of Receiver Operating Characteristic -Area Under the Curve (ROC-AUC), effectively revealing hidden APT attack patterns in dynamic provenance graphs.

БЕЗПЕЧНИЙ ДОСТУП ДО СЕРВЕРІВ ІНФОРМАЦІЙНИХ СИСТЕМ, ЗАБЕЗПЕЧЕНИЙ ML-МОДЕЛЛЮ ДЛЯ БЛОКУВАННЯ ШКІДЛИВИХ ЗАПИТІВ

The article presents a detailed exploration of using the k-Nearest Neighbors (KNN) algorithm to classify and identify various types of cyberattacks, particularly SQL Injection (SQLi) attacks, within SCADA (Supervisory Control and Data Acquisition) systems. This work addresses the need to enhance server infrastructure security in SCADA systems by mitigating the risks posed by harmful requests, such as SQL injections. SCADA systems are crucial in managing industrial processes, making their servers prime cyberattack targets. Attackers often exploit vulnerabilities in server applications by injecting malicious requests through input fields or URLs, potentially gaining access to sensitive data or disrupting system operations. To address this issue, the study proposes a machine learning-based approach using the k-nearest neighbors (KNN) algorithm to detect and block harmful SQL requests. The KNN algorithm is employed to classify and identify different types of cyberattacks by comparing new attack attempts with previously observed attack patterns. By analyzing specific attributes related to each attack, the KNN method evaluates the level of threat based on proximity metrics. The proposed approach helps classify SQL injection attempts, which involve manipulating SQL code to bypass authentication or extract unauthorized data. The study demonstrates how KNN can effectively distinguish harmful SQL requests from benign ones by calculating the Euclidean distance between the new attack and historical cases. Furthermore, the article emphasizes the importance of implementing rapid and accurate detection methods for protecting server infrastructure in industrial environments. The KNN algorithm, in this context, offers a flexible and efficient solution as it adapts to various attack scenarios, improving the overall resilience of SCADA systems to cyber threats. The study’s findings contribute to the ongoing efforts in cybersecurity, focusing on integrating machine learning models to strengthen the protection of critical assets in industrial control systems. This work aims to develop protection tools for server-based industrial control systems used in SCADA systems against dangerous requests based on SQL injections, using an ML-trained model for blocking harmful requests through the k-nearest neighbors method.

Uncovering Multi-step Attacks with Threat Knowledge Graph Reasoning

The rapid advancement of information technologies has significantly intensified the focus on cyberspace security across various sectors. In this evolving landscape, attackers deploy many of techniques- including exploits, weakness identification, and complex multi-step attacks- to gain unauthorized access to systems. Conversely, defenders harness insights from a variety of sources to pinpoint potential threats. Prominent public cybersecurity databases such as the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK), Common Attack Pattern Enumeration and Classification (CAPEC), Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), and Common Platform Enumeration (CPE) provide extensive data on security entities and their interrelations, playing a pivotal role in enriching the understanding of cybersecurity challenges and assisting in comprehensive defensive analyses. However, the semantic cross-analysis of these databases, crucial for identifying obscure threat patterns, remains underexploited. In this study, we amalgamate data from these disparate sources into a cohesive threat knowledge graph and introduce a novel knowledge representation learning approach, A4CKGE (ATT&CK-CAPEC-CWE-CVE-CPE Knowledge Graph Embedding). This method utilizes advanced structural and textual analytics to predict interactions among security entities such as products, vulnerabilities, weaknesses, and multi-step attack sequences, employing complex attack templates generated through a Large Language Model (LLM). Our extensive experiments demonstrate that this approach significantly outperforms existing state-of-the-art methods in effectively predicting these relationships. The findings validate the efficacy of our threat knowledge graph in unveiling hidden connections, thereby highlighting its potential to strengthen cybersecurity defenses substantially.

A METHOD OF VULNERABILITY ANALYSIS IN WIRELESS INTERNET OF THINGS NETWORKS FOR SMART CITY INFRASTRUCTURES

The article proposes an approach to information security vulnerability analysis and threat modeling in wireless Internet of Things networks for Smart City infrastructures. Currently, such infrastructures are becoming increasingly widespread in a variety of Smart City application areas, including industrial life support systems, pipelines, communication networks, and transportation systems. The wide coverage of end users, the critical nature of such infrastructures and the value of their inherent assets determine the increasing importance of solving problems of determining the security level of such infrastructures and the timely application of protective measures. The ultimate goal of the proposed approach is to assess the security of the infrastructure. This article analyses articles at the intersection of the subject area of vulnerability and attack analysis in information systems and networks and the area of Smart City infrastructure issues. The proposed approach includes the use of an analytical model of an intruder which, together with the analysis of the specification of a specific Smart City infrastructure, allows us to determine the current types of attacks. In order to obtain infrastructure security assessments, the CAPEC database of wireless network vulnerabilities and attack patterns is analysed. In this case, the main attributes of the attacks are identified, unified and transformed into a single format using the numerical values of the considered attributes. The feasibility of the proposed approach is also analysed and its main advantages and disadvantages are considered. In addition, the main areas of further activity and tasks related to testing and improving the proposed approach in practice are identified.