{ "model": { "rank": 10496, "code": "thing-q4071928", "model_id": "vr.tr.cyberattack", "name": "cyberattack", "purpose": "Let an agent explain cyberattacks and their categories at a conceptual level, support defence, detection and incident response, describe legal and reporting frameworks, and decline operational attack detail.", "family": "Thing Registry", "category": "Activities and processes", "status": "research-draft", "kind": "thing", "plane": "ACT", "domain": "ACT.ACT", "industry": "", "version": "", "url": "/models/thing/q4071928/", "tier": 2, "score": 44, "payload": { "layer": "wikidata", "aliases": [ "exploit", "zero-click attack", "account pre-hijacking", "DNS hijacking", "null dereferencing", "prompt injection", "return-to-libc attack", "cross-site request forgery", "XML external entity attack", "privilege escalation", "BadUSB", "return-oriented programming", "credential stuffing", "video game exploit", "browser exploit", "DMA attack", "server-side request forgery", "session hijacking", "killer poke", "HTTP request smuggling", "Jailbreak", "PlayStation Jailbreak", "SIM lock disabling", "confused deputy problem", "Zoombombing", "supply chain attack", "cache poisoning", "replay attack", "dusting attack", "OT attack", "ransomware attack", "spoofing attack", "fabrication attack", "eclipse attack", "AI training data poisoning", "cyber-physical attack", "2024 U.S. internet service provider hack", "hijacking", "AI-driven cyber attack", "man-on-the-side attack" ], "aliasCount": 71, "merged": 71, "knownIn": 44, "facets": null, "markers": [], "lexicalClass": "", "senseRank": null, "alsoRegisteredAs": null, "source": { "dataset": "wikidata", "item": "Q4071928", "url": "https://www.wikidata.org/wiki/Q4071928", "license": "CC0 1.0" } }, "research": { "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-12T00:43:31Z", "providers": [ "Claude" ], "breadth": "written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify", "pass": 2, "wave": 2, "engine": "claude" }, "metaModel": { "id": "THING-Q4071928", "registryId": "vr.tr.cyberattack", "name": "cyberattack", "version": "0.2.0-wave.2", "entryKind": "thing", "family": "Thing Registry", "domain": [ "ACT.ACT" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q4071928/", "model": { "registry_id": "vr.tr.cyberattack", "name": "cyberattack", "purpose": "Let an agent explain cyberattacks and their categories at a conceptual level, support defence, detection and incident response, describe legal and reporting frameworks, and decline operational attack detail.", "definition": "A deliberate attempt to compromise the confidentiality, integrity or availability of computer systems, networks or data, through techniques such as malware, phishing, exploitation of vulnerabilities, denial of service, credential and account attacks, DNS hijacking, and attacks on AI systems such as prompt injection; cyberattacks are studied in cybersecurity, classified in adversary technique frameworks, addressed by defences and incident response, and are criminal in most jurisdictions, and this entry is framed defensively without operational detail.", "what_it_is_for": "Deliberate attacks on computer systems.", "affordances": [ "explain categories conceptually", "support defence and response", "describe legal frameworks", "decline operational detail" ], "distinguishing_features": [ "Malicious intent", "Technique categories", "Defended and responded to", "Criminalised" ], "appearance": "Not physical; malicious activity in systems and networks.", "visual_identification": [ "Deliberate compromise of systems or data", "Many techniques", "Accidental outages and bugs are not attacks" ], "physical_properties": [], "families_and_kinds": [ "malware and ransomware attacks", "phishing and social engineering", "vulnerability exploitation and zero-click attacks", "denial of service and infrastructure attacks", "attacks on AI systems such as prompt injection" ], "related_models": [ { "relation": "is a kind of", "target": "attack", "why": "category" }, { "relation": "is a kind of", "target": "cyber incident", "why": "category" }, { "relation": "is related to", "target": "software bug", "why": "vulnerabilities exploited" }, { "relation": "is related to", "target": "incident", "why": "incident response" } ], "identifiers": [], "standards_and_regulation": [ "Cybercrime laws and international conventions", "Security standards and incident reporting rules", "Adversary technique frameworks for defenders" ], "failure_modes_and_hazards": [ "Providing attack instructions", "Data breaches and service loss", "Misattribution of attacks" ], "in_scope": [], "out_of_scope": [], "characteristics": [] }, "sources": [], "structure": { "bundles": [ { "id": "understand", "name": "Understand", "description": "What cyberattacks are.", "rationale": "Concepts.", "layers": [ { "id": "categories", "name": "Categories", "description": "Categories of attack.", "findings": [ { "id": "categories-finding", "name": "Categories", "description": "Categories.", "questions": [ { "text": "What are the main categories of cyberattack, and how do frameworks classify adversary techniques for defenders?", "kind": "provenance" }, { "text": "Is the request seeking operational attack detail, which must be declined?", "kind": "boundary" } ] } ] }, { "id": "ai", "name": "AI", "description": "Attacks on AI systems.", "findings": [ { "id": "ai-finding", "name": "AI", "description": "AI systems.", "questions": [ { "text": "What are prompt injection and other attacks on AI systems, and how are they mitigated, according to security researchers?", "kind": "provenance" }, { "text": "Which entry fits AI security?", "kind": "action" } ] } ] } ] }, { "id": "defend", "name": "Defend", "description": "Defence and response.", "rationale": "Practice.", "layers": [ { "id": "defence", "name": "Defence", "description": "Defensive measures.", "findings": [ { "id": "defence-finding", "name": "Defence", "description": "Defence.", "questions": [ { "text": "How can organisations and individuals reduce risk through patching, authentication, backups, training and monitoring?", "kind": "provenance" }, { "text": "Which entry fits a specific control?", "kind": "action" } ] } ] }, { "id": "response", "name": "Response", "description": "Incident response.", "findings": [ { "id": "response-finding", "name": "Response", "description": "Response.", "questions": [ { "text": "What should be done during and after a suspected attack, and who should be notified?", "kind": "provenance" }, { "text": "Is an attack in progress now, requiring incident response and authorities?", "kind": "boundary" } ] } ] } ] }, { "id": "law", "name": "Law", "description": "Law and reporting.", "rationale": "Law.", "layers": [ { "id": "legal", "name": "Legal", "description": "Legal frameworks.", "findings": [ { "id": "legal-finding", "name": "Legal", "description": "Legal.", "questions": [ { "text": "How are cyberattacks criminalised and reported here, and which authorities investigate?", "kind": "provenance" }, { "text": "Which entry fits cybercrime law?", "kind": "action" } ] } ] }, { "id": "attribution", "name": "Attribution", "description": "Attribution and geopolitics.", "findings": [ { "id": "attribution-finding", "name": "Attribution", "description": "Attribution.", "questions": [ { "text": "How are attacks attributed to actors, and how should contested attributions be presented?", "kind": "boundary" }, { "text": "Is the presentation neutral?", "kind": "boundary" } ] } ] } ] }, { "id": "learn", "name": "Learn", "description": "History and teaching.", "rationale": "Education.", "layers": [ { "id": "history", "name": "History", "description": "Notable attacks.", "findings": [ { "id": "history-finding", "name": "History", "description": "History.", "questions": [ { "text": "Which cyberattacks are historically notable, and what lessons do security bodies draw?", "kind": "provenance" }, { "text": "Which references are standard?", "kind": "provenance" } ] } ] }, { "id": "teach", "name": "Teach", "description": "Teaching.", "findings": [ { "id": "teach-finding", "name": "Teach", "description": "Teaching.", "questions": [ { "text": "How can cybersecurity awareness be taught defensively?", "kind": "action" }, { "text": "Which misconceptions arise?", "kind": "provenance" } ] } ] } ] } ] }, "openQuestions": [ "Should each attack category be a separate entry?", "How should security frameworks be linked?", "How should reporting channels be linked?" ], "statistics": { "bundles": 4, "layers": 8, "findings": 8, "questions": 16 } }, "draft": { "generator": "vr.draft.v3", "status": "draft-generated", "researched": false, "archetype": "abstract concept", "method": "Written from the archetype playbook - what this kind of thing needs beyond identity and provenance - and from the structure that recurred across 6,333 models already researched by two engines. Applied to this entry by rule. No source was read for this thing and no claim here is researched. This entry carries no facets of its own, so they were inferred from its domain - a guess about a whole domain applied to one thing.", "facetsInferred": true, "nextPass": "A researcher replaces this draft with a sourced specification. Treat every sentence below as a proposal to argue with.", "purpose": "Give an agent a durable, checkable way to recognise a cyberattack, record what state it is in, and decide what may be done with it.", "whatItIs": "Let an agent explain cyberattacks and their categories at a conceptual level, support defence, detection and incident response, describe legal and reporting frameworks, and decline operational attack detail.", "characteristics": { "substance": "activity", "origin": "conceptual", "agency": "inert" }, "whatYouCanDoWithIt": [ "observed and measured" ], "distinguishingFeatures": [ "Names folded into this entry, which a task may need to split apart again: exploit, zero-click attack, account pre-hijacking, DNS hijacking, null dereferencing, prompt injection, return-to-libc attack, cross-site request forgery, XML external entity attack, privilege escalation, BadUSB, return-oriented programming.", "71 finer distinctions are held as aliases rather than separate entries, because telling them apart needs a task that asks for it.", "Described in 44 Wikipedia languages, which is a measure of how widely the thing is known, not of how important it is." ], "openQuestionsForResearch": [ "Which of the bundles below does a real task actually need, and which are ceremony?", "What does this thing have that the facets do not capture at all?", "Which neighbouring kind is most often confused with a cyberattack, and on what evidence are they told apart?" ], "whatItIsMadeOf": "something that happens over time", "physicalCharacter": [ "Does nothing on its own; everything it does, something else did to it.", "These come from the domain this entry sits in rather than from the entry itself, so treat them as a first guess about the whole domain applied to one thing." ], "whatCanBeDoneWithIt": [ "observe it, measure it, record its state" ], "howItIsRecognised": [ "Nothing to see. What is recognised is an instance of it, and which instances count is exactly what is argued about." ], "relatedModels": [ { "relation": "covers", "note": "Finer kinds folded into this entry because telling them apart needs a task that asks for it. Each is a model waiting to be split out when one does.", "targets": [ "exploit", "zero-click attack", "account pre-hijacking", "DNS hijacking", "null dereferencing", "prompt injection", "return-to-libc attack", "cross-site request forgery", "XML external entity attack", "privilege escalation", "BadUSB", "return-oriented programming" ] } ], "standing": "Described in 44 Wikipedia languages, which measures how widely it is written about rather than how important or how common it is. 71 finer distinctions are held inside this entry as names rather than as separate models.", "structure": { "bundles": [ { "id": "identity-and-classification", "name": "Identity, naming and classification", "description": "How an agent tells one cyberattack from another, and a cyberattack from things that resemble it.", "rationale": "Recognition comes before every other claim. Without stable identity nothing else in the model can be trusted to be about the same thing twice.", "layers": [ { "id": "naming-and-identifiers", "name": "Names and identifiers", "description": "The names this thing goes by and the identifiers that survive translation and time.", "findings": [ { "id": "preferred-name-and-aliases", "name": "Preferred name, aliases and local names", "description": "Which name to use, which names mean the same thing, and which merely sound similar.", "questions": [ { "id": "preferred-name-and-aliases-q01", "text": "What identifies and describes the name of a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "preferred-name-and-aliases-q02", "text": "Who or what asserted this about the name of a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "preferred-name-and-aliases-q03", "text": "What may an agent decide or do once the name of a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] }, { "id": "stable-identifiers", "name": "Stable identifiers and external keys", "description": "Identifiers that keep pointing at this kind of thing across systems and languages.", "questions": [ { "id": "stable-identifiers-q01", "text": "What identifies and describes an identifier for a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "stable-identifiers-q02", "text": "Who or what asserted this about an identifier for a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "stable-identifiers-q03", "text": "What may an agent decide or do once an identifier for a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "classification-and-granularity", "name": "Classification and granularity", "description": "Where a cyberattack sits among kinds, and how finely a task needs to cut it.", "findings": [ { "id": "kind-and-parents", "name": "Kind, parents and neighbouring kinds", "description": "The classes this thing belongs to and the ones it is next to.", "questions": [ { "id": "kind-and-parents-q01", "text": "What identifies and describes the kind of a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "kind-and-parents-q02", "text": "Who or what asserted this about the kind of a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "kind-and-parents-q03", "text": "What may an agent decide or do once the kind of a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] }, { "id": "distinguishing-features", "name": "Distinguishing features", "description": "What separates a cyberattack from the things most often confused with it.", "questions": [ { "id": "distinguishing-features-q01", "text": "What identifies and describes what distinguishes a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "distinguishing-features-q02", "text": "Who or what asserted this about what distinguishes a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "distinguishing-features-q03", "text": "What may an agent decide or do once what distinguishes a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "state-and-lifecycle", "name": "State and lifecycle", "description": "The states a cyberattack passes through and the events that move it between them.", "rationale": "Most decisions about a thing depend on what state it is in now, which is a claim with a time on it, not a property.", "layers": [ { "id": "lifecycle-stages", "name": "Lifecycle stages", "description": "From coming into existence to ceasing to be one of these.", "findings": [ { "id": "stages-and-transitions", "name": "Stages and transitions", "description": "The stages worth naming and what moves a cyberattack between them.", "questions": [ { "id": "stages-and-transitions-q01", "text": "What identifies and describes the lifecycle of a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "stages-and-transitions-q02", "text": "Who or what asserted this about the lifecycle of a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "stages-and-transitions-q03", "text": "What may an agent decide or do once the lifecycle of a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "observations-and-status", "name": "Observations and current status", "description": "What is observed about a cyberattack, how often and by whom.", "findings": [ { "id": "observation-record", "name": "Observation record", "description": "How an observation of a cyberattack is recorded so that it can be superseded rather than overwritten.", "questions": [ { "id": "observation-record-q01", "text": "What identifies and describes an observation of a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "observation-record-q02", "text": "Who or what asserted this about an observation of a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "observation-record-q03", "text": "What may an agent decide or do once an observation of a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "process-and-outcome", "name": "Process, inputs and outcome", "description": "How a cyberattack proceeds, what it needs and what it leaves behind.", "rationale": "An activity is known by its steps and its results, and both have to be recordable while it is still running.", "layers": [ { "id": "steps-and-sequence", "name": "Steps and sequence", "description": "The steps of a cyberattack, their order and what may run in parallel.", "findings": [ { "id": "steps-and-preconditions", "name": "Steps, preconditions and completion", "description": "What has to be true before each step of a cyberattack and what marks it done.", "questions": [ { "id": "steps-and-preconditions-q01", "text": "What identifies and describes a step of a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "steps-and-preconditions-q02", "text": "Who or what asserted this about a step of a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "steps-and-preconditions-q03", "text": "What may an agent decide or do once a step of a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "inputs-and-results", "name": "Inputs, resources and results", "description": "What a cyberattack consumes and what it produces.", "findings": [ { "id": "inputs-and-outputs", "name": "Inputs, outputs and side effects", "description": "The resources a cyberattack takes and the results it leaves, wanted or not.", "questions": [ { "id": "inputs-and-outputs-q01", "text": "What identifies and describes the inputs and results of a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "inputs-and-outputs-q02", "text": "Who or what asserted this about the inputs and results of a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "inputs-and-outputs-q03", "text": "What may an agent decide or do once the inputs and results of a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "definitions-in-contest", "name": "Definitions and who holds them", "description": "What cyberattack is taken to mean, and by whom.", "rationale": "When a field disagrees about a concept, the disagreement is the content. A model that picks one definition silently destroys the information.", "layers": [ { "id": "competing-definitions", "name": "Competing definitions", "description": "The main readings and the traditions behind them.", "findings": [ { "id": "definition-map", "name": "Definitions and their holders", "description": "Each definition with the school or body that holds it.", "questions": [ { "id": "definition-map-q01", "text": "Which definitions of cyberattack are in use, and which tradition or body holds each?", "kind": "definition" }, { "id": "definition-map-q02", "text": "What turns on the difference between them in practice?", "kind": "boundary" } ] } ] }, { "id": "operationalisation", "name": "Operationalisation", "description": "How it is measured or applied when it has to be.", "findings": [ { "id": "operational-record", "name": "Measures and proxies", "description": "Instruments and indicators used to stand in for it.", "questions": [ { "id": "operational-record-q01", "text": "How is cyberattack operationalised or measured in practice, and by what instrument?", "kind": "measurement" }, { "id": "operational-record-q02", "text": "What does that operationalisation leave out, and when does that matter?", "kind": "boundary" } ] } ] } ] }, { "id": "instances-and-use", "name": "Instances, use and consequence", "description": "What counts as an instance of cyberattack and what follows from calling something that.", "rationale": "Applying a concept is an act with consequences, so a model must say what the label licenses and what it does not.", "layers": [ { "id": "instances", "name": "What counts as an instance", "description": "Clear cases, borderline cases and non-cases.", "findings": [ { "id": "instance-tests", "name": "Tests for an instance", "description": "What would settle whether something falls under it.", "questions": [ { "id": "instance-tests-q01", "text": "What would settle whether something is an instance of cyberattack?", "kind": "boundary" }, { "id": "instance-tests-q02", "text": "Which borderline cases are argued about, and on what grounds?", "kind": "definition" } ] } ] }, { "id": "consequence", "name": "Consequence of application", "description": "Rights, duties or decisions that follow from the label.", "findings": [ { "id": "consequence-record", "name": "What the label licenses", "description": "What an agent may do once something is classified this way.", "questions": [ { "id": "consequence-record-q01", "text": "What follows practically once something is treated as cyberattack?", "kind": "action" }, { "id": "consequence-record-q02", "text": "What must an agent not infer from the label alone?", "kind": "action" } ] } ] } ] }, { "id": "provenance-and-evidence", "name": "Provenance, evidence and time", "description": "Where every claim about a cyberattack came from and when it held.", "rationale": "A claim without a source and a time cannot be superseded, only overwritten, and an agent that overwrites loses the ability to explain itself.", "layers": [ { "id": "source-and-authority", "name": "Source and authority", "description": "Who said it, on what evidence, and how strongly.", "findings": [ { "id": "claim-provenance", "name": "Claim provenance and confidence", "description": "The authority behind each claim about a cyberattack and how confident it is.", "questions": [ { "id": "claim-provenance-q01", "text": "What identifies and describes a claim about a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "claim-provenance-q02", "text": "Who or what asserted this about a claim about a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "claim-provenance-q03", "text": "What may an agent decide or do once a claim about a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "time-and-versions", "name": "Time, versions and supersession", "description": "When a claim was true, when it was learnt, and what replaced it.", "findings": [ { "id": "validity-and-supersession", "name": "Validity period and supersession", "description": "How an old claim about a cyberattack is retired without being erased.", "questions": [ { "id": "validity-and-supersession-q01", "text": "What identifies and describes the validity of a claim about a cyberattack, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "validity-and-supersession-q02", "text": "Who or what asserted this about the validity of a claim about a cyberattack, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "validity-and-supersession-q03", "text": "What may an agent decide or do once the validity of a claim about a cyberattack is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] } ] }, "statistics": { "bundles": 6, "layers": 12, "findings": 14, "questions": 38 } } } }