Assessing the Impact of Malware Attacks in Utility Networks

Utility networks are becoming more and more interconnected. Besides the natural physical interdependencies (e.g., water networks heavily depend on power grids, etc.), utility networks are nowadays often monitored and operated by industrial control systems (ICS). While these systems enhance the level of control over utility networks, they also enable new forms of attacks, such as cyberattacks. During the last years, cyberattacks have occurred more frequently with sometimes a significant impact on the company as well as the society. The first step toward preventing such incidents is to understand how an infection of one component influences the rest of the network. This malware spreading can be modeled as a stochastic process on a graph where edges transmit an infection with a specific probability. In practice, this probability depends on the type of the malware (e.g., ransomware, spyware, virus, etc.) as well as on the type of the connection between the nodes (e.g., physical or logical connections). In this chapter, we illustrate how the abstract model can be put into practice for a concrete use case.