A Dynamic Decision-Making Approach for Cyber-Risk Reduction in Critical Infrastructure

Critical infrastructure (CI) is of vital importance to national economy and social stability. Although the rapid development of information technology improves the system performance of CI, it also makes CI more vulnerable to cyber attackers. However, due to the CI characteristics which include complex cyber-physical interaction and the interdependence in physical network, the cybersecurity protection methods of ITs cannot be used in CI directly. This paper provides a dynamic decision-making approach about cybersecurity protection for CI based on risk reduction. Firstly, a dynamic risk assessment is presented for CI after the attack-defense strategy is executed. Then, the optimal defense strategies are chosen in each station in CI, with considering the resource constraints. Finally, several simulations are carried out on a water-supply system. The simulation results demonstrate the effectiveness of the proposed approach.