A Fuzzy Probability Bayesian Network Approach for Dynamic Cybersecurity Risk Assessment in Industrial Control Systems

With the increasing deployment of data network technologies in industrial control systems (ICSs), cybersecurity becomes a challenging problem in ICSs. Dynamic cybersecurity risk assessment plays a vital role in ICS cybersecurity protection. However, it is difficult to build a risk propagation model for ICSs due to the lack of sufficient historical data. In this paper, a fuzzy probability Bayesian network (FPBN) approach is presented for dynamic risk assessment. First, an FPBN is established for analysis and prediction of the propagation of cybersecurity risks. To overcome the difficulty of limited historical data, the crisp probabilities used in standard Bayesian networks are replaced in our approach by fuzzy probabilities. Then, an approximate dynamic inference algorithm is developed for dynamic assessment of ICS cybersecurity risk. It is embedded with a noise evidence filter in order to reduce the impact from noise evidence caused by system faults. Experiments are conducted on a simplified chemical reactor control system to demonstrate the effectiveness of the presented approach.

[1]  Naixue Xiong,et al.  Multimodel-Based Incident Prediction and Risk Assessment in Dynamic Cybersecurity Protection for Industrial Control Systems , 2016, IEEE Transactions on Systems, Man, and Cybernetics: Systems.

[2]  Davide Bresolin,et al.  A Platform-Based Design Methodology With Contracts and Related Tools for the Design of Cyber-Physical Systems , 2015, Proceedings of the IEEE.

[3]  Michael I. Jordan,et al.  Loopy Belief Propagation for Approximate Inference: An Empirical Study , 1999, UAI.

[4]  Rami Zwick,et al.  Measures of similarity among fuzzy concepts: A comparative analysis , 1987, Int. J. Approx. Reason..

[5]  Dale C. Rowe,et al.  A survey SCADA of and critical infrastructure incidents , 2012, RIIT '12.

[6]  Salwani Abdullah,et al.  ANTSC: An Intelligent Naïve Bayesian Probabilistic Estimation Practice for Traffic Flow to Form Stable Clustering in VANET , 2018, IEEE Access.

[7]  Przemyslaw Grzegorzewski,et al.  Distances between intuitionistic fuzzy sets and/or interval-valued fuzzy sets based on the Hausdorff metric , 2004, Fuzzy Sets Syst..

[8]  V. Vittal,et al.  Online Risk-Based Security Assessment , 2002, IEEE Power Engineering Review.

[9]  David J. Spiegelhalter,et al.  Local computations with probabilities on graphical structures and their application to expert systems , 1990 .

[10]  Indrajit Ray,et al.  Dynamic Security Risk Management Using Bayesian Attack Graphs , 2012, IEEE Transactions on Dependable and Secure Computing.

[11]  Zahir Tari,et al.  A Probabilistic Model to Predict the Survivability of SCADA Systems , 2013, IEEE Transactions on Industrial Informatics.

[12]  Adnan Darwiche,et al.  Recursive conditioning , 2001, Artif. Intell..

[13]  Carol Woody,et al.  Introduction to the OCTAVE ® Approach , 2003 .

[14]  Lei Huang,et al.  Bayesian Networks in Fault Diagnosis , 2017, IEEE Transactions on Industrial Informatics.

[15]  Joe Halliwell.  Linguistic Probability Theory , 2008 .

[16]  UpdatingRobert Mateescu,et al.  Partition-based Anytime Approximation for Belief , 2001 .

[17]  John W. Fisher,et al.  Loopy Belief Propagation: Convergence and Effects of Message Errors , 2005, J. Mach. Learn. Res..

[18]  Helen Gill,et al.  Cyber-Physical Systems , 2019, 2019 IEEE International Conference on Mechatronics (ICM).

[19]  S. E. Ahmed,et al.  Markov Chain Monte Carlo: Stochastic Simulation for Bayesian Inference , 2008, Technometrics.

[20]  Sabina Jeschke,et al.  Security and Privacy in Cyber-Physical Systems : Foundations, Principles, and Applications , 2017 .

[21]  Hao Wang,et al.  Application of Work Domain Analysis for Cybersecurity , 2017, HCI.

[22]  A. Salmerón,et al.  Importance sampling in Bayesian networks using probability trees , 2000 .

[23]  Gang Tao,et al.  Relative Degrees and Adaptive Feedback Linearization Control of T–S Fuzzy Systems , 2015, IEEE Transactions on Fuzzy Systems.

[24]  F. Cozman,et al.  Generalizing variable elimination in Bayesian networks , 2000 .

[25]  Konrad S. Wrona,et al.  Real-time automated risk assessment in protected core networking , 2010, Telecommun. Syst..

[26]  Ian Jenkinson,et al.  An Offshore Risk Analysis Method Using Fuzzy Bayesian Network , 2009 .

[27]  Richard Gowland,et al.  The accidental risk assessment methodology for industries (ARAMIS)/layer of protection analysis (LOPA) methodology: a step forward towards convergent practices in risk assessment? , 2006, Journal of hazardous materials.

[28]  Nir Friedman,et al.  Bayesian Network Classifiers , 1997, Machine Learning.

[29]  Lawrence J. Trautman,et al.  Industrial Cyber Vulnerabilities: Lessons from Stuxnet and the Internet of Things , 2017 .

[30]  Yafeng Yin,et al.  Privacy-Preserving Transportation Traffic Measurement in Intelligent Cyber-physical Road Systems , 2016, IEEE Transactions on Vehicular Technology.

[31]  Alvaro A. Cárdenas,et al.  Attacks against process control systems: risk assessment, detection, and response , 2011, ASIACCS '11.

[32]  E. Newport,et al.  Computation of Conditional Probability Statistics by 8-Month-Old Infants , 1998 .

[33]  Qiang Shen,et al.  Linguistic probabilities: theory and application , 2008, Soft Comput..

[34]  Bir Bhanu,et al.  Dynamic Bayesian Networks for Vehicle Classification in Video , 2012, IEEE Transactions on Industrial Informatics.