Cybersecurity risk assessment method of ICS based on attack-defense tree model

2021 ◽  
pp. 1-14
Author(s):  
Shuang Wang ◽  
Lei Ding ◽  
He Sui ◽  
Zhaojun Gu
Keyword(s):  
Risk Assessment ◽  
Control System ◽  
Assessment Method ◽  
Assessment Process ◽  
Industrial Control System ◽  
Tree Model ◽  
Industrial Control ◽  
Interval Probability ◽  
Risk Assessment Method ◽  
Attack Path

Cybersecurity risk assessment is an important means of effective response to network attacks on industrial control systems. However, cybersecurity risk assessment process is susceptible to subjective and objective effects. To solve this problem, this paper introduced cybersecurity risk assessment method based on fuzzy theory of Attack-Defense Tree model and probability cybersecurity risk assessment technology, and applied it to airport automatic fuel supply control system. Firstly, an Attack-Defense Tree model was established based on the potential cybersecurity threat of the system and deployed security equipment. Secondly, the interval probability of the attack path was calculated using the triangular fuzzy quantification of the interval probabilities of the attack leaf nodes and defensive leaf nodes. Next, the interval probability of the final path was defuzzified. Finally, the occurrence probability of each final attack path was obtained and a reference for the deployment of security equipment was provided. The main contributions of this paper are as follows: (1) considering the distribution of equipment in industrial control system, a new cybersecurity risk evaluation model of industrial control system is proposed. (2) The experimental results of this article are compared with other assessment technologies, and the trend is similar to that of other evaluation methods, which proves that the method was introduced in this paper is scientific. However, this method reduces the subjective impact of experts on cybersecurity risk assessment, and the assessment results are more objective and reasonable. (3) Applying this model to the airport oil supply automatic control system can comprehensively evaluate risk, solve the practical problems faced by the airport, and also provide an important basis for the cybersecurity protection scheme of the energy industry.

scholarly journals Information Security Risk Assessment Method for Ship Control System Based on Fuzzy Sets and Attack Trees

2019 ◽  
Vol 2019 ◽  
pp. 1-11 ◽  
Author(s):  
Wenli Shang ◽  
Tianyu Gong ◽  
Chunyu Chen ◽  
Jing Hou ◽  
Peng Zeng
Keyword(s):  
Risk Assessment ◽  
Control System ◽  
Information Security ◽  
Assessment Method ◽  
Security Risk ◽  
Tree Model ◽  
Attack Tree ◽  
Interval Probability ◽  
Information Security Risk ◽  
Security Risk Assessment

Information security risk assessment for industrial control system is usually influenced by uncertain factors. For effectively dealing with problem that the uncertainty and quantification difficulties are caused by subjective and objective factors in the assessment process, an information security risk assessment method based on attack tree model with fuzzy set theory and probability risk assessment technology is proposed, which is applied in a risk scenario of ship control system. Firstly, potential risks of the control system are analyzed and the attack tree model is established. Then triangular fuzzy numbers and expert knowledge are used to determine the factors that influence the probability of a leaf node and the leaf nodes are quantified to obtain the interval probability. Finally, the fuzzy arithmetic is used to determine the interval probability of the root node and the attack path. After defuzzification, the potential risks of the system and the probability of occurrence of each attack path are obtained. Compared with other methods, the proposed method can greatly reduce the impact of subjectivity on the risk assessment of industrial control systems and get more stable, reliable, and scientific evaluation results.

scholarly journals A Methodology for Harmonizing Safety and Health Scales in Occupational Risk Assessment

2021 ◽  
Vol 18 (9) ◽  
pp. 4849
Author(s):  
Zuzhen Ji ◽  
Dirk Pons ◽  
John Pearse
Keyword(s):  
Risk Assessment ◽  
Health And Safety ◽  
Assessment Method ◽  
Assessment Process ◽  
Successful Implementation ◽  
Health Issues ◽  
Public Health Perspective ◽  
Chronic Health ◽  
Risk Assessment Method

Successful implementation of Health and Safety (H&S) systems requires an effective mechanism to assess risk. Existing methods focus primarily on measuring the safety aspect; the risk of an accident is determined based on the product of severity of consequence and likelihood of the incident arising. The health component, i.e., chronic harm, is more difficult to assess. Partially, this is due to both consequences and the likelihood of health issues, which may be indeterminate. There is a need to develop a quantitative risk measurement for H&S risk management and with better representation for chronic health issues. The present paper has approached this from a different direction, by adopting a public health perspective of quality of life. We have then changed the risk assessment process to accommodate this. This was then applied to a case study. The case study showed that merely including the chronic harm scales appeared to be sufficient to elicit a more detailed consideration of hazards for chronic harm. This suggests that people are not insensitive to chronic harm hazards, but benefit from having a framework in which to communicate them. A method has been devised to harmonize safety and harm risk assessments. The result was a comprehensive risk assessment method with consideration of safety accidents and chronic health issues. This has the potential to benefit industry by making chronic harm more visible and hence more preventable.

scholarly journals Reliability Assessment Model for Industrial Control System Based on Belief Rule Base

2019 ◽  
Vol 14 (3) ◽  
pp. 419-436 ◽  
Author(s):  
Yuhe Wang ◽  
Peili Qiao ◽  
Zhiyong Luo ◽  
Guanglu Sun ◽  
Guangze Wang
Keyword(s):  
Control System ◽  
Reliability Assessment ◽  
Quantitative Information ◽  
Assessment Method ◽  
Assessment Model ◽  
Rule Base ◽  
Industrial Control System ◽  
Industrial Control ◽  
Proposed Model ◽  
Belief Rule Base

This paper establishes a novel reliability assessment method for industrial control system (ICS). Firstly, the qualitative and quantitative information were integrated by evidential reasoning(ER) rule. Then, an ICS reliability assessment model was constructed based on belief rule base (BRB). In this way, both expert experience and historical data were fully utilized in the assessment. The model consists of two parts, a fault assessment model and a security assessment model. In addition, the initial parameters were optimized by covariance matrix adaptation evolution strategy (CMA-ES) algorithm, making the proposed model in line with the actual situation. Finally, the proposed model was compared with two other popular prediction methods through case study. The results show that the proposed method is reliable, efficient and accurate, laying a solid basis for reliability assessment of complex ICSs.

A Distributed Network Risk Assessment Method Based on Attack Graph

2012 ◽  
Vol 241-244 ◽  
pp. 2335-2342
Author(s):  
Tian Chi Yang ◽  
Ming Fang ◽  
Qi Feng Shao
Keyword(s):  
Risk Assessment ◽  
Information Security ◽  
Graph Model ◽  
Assessment Method ◽  
Computing Power ◽  
Attack Graph ◽  
Risk Assessment Method ◽  
Key Points ◽  
Attack Path ◽  
Network Risk

Evaluating risk effectively selecting effective defence measures and defending information threats actively are the key points of resolving security problems of information system．Based on the actual requirements and status of risk assessment of information security，we integrate attack graph to apply it in studying risk assessment of information security．Firstly，focused on the uncertainty and complexity of risk assessment of information security，we integrate the technology of vulnerabilities associated with to apply it in studying risk assessment．On the other hand，since the attack path described by attack graph model is suited for the quantity data processing，and poor to the qualitative analyze，and risk is uncertain，the risk factors are quantized by the probability of attack path forming proposed in this dissertation so that the probability of atom attack are pre-treated，a risk assessment method based on attack graph model is proposed．The method Take full advantage of computing power of each host in the network, greatly shorten the attack graph generation time.

Sign in / Sign up

Export Citation Format

Share Document