Use of Bayesian belief networks in the analysis of information system network risk

Abstract

Information system networks are becoming increasingly pervasive in military applications, and thereby increasingly important to the conduct of modern warfare. They are also, consequently, increasingly becoming a target in themselves for attack. These considerations lead to the concept of command and control warfare, and, more generally, information warfare which focus on the decision making elements of an adversary force. Complementary to the offensive aspect of information warfare is the problem of determining the risks associated with a commander's own assets, and the devising of appropriate defensive measures, which is a similarly complex task. This paper describes a simple tool, based upon the use of Bayesian networks and a straightforward application of the graph theory, which is intended to assist commanders in determining the level of risk associated with their information system network assets, as well as the selection of countermeasures to reduce that risk level.