Bayesian Attack Graph Research Articles

Optimal Joint Defense and Monitoring for Networks Security under Uncertainty: A POMDP-Based Approach

The increasing interconnectivity in our infrastructure poses a significant security challenge, with external threats having the potential to penetrate and propagate throughout the network. Bayesian attack graphs have proven to be effective in capturing the propagation of attacks in complex interconnected networks. However, most existing security approaches fail to systematically account for the limitation of resources and uncertainty arising from the complexity of attacks and possible undetected compromises. To address these challenges, this paper proposes a partially observable Markov decision process (POMDP) model for network security under uncertainty. The POMDP model accounts for uncertainty in monitoring and defense processes, as well as the probabilistic attack propagation. This paper develops two security policies based on the optimal stationary defense policy for the underlying POMDP state process (i.e., a network with known compromises): the estimation-based policy that performs the defense actions corresponding to the optimal minimum mean square error state estimation and the distribution-based policy that utilizes the posterior distribution of network compromises to make defense decisions. Optimal monitoring policies are designed to specifically support each of the defense policies, allowing dynamic allocation of monitoring resources to capture network vulnerabilities/compromises. The performance of the proposed policies is examined in terms of robustness, accuracy, and uncertainty using various numerical experiments.

An approach for assessing the functional vulnerabilities criticality of CPS components

Timely identification of critical security flaws in a cyber-physical system makes identifying risks and potential threats possible. To address this issue, threat models are created to better understand potential vulnerabilities that must be considered to ensure system reliability. Selecting the optimal solution for assessing the functional vulnerabilities criticality of cyber-physical system components is a complex process since all vulnerabilities must be identified, classified, and quantified according to a unified approach as part of the cybersecurity process. An effective tool for cyber-physical systems analysis is the Bayesian attack graph. Each path in the graph represents a sequence of attacks that an attacker can use to achieve a specific goal, such as gaining access to sensitive data or controlling a system. This paper proposes a quantitative method for assessing the vulnerability criticality of cyber-physical system components based on the Promethee II multi-criteria decision-making method. It allows ranking and identification of the system's most vulnerable components. The proposed approach is evaluated using a threat model and three scenarios of cyberattacks on a cyber-physical system. Comparison with TOPSIS, VIKOR, and ELECTRE methods proves the effectiveness of the proposed approach. The proposed approach can help technical specialists make more reasoned decisions when ranking critical vulnerabilities of cyber-physical system components to provide security measures and prevent cyberattacks.

A new method of dynamic network security analysis based on dynamic uncertain causality graph

In the context of cloud computing, network attackers usually exhibit complex, dynamic, and diverse behavior characteristics. Existing research methods, such as Bayesian attack graphs, lack evidence correlation and real-time reflection of the network attack events, and high computational complexity for attack analysis. To solve these problems, this study proposes a Dynamic Uncertain Causal Attack Graph (DUCAG) model and a Causal Chain-based Risk Probability Calculation (CCRP) algorithm. The DUCAG model is constructed to represent the uncertain underlying causalities among network attack events, and the CCRP algorithm aims at dynamically updating the causality weights among different network attack events and attacker hypotheses based on alarm information and causal chain reasoning process. By causality simplification and causality reasoning methods, the CCRP efficiently predicts the attacker behaviors and potential attack likelihood under uncertain time-varying attack situations, and is robust to the incompleteness and redundancy in alarm information. Four experiments under different attack scenarios demonstrate that, the DUCAG model can effectively characterize and predict the complex and uncertain attack causalities, in a manner of high time efficiency. The proposed method has application significance on cloud computing platforms by dynamically evaluating network security status, predicting the future behaviors of attackers, and assisting in adjusting network defense strategies.

Deep Learning-based Network Security Protection for Scheduling Data in Power Plant Systems

Abstract Scheduling data of power plant systems plays a pivotal role in grid security. In this paper, the intrusion detection model IDP-TSW is constructed by using deep learning technology, feature extraction of raw traffic data based on density peak clustering algorithm and control variable method, and the final classification is realized by softmax. After completing the intrusion detection, for the network malicious intrusion situation further proposed the security protection strategy selection model HMS-BAG based on the Bayesian attack graph, formalized the description of the protection strategy selection problem, and proposed the optimal security protection strategy selection algorithm based on PSO. In the network intrusion detection performance experiments, the performance of the IDP-TSW model proposed in this paper outperforms the Bi-LSTM and CNN+Bi-LSTM models in terms of accuracy, recall, and F1 value. The F1 values for determining normal and abnormal data are 96.57% and 95.75%, respectively, and the precision and recall are also higher than 94%. Detecting Generic and Reconnaissance attacks is more than 90% accurate, but Dos attacks and others are relatively absent. In the network security defense performance experiment, the proposed HMS-BAG model achieved a defense success rate of 94.2% and a defense gain of 170.68.

Modeling and assessing load redistribution attacks considering cyber vulnerabilities in power systems

Introduction: Load Redistribution (LR) attacks, as a common form of false data injection attack, have emerged as a significant cybersecurity threat to power system operations by manipulating load buses’ measurements at substations. Existing LR attack methods typically assume that any substation can be equally attacked, contributing to the analysis of LR attacks in power systems. However, the diversity of cyber vulnerabilities in substation communication links implies varying costs associated with falsifying load buses’ measurements. Thus, quantitatively evaluating these costs and analyzing the impact of LR attacks on power systems within cost constraints holds practical significance.Methods: In this paper, we employ a Bayesian attack graph model to characterize the intrusion process through cyber vulnerabilities. The costs of falsifying load buses’ measurements at substations are quantitatively evaluated using the mean time-to-compromise model. Subsequently, from the attacker’s perspective, we propose a bi-level optimization model for LR attacks, considering the mean time to compromise in conjunction with limited attack resources and power flow constraints.Results: Simulations conducted on the IEEE 14-bus system illustrate the influence of cyber vulnerabilities on LR attacks within power systems. Furthermore, we verify that the attack scenario of the existing LR attack model aligns with a case of the proposed bi-level LR attack model when there is sufficient attack time to compromise all communication links.Discussion: The findings of this research demonstrate that the impact of cyber vulnerabilities on LR attacks can be quantified by assessing the attack costs. Effective management of LR attacks can be achieved under cost constraints through optimization methods. These insights contribute to enhancing network security strategies for power systems, mitigating potential threats posed by LR attacks in power system operations.

Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs

Early attack detection is essential to ensure the security of complex networks, especially those in critical infrastructures. This is particularly crucial in networks with multi-stage attacks, where multiple nodes are connected to external sources, through which attacks could enter and quickly spread to other network elements. Bayesian attack graphs (BAGs) are powerful models for security risk assessment and mitigation in complex networks, which provide the probabilistic model of attackers’ behavior and attack progression in the network. Most attack detection techniques developed for BAGs rely on the assumption that network compromises will be detected through routine monitoring, which is unrealistic given the ever-growing complexity of threats. This paper derives the optimal minimum mean square error (MMSE) attack detection and monitoring policy for the most general form of BAGs. By exploiting the structure of BAGs and their partial and imperfect monitoring capacity, the proposed detection policy achieves the MMSE optimality possible only for linear-Gaussian state space models using Kalman filtering. An adaptive resource monitoring policy is also introduced for monitoring nodes if the expected predictive error exceeds a user-defined value. Exact and efficient matrix-form computations of the proposed policies are provided, and their high performance is demonstrated in terms of the accuracy of attack detection and the most efficient use of available resources using synthetic Bayesian attack graphs with different topologies.

Including insider threats into risk management through Bayesian threat graph networks

Cybersecurity incidents do represent a serious danger for companies. In fact, the number of cyber crimes is exponentially growing in a scenario where the global COVID-19 pandemic determined several conditions that have negatively affected companies' cyber-security posture. The adoption of risk management processes can help reduce security threats and mitigate both financial and reputation losses. In computer systems, it is crucial to relate security risks to the system infrastructure. Bayesian attack graph models can help reach such a goal. The approach is very effective as it allows to define the attack paths an attacker would perform against a specific network infrastructure. In this way, it is possible to construct a truthful representation of a company's security risks that cannot be obtained with other approaches. Still, Bayesian risk management approaches are usually based on advanced threats. Namely, those threats relate to vulnerabilities that can only be exploited by a skilled attacker. Although several works enrich the expressiveness of the proposed Bayesian model, current proposals do not provide insights into how it is possible to estimate security control costs, asset values, and threat probabilities for other types of threats. Furthermore, they do not take insider threats into consideration. This work shows that a risk management framework based on Bayesian Attack Graphs can be adapted to include a variety of threats, including those related to the insiders. We first extend an interesting work based on Bayesian Decision Networks to cover a broader range of threats. Then, we formalize several concepts, such as security control coverage and risk strategy, and show that our model can easily integrate insider threats when specific properties are defined. Finally, in order to address insider threats, we enrich the model with security controls that differ from the standard ones, such as technical IT training sessions and employee satisfaction surveys.

A Network Intrusion Detection Method Incorporating Bayesian Attack Graph and Incremental Learning Part

For the current stage of complex and changing network environments and correlated and synchronized vulnerability attacks, this study first fuses attack graph technology and Bayesian networks and constructs Bayesian attack graphs toportray the correlation relationships between vulnerabilities and discovering attackers’ intentions. Meanwhile, improving the Bayesian attack graph is difficult because it is difficult to achieve active updates and adapt to the changing network environment and other problems. The study proposed a detection method that integrated the Bayesian attack graph and the XGBoost incremental learning (IL) approach. Experiments showed that the IL model had an accuracy of 0.951, an accuracy of 0.999, a recall of 0.815, an F1 value of 0.898, and an Area Under Curve (AUC) value of 0.907. The prediction ability of this method was better than that of the base model. Bayesian attack graphs fused with IL can detect attacks in the network more efficiently and accurately, so the probability of each node in the network system being attacked can be updated in real time.

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

AbstractHighly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.

A scalable algorithm for network reachability analysis with cyclic attack graphs

Today, it is indispensable for us to know our IT infrastructure’s security level to make rational decisions to protect it from malicious attacks. However, the ever-growing scale and complexity of our infrastructures make it difficult. One available approach is attack-graph analysis, a model-based algorithm that generates a directed graph called an attack graph composed of possible attack actions and their AND/OR combinations. An attack graph allows us to identify the logical possibility of cyber-attacks. Unfortunately, attack graphs lack quantitative information, such as the likelihood of a successful attack – the reachability. Meanwhile, some advanced approaches, such as the Bayesian attack-graph, compute reachabilities with an attack graph. Still, those methods have problems in the scalability and the handling of cycles contained in attack graphs. This study proposes and examines another approach named reachability-graph analysis. A reachability graph is a directed graph obtained from an attack graph by which we can compute the reachabilities. It is extremely fast to generate, thus applicable to large-scale network analysis. Furthermore, this method allows cycles in attack graphs. Such a scalable algorithm has been awaited for over a decade; it generates probabilistic security metrics and is guaranteed applicable to any cyclic AND/OR graphs. We compare our approach’s computational efficiency with the Bayesian attack-graph. Also, we apply our approach to large-scale, cyclic attack graphs. Several theoretical properties with proofs and the computational complexity of our approach are examined too.

Time-Based Moving Target Defense Using Bayesian Attack Graph Analysis

The moving target defense (MTD) is a proactive cybersecurity defense technique that constantly changes potentially vulnerable points to be attacked, to confuse the attackers, making it difficult for attackers to infer the system configuration and nullify reconnaissance activities to a victim system. We consider an MTD strategy for software-defined networking (SDN) environment where every SDN switch is controlled by a central SDN controller. As the MTD may incur excessive usage of the network/system resources for cybersecurity purposes, we propose to perform the MTD operations adaptively according to the security risk assessment based on a Bayesian attack graph (BAG) analysis. For accurate BAG analysis, we model random and weakest-first attack behaviors and incorporate the derived analytical models into the BAG analysis. Using the BAG analysis result, we formulate a knapsack problem to determine the optimal set of vulnerabilities to be reconfigured under a constraint of SDN reconfiguration overhead. The experiment results prove that the proposed MTD strategy outperforms the full MTD and random MTD counterparts in terms of the maximum/average of attack success probabilities and the number of SDN reconfiguration updates.

Reliability assessment of cyber-physical power systems considering the impact of predicted cyber vulnerabilities

This paper presents a reliability assessment technique for cyber-physical power systems (CPPSs) that incorporates cybersecurity issues by considering non-normal random variables with non-linear dependencies. Our model uses bidirectional encoder representations from transformers (BERTs) to predict the severity of cyber vulnerabilities by analyzing their textual description. This practical model allows the engineer to manually enter text that describes threats to predict the probability of cyber vulnerability. We use a Bayesian attack graph to simulate the attack paths and a Markov model to demonstrate the consequences of cyber attacks on the CPPS. Furthermore, a hybrid approximate-analytical approach is employed to assess the overall reliability of the CPPS when considering the load and wind generation uncertainties, given their non-linear dependencies. The proposed method is implemented on the modified IEEE Reliability Test System. The results demonstrate that the reliability indices for a simultaneous cyber attack on corporate networks and wind farm control centers are more significant than those obtained for other attack scenarios. The proposed prediction method is highly accurate, and the predicted vulnerability scores align with those provided by the National Vulnerability Database. The results are compared with sequential Monte Carlo simulation, subset simulation, and cross-entropy-based importance sampling methods. The comparison shows that the proposed method outperforms other methods in terms of convergence speed and accuracy.

Optimal Security Protection Strategy Selection Model Based on Q-Learning Particle Swarm Optimization.

With the rapid development of Industrial Internet of Things technology, the industrial control system (ICS) faces more and more security threats, which may lead to serious risks and extensive damage. Naturally, it is particularly important to construct efficient, robust, and low-cost protection strategies for ICS. However, how to construct an objective function of optimal security protection strategy considering both the security risk and protection cost, and to find the optimal solution, are all significant challenges. In this paper, we propose an optimal security protection strategy selection model and develop an optimization framework based on Q-Learning particle swarm optimization (QLPSO). The model performs security risk assessment of ICS by introducing the protection strategy into the Bayesian attack graph. The QLPSO adopts the Q-Learning to improve the local optimum, insufficient diversity, and low precision of the PSO algorithm. Simulations are performed on a water distribution ICS, and the results verify the validity and feasibility of our proposed model and the QLPSO algorithm.

Protection Strategy Selection Model Based on Genetic Ant Colony Optimization Algorithm

Industrial control systems (ICS) are facing an increasing number of sophisticated and damaging multi-step attacks. The complexity of multi-step attacks makes it difficult for security protection personnel to effectively determine the target attack path. In addition, most of the current protection models responding to multi-step attacks have not deeply studied the protection strategy selection method in the case of limited budget. Aiming at the above problems, we propose a protection strategy selection model based on the Genetic Ant Colony Optimization Algorithm. The model firstly evaluates the risk of ICS through the Bayesian attack graph; next, the target attack path is predicted from multiple angles through the maximum probability attack path and the maximum risk attack path; and finally, the Genetic Ant Colony Optimization Algorithm is used to select the most beneficial protection strategy set for the target attack path under limited budget. Compared with the Genetic Algorithm and Ant Colony Optimization Algorithm, the Genetic Ant Colony Optimization Algorithm proposed in this paper can handle the local optimal problem well. Simulation experiments verify the feasibility and effectiveness of our proposed model.

Risk assessment in distribution networks considering cyber coupling

With the continuous development of information and communication technologies and their wide application in distribution networks, which have evolved into cyber-physical distribution systems (CPDS). Yet, interactions between cyber and physical systems mean power systems face a greater potential risk. Since feeder automation (FA) systems in a CPDS can quickly isolate faults and restore services, to reduce customer outage times, the potential effect of cyberattacks on FA systems is massive. This paper proposes a risk assessment method for cyberattacks in distribution networks considering cyber coupling. The proposed method takes into account the impacts of cyber systems on power systems, and vice versa. Regarding the cyberattack, an attack method to mislead the judgment of FA systems by tampering with monitoring data of remote terminal units (RTUs) is analyzed, and a Bayesian attack graph (BAG) model is adopted to quantify the successful probability of RTUs. To calculate the attack consequences, a power supply restoration model considering the interdependence of cyber and physical systems is developed, which is measured in scale and in duration to full restoration. The proposed methodology is tested and validated using the modified IEEE 33-node and CPS 62-node test systems. This study highlights the importance of assessing distribution network security from the cyber-physical point of view.

Consider the Consequences: A Risk Assessment Approach for Industrial Control Systems

The development of information and communication technologies extended the application of digitalized industrial control systems (ICSs) to critical infrastructure. With this circumstance, emerging sophisticated cyberattacks by adversaries, including nation-backed terrorists, target ICSs due to their strategic value that critical infrastructure can cause severe consequences to equipment, people, and the environment due to the cyberattacks on ICSs. Therefore, critical infrastructure owners should provide high assurance to those involved, such as neighboring residents and governments, that the facility is adequately protected against cyberattacks. The risk assessment that identifies, estimates, and prioritizes risks is vital to provide high assurance. This study proposes a framework for evaluating risks by quantifying the likelihood of cyber exploitation and the consequences of cyberattacks. The quantification of the likelihood of cyber exploitation is inspired by research on Bayesian attack graphs (BAGs), allowing probability evaluation that considers the causal relationship between ICSs and multistage attacks. For the cyberattack consequences quantification, we propose a methodology to evaluate how far an impact will spread and thus how many functions will be influenced when an ICS is exploited. The methodology is conducted by ICS experts identifying and listing functional dependencies and essential function goals among ICSs that they are already familiar with and do not require in-depth cybersecurity knowledge. Through experiments, we demonstrated how to apply our framework to assess the risks of the plant protection system, which is a safety-grade digital system used in nuclear power plants. The result shows that risk can be multidimensionally assessed than previous literature, such as discovering that components that were not considered important have high risk due to their functional connectivity.

Dynamic Network Security Analysis Based on Bayesian Attack Graphs

Dynamic Network Security Analysis Based on Bayesian Attack Graphs

Security Threat Modelling With Bayesian Networks and Sensitivity Analysis for IAAS Virtualization Stack

Designing security mechanisms for cloud computing infrastructures has assumed importance with the widespread adoption of public clouds. Virtualization security is a crucial component of the overall cloud infrastructure security. In this article, the authors employ the concept of Bayesian networks and attack graphs to carry out sensitivity analysis on the different components involved in virtualization security for infrastructure as a service (IaaS) cloud infrastructures. They evaluate the Bayesian attack graph (BAG) for the IaaS model to reveal the sensitive regions and thus help the administrators to secure the high risk components in the stack. They present a formal definition of the sensitivity analysis and then evaluate using the BAG model for IaaS stack. The model and analysis presented here can also be used by security analysts and designers to make a selection of the security solutions based on the risk profile of vulnerable nodes and the corresponding cost involved in adding a defense against the identified vulnerabilities.

Information security assessment of wireless sensor networks based on bayesian attack graphs

Network security issues have become increasingly prominent, and information security risk assessment is an important part of network security protection. Security risk assessment based on methods such as attack trees, attack graphs, neural networks, and fuzzy logic has problems such as difficulty in data collection during the assessment process, excessive reliance on expert experience, failure to consider the actual network environment, or ineffective joint application. The qualitative and quantitative information security fuzzy comprehensive evaluation method uses the theory of fuzzy mathematics to better solve the above problems, so that the evaluation method is scientific, comprehensive and operable. To improve the accuracy of information security risk assessment in wireless sensor networks, we propose a fuzzy comprehensive evaluation method based on Bayesian attack graphs. This considers the impact of environmental factors of the assessed system on security risk and the spread of the effects on the Bayesian network. Therefore, this model can reflect possible situations due to network attacks in the wireless sensor network system. The results show that this quantitative evaluation method is applicable to assessing risk in wireless sensor network systems, and the results are more objective and accurate.

SD-CPC: SDN Controller Placement Camouflage based on Stochastic Game for Moving-target Defense

The modern paradigm of Software Defined Network (SDN) inspired the research community to develop more innovative and transformative solutions for large scale and complex crucial Cyber Physical Systems (CPS). However, the recent destructive attacks targeting such CPS applications, raised the need to initially secure and scale the core SDN network. These attacks may target the heart of SDN networks itself formed by the controllers. Therefore, recent research works discussed the Controller Placement Problem (CPP) to determine the required number of SDN controller(s) and their optimal locations in synonyms wide area networks. A few of the presented solutions discussed the network security aspect to solve this problem. In addition, none of them addressed the need to secure and dynamically change SDN controller location to confuse attackers. Therefore, in this paper, we introduce a new concept of Controller Placement Camouflage (CPC) to dynamically change the attack surface (SDN controller placements) for Moving-target Defense (MTD). The new paradigm of MTD imposes various asymmetric offensive and defensive modes against cyber-adversaries. We relied on the Zero-Sum game as a stochastic game between the system defender and the attacker to guide our MTD solution. In addition, our presented solution is adapted to consider the network vulnerabilities, evaluate the risk level of the system in real-time using Bayesian Attack Graph (BAG), to frequently shift the SDN controller(s) location. Furthermore, we used the Smart Grid as a case study for a mission critical CPS application. We conducted a scenario of UK Bulk Demand Points (BDP), 50MVA generation network capacity map to simulate a real mini-grid network topology. To the best of our knowledge, this research work may be considered the first introduction for SD-CPC for MTD.