Abstract:Although the expansion of attack types against industrial control systems is limited, the available means that violate the same security strategy emerge endlessly. However, the high availability and real-time requirements of industrial control systems restrict the application of some countermeasures that require massive resources. To solve this problem, this paper proposes a low learning-cost risk assessment model for similar scenarios, which enables the formulation of defense strategies for system risks in advance. To lay the foundation for this method, we firstly aggregate the attack means into limited attack types according to word clustering to address the classification challenge caused by unknown attacks. Then, similarity and statistical methods are combined to predict the next attack type. Subsequently, the hidden Markov model is used to map attack types and security states to obtain the forecasting results of the next security state. Based on this, the risk value is calculated through these prediction and forecasting results, and the system relevance and alert timeliness are considered in the assessment stage. We break the scenario limitations and verify the advantages of our model in a known scenario and another similar scenario with unknown attacks. The experimental results show that our model can deal with unknown attacks in similar scenarios and has excellent scenario migration ability. Meanwhile, the changing trend of the risk value is in consistence with the actual data, which also confirms that the assessment model can forecast the future risk situation of the system accurately and comprehensively.

Real-time Risk Assessment Based on Hidden Markov Model and Security Configuration

A Method of Network Security Situation Assessment Based on Hidden Markov Model.

Using Hidden Markov Models to Evaluate the Real-Time Risks of Network

Hierarchical Risk Assessment Method for Network Security Based on Real-Time Warning

Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

Multi-agent based hybrid Intrusion detection system

A markov game theory-based risk assessment model for network information system

Real-Time Risk Management Based on Time Series Analysis

A Fusion Model for Network Threat Identification and Risk Assessment

A Method of Intrusion Detection Based on Network Security Risk Assessment

Research On Technology For It System Security Assessment Based On Markov Chain

A Real Time Information Security Risk Assessment Method

A Time-Varying Markov Model and Its Application to Network Real-time Risk Probability Prediction

Network Security Situation Awareness Approach Based on Markov Game Model

Research on network risk situation assessment based on threat analysis

High-speed Model of Real-Time Risk Evaluation Based on Multi-Processor

Computer network security evaluation method based on improved attack graph

A Real-Time Method of Risk Evaluation Based on Danger Signal for Network Security

A risk assessment model for similar attack scenarios in industrial control system

Risk Assessment Model Based on Fuzzy Petri Nets

Overview Of Research On Assessment Model Of Radiant Threat Rank Based On Dynamic Bayesian Network