# Classification and Comparison of Critical Infrastructure Protection Tools

George Stergiopoulos, Efstratios Vasilellis, Georgia Lykou, Panayiotis Kotzanikolaou, Dimitris Gritzalis

► To cite this version:

George Stergiopoulos, Efstratios Vasilellis, Georgia Lykou, Panayiotis Kotzanikolaou, Dimitris Gritzalis. Classification and Comparison of Critical Infrastructure Protection Tools. 10th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2016, Arlington, VA, United States. pp.239-255, 10.1007/978-3-319-48737-3_14. hal-01614869

HAL Id: hal-01614869

https://inria.hal.science/hal-01614869

Submitted on 11 Oct 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Chapter 14

CLASSIFICATION AND COMPARISON
OF CRITICAL INFRASTRUCTURE
PROTECTION TOOLS

George Stergiopoulos, Efstratios Vasilellis, Georgia Lykou, Panayiotis Kotzanikolaou and Dimitris Gritzalis

**Abstract** Modeling and analysis of critical infrastructure interdependencies is a research area that has attracted considerable interest. Interdependency and risk analyses can be computationally intensive, but can also yield useful results that enhance risk assessments and offer risk mitigation alternatives. Unfortunately, many tools and methodologies are left unsupported and are forgotten soon after the projects that developed them terminate.

This chapter attempts to identify and classify many existing tools and frameworks to create a common baseline for threat identification and risk assessment. It also compares their attributes and technologies in creating a taxonomy. Conceptual and qualitative studies about infrastructure interdependencies along with modeling and simulation approaches are examined. The comparison is based on two aspects: the purpose that each tool serves and its technical modeling approach. This work attempts to aid the industrial control system security community by acting as a single point of reference and drawing attention to possible modeling combinations to enable researchers to identify and construct complex combined solutions that yield better results. The analysis suggests that future research should address risk mitigation through qualitative rather than quantitative analyses. The contributions can be maximized by developing holistic meta-tools or focusing entirely on specific problems.

**Keywords:** Critical infrastructure protection tools, taxonomy, classification

# 1. Introduction

Critical infrastructures are defined by the U.S. Department of Homeland Security [10] as “assets, systems and networks, whether physical or virtual, so
vital that their incapacitation or destruction would have a debilitating effect on security, national economy security, national public health or safety, or any combination thereof.” Critical infrastructure protection methodologies, models and simulations are used to understand infrastructure systems, their interdependencies, vulnerabilities, impacts of potential failures and their propagation across interdependent infrastructure systems, based on risk assessments of all the involved critical infrastructures. They may also be used to support performance measurement, conceptual design, impact evaluation, response planning, vulnerability analyses and economic impact assessments. This chapter seeks to capture knowledge about critical infrastructure protection tools (and methodologies) and classify them to create a common baseline for threat identification and risk assessment.

## 2. Tool Classification and Comparison

The classification and comparison of critical infrastructure protection tools are based on two aspects: (i) purpose (i.e., functionality) of each tool [10, 20]; and (ii) technical modeling approach [13]. The categories used for each classification are:

* **Purpose Based Classification:** (i) risk identification; (ii) risk assessment; (iii) risk prioritization; (iv) risk mitigation planning; and (v) effectiveness evaluation.

* **Technical Approach Based Classification:** (i) empirical approaches; (ii) system dynamics approaches; (iii) agent based approaches; (iv) network based approaches; and (v) other approaches.

This research has identified, classified and compared 67 critical infrastructure protection tools, most of which were developed in the United States [14].

### 2.1 Purpose Based Classification

The National Infrastructure Protection Plan (NIPP) [20] classifies tools, frameworks and methodologies according to the purpose they serve. Specifically, the stage or stages of the risk management framework that they support.

After setting the security goals, the following goals should be achieved (in serial order):

* **Goal 1: Risk Identification (RI):** Asset identification, vulnerabilities and events with relationships.

* **Goal 2: Risk Impact Assessment (RIA):** Assessment of probabilities and consequences of risk events. May include cost, schedule, performance impact and functionality impacts.

* **Goal 3: Risk Prioritization (RP):** Aggregation and analysis of risk assessment results, establishment of priorities that provide the greatest
mitigation of risk. Assessment of the criticality of risk using decision-analytic rules and ranking of risk events from the most critical to the least critical.

* **Goal 4: Risk Mitigation Planning and Implementation (RMP):** Selection of sector-appropriate protective actions and/or countermeasures to reduce or manage the identified risk.

* **Goal 5: Effectiveness Evaluation (EE):** Evaluation of countermeasures and strategies. Reassessment of risk.

Tables 1 and 2 present the tool taxonomy according to the risk management purpose served. Note that the majority of the tools start with the risk identification (RI) stage and proceed to the subsequent analysis steps (RIA, RP, RMP and EE). Tools that are lower in the classification tree support additional, multiple risk analysis purposes. A few tools skip the first two stages, while very few tools support all the stages of the risk management framework.

## 2.2 Modeling Approach Based Classification

Critical infrastructure modeling approaches refer to techniques used in developing critical infrastructure protection tools. The approaches are often chosen based on the intended purposes of the tools. Ouyang [13] has categorized critical infrastructure protection methodologies and tools using five main types of modeling and simulation approaches:

* **Empirical Approaches:** These approaches analyze interdependencies based on historical events, disaster data and expert knowledge. They can identify failure patterns, quantify interdependency strength metrics to aid in decision making, perform empirical risk analyses and provide alternatives for minimizing risk.

* **System Dynamics Approaches:** These approaches utilize a top-down method to manage and analyze complex adaptive systems with interdependencies. Feedback, stock and flow are the basic concepts in such approaches. Loops indicate connections and the directions of effects between critical infrastructure components.

* **Agent Based Approaches:** These approaches are commonly used by tools. Critical infrastructures are complex adaptive systems and their components can be modeled as agents. Agent based approaches adopt a bottom-up method and assume that complex behavior or phenomena emerge from many individual and relatively simple interactions of autonomous agents. Agents interact with each other and their environment based on a set of rules that mimic the way real infrastructure components would react.

* **Network Based Approaches:** These approaches model critical infrastructures as networks whose nodes represent critical infrastructure components and links represent physical and relational connections between
<table><caption>Table 1. Tool classification according to risk management purpose.</caption><thead><tr><th>Tools</th><th>RI</th><th>RIA</th><th>RP</th><th>RMP</th><th>EE</th></tr></thead><tbody><tr><td>MIN</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>TRAGIS</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>MITS</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>L2SIM</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>RTDS</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>ActivitySim</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>SessionSim</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>PC Tides</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>UPMoST</td><td>T</td><td>F</td><td>F</td><td>F</td><td>F</td></tr><tr><td>CIMS</td><td>F</td><td>T</td><td>T</td><td>T</td><td>T</td></tr><tr><td>DECRIS</td><td>F</td><td>T</td><td>T</td><td>T</td><td>T</td></tr><tr><td>CAPRA</td><td>F</td><td>T</td><td>T</td><td>T</td><td>F</td></tr><tr><td>EPRAM</td><td>F</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>Multi-Graph</td><td>F</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>AIMSUN</td><td>F</td><td>T</td><td>F</td><td>T</td><td>F</td></tr><tr><td>Athena</td><td>F</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>Nexus Fusion</td><td>F</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>HCSim</td><td>F</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>HYDRA</td><td>F</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>NEMO</td><td>F</td><td>F</td><td>T</td><td>T</td><td>T</td></tr><tr><td>CISIA Pro</td><td>F</td><td>F</td><td>T</td><td>T</td><td>F</td></tr><tr><td>IntePoint VU</td><td>F</td><td>F</td><td>T</td><td>F</td><td>F</td></tr><tr><td>CIPMA</td><td>F</td><td>F</td><td>F</td><td>T</td><td>T</td></tr><tr><td>CI3</td><td>F</td><td>F</td><td>T</td><td>F</td><td>T</td></tr><tr><td>Restore</td><td>F</td><td>F</td><td>F</td><td>T</td><td>F</td></tr><tr><td>TRANSIMS</td><td>F</td><td>F</td><td>F</td><td>F</td><td>T</td></tr><tr><td>CARVER-2</td><td>T</td><td>F</td><td>T</td><td>F</td><td>F</td></tr><tr><td>MUNICIPAL</td><td>T</td><td>F</td><td>T</td><td>F</td><td>F</td></tr><tr><td>IEISS</td><td>T</td><td>F</td><td>T</td><td>T</td><td>F</td></tr><tr><td>IIM</td><td>T</td><td>F</td><td>T</td><td>T</td><td>F</td></tr><tr><td>CIP/DSS</td><td>T</td><td>F</td><td>T</td><td>T</td><td>T</td></tr><tr><td>CIPDSS-DM</td><td>T</td><td>F</td><td>T</td><td>T</td><td>T</td></tr><tr><td>N-ABLE</td><td>T</td><td>F</td><td>T</td><td>T</td><td>T</td></tr><tr><td>IRRIIS</td><td>T</td><td>T</td><td>T</td><td>T</td><td>T</td></tr></tbody></table>

critical infrastructure components. A network provides an intuitive representation of a critical infrastructure along with descriptions of topologies and flow patterns. The performance response of a critical infrastructure to hazards can also be analyzed by modeling component failures due to hazards and then simulating cascading failures within and across the critical infrastructure at the system level.
<table><caption>Table 2. Tool classification according to risk management purpose (continued).</caption><thead><tr><th>Tools</th><th>RI</th><th>RIA</th><th>RP</th><th>RMP</th><th>EE</th></tr></thead><tbody><tr><td>AIMS</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>FINSIM</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>PFNAM</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>FAIT</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>BIRR</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>QualNet</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>CASCADE</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>LS-DYNA</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>VISAC</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>FEPVA</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>Net-Centric</td><td>T</td><td>T</td><td>F</td><td>F</td><td>F</td></tr><tr><td>EpiSimS</td><td>T</td><td>T</td><td>F</td><td>F</td><td>T</td></tr><tr><td>Comm-Aspen</td><td>T</td><td>T</td><td>F</td><td>F</td><td>T</td></tr><tr><td>(AMTI) Loki</td><td>T</td><td>T</td><td>F</td><td>F</td><td>T</td></tr><tr><td>NG Analysis</td><td>T</td><td>T</td><td>F</td><td>F</td><td>T</td></tr><tr><td>PipelineNet</td><td>T</td><td>T</td><td>F</td><td>T</td><td>F</td></tr><tr><td>WISE</td><td>T</td><td>T</td><td>F</td><td>T</td><td>T</td></tr><tr><td>ATOM</td><td>T</td><td>T</td><td>F</td><td>T</td><td>T</td></tr><tr><td>CIMSuite</td><td>T</td><td>T</td><td>F</td><td>T</td><td>T</td></tr><tr><td>R-NAS</td><td>T</td><td>T</td><td>F</td><td>T</td><td>T</td></tr><tr><td>SIERRA</td><td>T</td><td>T</td><td>F</td><td>T</td><td>T</td></tr><tr><td>EMCAS</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>MBRA</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>FastTrans</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>AT/FP</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>TEVA</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>EURACOM</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>MSM</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>RAMCAP</td><td>T</td><td>T</td><td>T</td><td>F</td><td>F</td></tr><tr><td>CIPRSIM</td><td>T</td><td>T</td><td>T</td><td>F</td><td>T</td></tr><tr><td>LogiSims</td><td>T</td><td>T</td><td>T</td><td>T</td><td>F</td></tr><tr><td>NSRAM</td><td>T</td><td>T</td><td>T</td><td>T</td><td>T</td></tr><tr><td>Counteract</td><td>T</td><td>T</td><td>T</td><td>T</td><td>T</td></tr><tr><td>CIDA</td><td>F</td><td>F</td><td>T</td><td>T</td><td>T</td></tr></tbody></table>

■ **Other Approaches:** Other major approaches that model and analyze interdependent critical infrastructures are: (i) economic theory based approaches; (ii) cellular automata based approaches; (iii) mathematical equation based approaches; and (iv) real-time simulation based approaches.

Critical infrastructure modeling appears to be associated with simulation techniques and mathematical models. The following simulation techniques and
<table><caption>Table 3. Critical infrastructure sectors and their abbreviation prefixes.</caption><thead><tr><td>Sector</td><td>Prefix</td><td>Sector</td><td>Prefix</td></tr></thead><tbody><tr><td>Chemical</td><td>CH</td><td>Financial Services</td><td>FS</td></tr><tr><td>Commercial Facilities</td><td>CF</td><td>Food and Agriculture</td><td>FA</td></tr><tr><td>Communications</td><td>C</td><td>Government Facilities</td><td>GF</td></tr><tr><td>Critical Manufacturing</td><td>CM</td><td>Healthcare and Public Health</td><td>HPH</td></tr><tr><td>Dams</td><td>D</td><td>Information Technology</td><td>IT</td></tr><tr><td>Defense Industrial Base</td><td>DIB</td><td>Nuclear Reactor Materials/Waste</td><td>NRMW</td></tr><tr><td>Emergency Services</td><td>ES</td><td>Transportation Systems</td><td>TS</td></tr><tr><td>Energy</td><td>E</td><td>Water/Wastewater Systems</td><td>W</td></tr></tbody></table>

mathematical models were identified in this research: (i) continuous time-step simulation; (ii) discrete time-step simulation; (iii) Monte Carlo simulation; (iv) decision trees; (v) geographical information systems; and (vi) risk management.

The classification model of Ouyang [13] is used to categorize the critical infrastructure tools. Each tool is assigned to one category. Hybrid methodologies and tools (i.e., those engaging more than one approach) are categorized based on their dominant approach and are further classified based on the additional approaches used. Tools are also categorized according to supplementary techniques (e.g., continuous/discrete time-step simulation, geographical information system). In general, the most dominant approaches are agent and network based approaches.

## 2.3 Classification Summary

Table 3 shows the sixteen infrastructure sectors that are designated as critical by the U.S. Department of Homeland Security [12]; the table also shows the sector abbreviation prefixes that are used in the discussion below.

<table><caption>Table 4. Classification abbreviation prefixes.</caption><thead><tr><td>Purpose Functionality</td><td>Prefix</td><td>Modeling Technique</td><td>Prefix</td></tr></thead><tbody><tr><td>Risk Identification</td><td>RI</td><td>Continuous Time-Step</td><td>CS</td></tr><tr><td>Risk Impact Assessment</td><td>RIA</td><td>Decision Tree</td><td>DT</td></tr><tr><td>Risk Prioritization</td><td>RP</td><td>Discrete Time-Step</td><td>DS</td></tr><tr><td>Risk Mitigation Planning</td><td>RMP</td><td>Geographical Information System</td><td>GIS</td></tr><tr><td>Effectiveness Evaluation</td><td>EE</td><td>Monte Carlo Simulation</td><td>MC</td></tr></tbody></table>

Table 4 shows the risk purpose and modeling techniques along with their abbreviation prefixes.

Figure 1 summarizes the comparison aspects for the two dimensions of tool classification (i.e., purpose and technical approach). Tables 5 through 9 present the detailed taxonomy of the critical infrastructure tools examined in this study.
<figure><img src="image_2.png" /><figcaption>Figure 1. Comparison aspects for tool classification.</figcaption></figure>

## 3. Modeling Tool Comparison

It should be stated that most tools considered in this study were for in-house use only. As a result, it was not possible to have hands-on access to all the tools for evaluation purposes. Most of the information used in the following classification and comparison was obtained from technical reports and published articles.

### 3.1 Purpose Based Comparison

Comparing critical infrastructure tools based on the risk management stages in which they are used provides valuable insights. In all, 76% of the tools deal with risk identification (RI), 67% deal with risk impact assessment (RIA), 42% provide some sort of risk prioritization (RP), 41% are used for risk mitigation planning (RMP) and just 35% evaluate the effectiveness of countermeasures (EE).

Due to the complex data analysis requirements, it is difficult to create a single tool that supports all the risk management stages. Less than 5% of the
<table><caption>Table 5. Tool classification based on purpose and technical approach.</caption><thead><tr><td>Tool</td><td>Developer</td><td>Modeling</td><td>Purpose</td><td>Sector</td></tr></thead><tbody><tr><td>ActivitySim</td><td>Los Alamos National Laboratory</td><td>Agent Based, DS</td><td>RI</td><td>CF</td></tr><tr><td>AIMS</td><td>University of New Brunswick</td><td>Agent Based, CS</td><td>RI, RIA</td><td>E, C, WWS, IT</td></tr><tr><td>AIMSUN</td><td>Transport Simulation Systems</td><td>System Dynamics Based</td><td>RIA, RMP</td><td>TS</td></tr><tr><td>AMTI</td><td>Sandia National Laboratories</td><td>Network Based</td><td>RIA, EE</td><td>E, TS, FS</td></tr><tr><td>AT/FP</td><td>Naval Postgraduate School</td><td>Agent Based, GIS</td><td>RI, RIA, RP</td><td>DIB, ES, HPH, TS</td></tr><tr><td>Athena</td><td>California Institute of Technology</td><td>Network Based, DT</td><td>RIA</td><td>C, CF, CM, DIB, E, FS, IT, NRMW, WWS, TS</td></tr><tr><td>ATOM</td><td>Sandia/Los Alamos National Laboratories</td><td>Network Based</td><td>RI, RIA, RMP, EE</td><td>TS</td></tr><tr><td>BIRR</td><td>U.S. Dept. of Homeland Security</td><td>Methodology</td><td>RI, RIA</td><td>All Sectors</td></tr><tr><td>CAPRA</td><td>World Bank/ United Nations Project</td><td>System Dynamics Based</td><td>RIA, RP, RMP</td><td>WWS, HPH, TS, FS</td></tr><tr><td>CARVER-2</td><td>National Infrastructure Institute</td><td>Empirical</td><td>RI, RP</td><td>HPH</td></tr><tr><td>CASCADE</td><td>Det Norske Veritas</td><td>Empirical</td><td>RI, RIA</td><td>All Sectors</td></tr><tr><td>CI3</td><td>Argonne National Laboratory</td><td>Network Based, MC</td><td>RP, EE</td><td>C, CM, E, NRMW, WWS</td></tr><tr><td>CIDA</td><td>Athens University of Economics and Business</td><td>Empirical, Network Based</td><td>RP, RMP, EE</td><td>All Sectors</td></tr><tr><td>CIMS</td><td>Idaho National Laboratory</td><td>Agent Based, MC</td><td>RIA, RP, RMP, EE</td><td>C, CF, E, TS, HPH</td></tr></tbody></table>
<table><caption>Table 6. Tool classification based on purpose and technical approach (continued).</caption><thead><tr><td>Tool</td><td>Developer</td><td>Modeling</td><td>Purpose</td><td>Sector</td></tr></thead><tbody><tr><td>CIMSuite</td><td>Idaho National Laboratory</td><td>System Dynamics Based</td><td>RI, RIA, RMP, EE</td><td>All Sectors</td></tr><tr><td>CIP/DSS</td><td>Los Alamos/ Sandia/Argonne National Laboratories</td><td>System Dynamics Based</td><td>RI, RP, RMP EE</td><td>All Sectors</td></tr><tr><td>CIPDSS-DM</td><td>Los Alamos/ Sandia/Argonne National Laboratories</td><td>Empirical</td><td>RI, RP, RMP, EE</td><td>All Sectors</td></tr><tr><td>CIPMA</td><td>Government of Australia</td><td>System Dynamics Based</td><td>RMP, EE</td><td>C, E, IT, TS, FS</td></tr><tr><td>CISIA-Pro</td><td>University of Roma Tre</td><td>Agent Based, Relational Databases</td><td>RP, RMP</td><td>C, CM, E, WWS, C</td></tr><tr><td>Comm-Aspen</td><td>Sandia National Laboratories</td><td>Agent Based, MC</td><td>RI, RIA, EE</td><td>FS, C, E</td></tr><tr><td>Counteract</td><td>European Research Project</td><td>Methodology</td><td>RI, RIA, RP, RMP, EE</td><td>TS, E, HPH</td></tr><tr><td>DECRIS</td><td>SAMRISK Project</td><td>Methodology</td><td>RIA, RP, RMP, EE</td><td>E, WWS, TS, C, IT</td></tr><tr><td>EMCAS</td><td>Argonne National Laboratory/Adica Consulting</td><td>Agent Based, DS</td><td>RI, RIA, RP</td><td>E</td></tr><tr><td>EpiSimS</td><td>Los Alamos National Laboratory</td><td>Agent Based, GIS</td><td>RI, RIA, EE</td><td>HPH</td></tr><tr><td>EPRAM</td><td>NISAC</td><td>Cellular Automata</td><td>RIA, RP</td><td>E</td></tr><tr><td>EURACOM</td><td>EU/DG for Enterprise and Industry</td><td>Methodology</td><td>RI, RIA, RP</td><td>All Sectors</td></tr><tr><td>FAIT</td><td>Sandia National Laboratories</td><td>Network Based, GIS, Relational Databases</td><td>RI, RIA</td><td>E, ES, FS, TS, WWS</td></tr><tr><td>FastTrans</td><td>Los Alamos National Laboratory</td><td>Agent Based, DS</td><td>RI, RIA, RP</td><td>TS</td></tr><tr><td>FEPVA</td><td>Los Alamos National Laboratory</td><td>Network Based, GIS, Relational Databases</td><td>RI, RIA</td><td>E</td></tr></tbody></table>
<table><caption>Table 7. Tool classification based on purpose and technical approach (continued).</caption><thead><tr><td>Tool</td><td>Developer</td><td>Modeling</td><td>Purpose</td><td>Sector</td></tr></thead><tbody><tr><td>FINSIM</td><td>Los Alamos National Laboratory</td><td>Agent Based, CS</td><td>RI, RIA</td><td>FS, E, C</td></tr><tr><td>CBRSim (Fort Future)</td><td>U.S. Army Corps of Engineers</td><td>Agent Based, GIS</td><td>RI, RIA, RP, EE</td><td>C, CF, CM, E, ES, FS, HPH, IT, NRMW, TS, WWS</td></tr><tr><td>HCSim</td><td>Los Alamos National Laboratory</td><td>Agent Based, DS</td><td>RIA</td><td>D, HPH, NRMW</td></tr><tr><td>HYDRA</td><td>Los Alamos National Laboratory</td><td>Network Based, GIS, Relational Databases</td><td>RIA</td><td>HPH, FS</td></tr><tr><td>I2SIM</td><td>University of British Columbia</td><td>Agent Based, GIS</td><td>RI, RP, RMP</td><td>CF, TS, CM, HPH</td></tr><tr><td>IEISS</td><td>University of Virginia</td><td>Agent Based, GIS</td><td>RI, RP, RMP</td><td>E, TS, WWS</td></tr><tr><td>IIM</td><td>Sandia/Los Alamos National Laboratories</td><td>Economic Theory Based</td><td>RI, RP, RMP</td><td>FS, E, C, IT, TS, FS</td></tr><tr><td>IntePoint VU</td><td>IntePoint</td><td>Agent Based, GIS</td><td>RP</td><td>C, E, CF, TS</td></tr><tr><td>IRRIIS</td><td>IRRIIS Project</td><td>Network Based, DS</td><td>RI, RIA, RP, RMP, EE</td><td>All Sectors</td></tr><tr><td>Knowledge Management Visualization</td><td>Carnegie Mellon University</td><td>Network Based, Rating Matrices</td><td>RMP, EE</td><td>E, TS, WWS</td></tr><tr><td>LogiSims</td><td>Los Alamos National Laboratory</td><td>Empirical</td><td>RI, RIA, RP, RMP</td><td>HPH, E</td></tr><tr><td>LS-DYNA</td><td>Livermore Software Technology</td><td>System Dynamics Based</td><td>RI, RIA</td><td>CM, D, TS</td></tr><tr><td>MBRA</td><td>Naval Postgraduate School</td><td>Network Based, FT</td><td>RI, RIA, RP</td><td>FS, TS, E</td></tr><tr><td>MIITS</td><td>Los Alamos National Laboratory</td><td>Agent Based, DS</td><td>RI</td><td>C, IT</td></tr><tr><td>MIN</td><td>Purdue University</td><td>Agent Based, CS</td><td>RI</td><td>CF, TS</td></tr></tbody></table>
<table><caption>Table 8. Tool classification based on purpose and technical approach (continued).</caption><thead><tr><td>Tool</td><td>Developer</td><td>Modeling</td><td>Purpose</td><td>Sector</td></tr></thead><tbody><tr><td>MSM</td><td>Massachusetts Institute of Technology</td><td>Network Based, DT</td><td>RI, RIA, RP</td><td>E, WWS, HPH</td></tr><tr><td>Multi-Graph Vulnerability Analysis</td><td>Network Based, DS</td><td>RIA, RP</td><td>E, W, CH</td><td>All Sectors</td></tr><tr><td>MUNICIPAL</td><td>Rensselaer Polytechnic Institute</td><td>Network Based, GIS, Relational Databases</td><td>RI, RP</td><td>E, C, IT, TS</td></tr><tr><td>N-ABLE</td><td>Sandia/Los Alamos National Laboratories</td><td>Agent Based, DS</td><td>RI, RP, RMP, EE</td><td>E, FS, TS</td></tr><tr><td>NEMO</td><td>Sparta</td><td>Network Based, GIS, Relational Databases</td><td>RP, RMP, EE</td><td>C, E, WWS, TS, DIB</td></tr><tr><td>Network-Centric GIS</td><td>York University</td><td>Network Based, GIS, Relational Databases</td><td>RI, RIA</td><td>TS, WWS, ES</td></tr><tr><td>Nexus Fusion Framework</td><td>BT Pervasive ICT Research Centre</td><td>Agent Based, GIS</td><td>RIA</td><td>E, C, TS, DIB</td></tr><tr><td>NGAT</td><td>Argonne National Laboratory</td><td>Agent Based, Relational Databases</td><td>RI, RIA, EE</td><td>E</td></tr><tr><td>NSRAM</td><td>James Madison University</td><td>Agent Based, MC</td><td>RI, RIA, RP, RMP, EE</td><td>E, IT, C</td></tr><tr><td>PC Tides</td><td>Neptune Navigation Software</td><td>Mathematical Equations</td><td>RI</td><td>HPH, ES</td></tr><tr><td>PFNAM</td><td>Argonne National Laboratory</td><td>Network Based</td><td>RI, RIA</td><td>E, TS</td></tr><tr><td>PipelineNet</td><td>Federal Emergency Management Agency/ EPA/TSWG</td><td>Network Based, GIS, Relational Databases</td><td>RI, RIA, RMP</td><td>WWS, HPH</td></tr><tr><td>QualNet</td><td>Scalable Network Technologies</td><td>Network Based, DS</td><td>RI, RIA</td><td>C</td></tr><tr><td>RAMCAP-Plus</td><td>ASME Innovative Technologies Institute</td><td>Mathematical Equations</td><td>RI, RIA, RP</td><td>NRMW, CH, D, W</td></tr></tbody></table>
<table><caption>Table 9. Tool classification based on purpose and technical approach (continued).</caption><thead><tr><td>Tool</td><td>Developer</td><td>Modeling</td><td>Purpose</td><td>Sector</td></tr></thead><tbody><tr><td>Restore</td><td>Argonne National Laboratory</td><td>Empirical</td><td>RMP</td><td>CM, E</td></tr><tr><td>R-NAS</td><td>Sandia/Los Alamos National Laboratories</td><td>Network Based</td><td>RI, RIA, RMP, EE</td><td>FA, TS</td></tr><tr><td>RTDS</td><td>Idaho National Laboratory</td><td>Real-Time Simulation</td><td>RI</td><td>E</td></tr><tr><td>SessionSim</td><td>Los Alamos National Laboratory</td><td>Agent Based, DS</td><td>RI</td><td>C</td></tr><tr><td>SIERRA</td><td>Sandia/Los Alamos National Laboratories</td><td>Network Based</td><td>RI, RIA, RMP, EE</td><td>TS</td></tr><tr><td>TEVA</td><td>EPA National Homeland Security Research Center</td><td>Empirical</td><td>RI, RIA, RP</td><td>HPH, WWS</td></tr><tr><td>TRAGIS</td><td>Oak Ridge National Laboratory</td><td>Network Based, GIS, Relational Databases</td><td>RI</td><td>TS, WWS</td></tr><tr><td>TRANSIMS</td><td>Los Alamos National Laboratory</td><td>Agent Based, DS</td><td>EE</td><td>TS, CF</td></tr><tr><td>UPMoST</td><td>NISAC</td><td>Methodology</td><td>RI</td><td>CF</td></tr><tr><td>VISAC</td><td>Oak Ridge National Laboratory</td><td>System Dynamics Based</td><td>RI, RIA</td><td>CH, NRMW</td></tr><tr><td>WISE</td><td>Los Alamos National Laboratory</td><td>Agent Based, CS</td><td>RI, RIA, RMP, EE</td><td>CS, TS, WWS, HPH</td></tr></tbody></table>

tools cover five stages and 17% cover four stages. Nearly 80% of the tools cover three or fewer stages.

Methodologies such as Counteract, IRRIIS, EURACOM and BIRR and sophisticated tools such as NSRAM cover all five stages of risk analysis. NSRAM is a complex network modeling and simulation tool, but it only covers three sectors (E, IT, C). A limited number of tools (5%) cover more than four risk analysis stages and more than ten sectors. Once again, most of them incorporate broad methodologies or are advanced tools developed in the United States such as CIP/DSS, CIPDSS-DM, CBRSin (Fort Future) and CIMSuite.
CIP/DSS [2], for example, is a complete risk assessment methodology that
can be applied to all sectors. Developed under the National Infrastructure
Protection Plan, the methodology uses system dynamics with continuous time-
step simulation. Like CIP/DSS, the CIPDSS-DM tool is designed to help ana-
lysts and policy makers evaluate and select optimal risk mitigation strategies.
CIP/DSS and CIPDSS-DM are a robust combination. As a matter of fact, the
ability of CIPDSS-DM to facilitate the selection of the most effective mitigation
strategies is helpful in restricting the impact of failures and reducing economic
losses.

CBRSim (Fort Future) [17] was developed by the U.S. Army Corps of Engi-
neers. It is an agent based tool with geographical information system support
that runs multiple dynamic simulations to evaluate a set of alternative scenar-
ios.

CIMSuite [4], CIDA (Critical Infrastructure Dependency Analysis tool) [19]
and Athena [3, 14, 22] can depict cascading effects in all sectors and for all
infrastructure relationships. CIMSuite is a system dynamics based tool that
implement a variety of probabilistic simulations and covers four risk manage-
ment stages (RI, RIA, RMP, EE). CIDA is a hybrid (empirical and network
based) tool that employs several growth models and fuzzy logic to consider the
effects of dependencies; it covers the last three risk management stages (RP,
RMP, EE). Athena only supports the risk impact assessment (RIA) stage and
can be used to model a number of different risk events in various sectors. Of
all the tools mentioned above, CIDA is the only one that is publicly available.

With regard to the risk identification (RI) and risk prioritization (RP) stages, CARVER-2 [5, 15] and MUNICIPAL [8, 22] appear to be effective at analyzing multiple critical infrastructure components in order to identify and prioritize them according to the severity of failure impacts, albeit using technical approaches. CARVER-2 uses rating matrices to generate hazard maps whereas MUNICIPAL relies on a relational database that maintains network asset inventories.

IEISS [10, 22] is well suited to risk mitigation planning (RMP) in the energy,
water and wastewater systems, nuclear reactor materials and waste sectors. It
simulates dynamic behavior, including the effects of system interdependencies.
IIM [22] is a continuous input-output model that uses analytical models to de-
termine the impacts of attack on infrastructures and their cascading effects in all
the interconnected infrastructures [10]; like IIM, it uses continuous simulation
and is employed in the energy and water and wastewater sectors. Both IEISS
and IIM are designed for risk identification, risk prioritization and risk miti-
gation planning. IIM has wider sector coverage compared with IEIIS. IEISS
uses a multi-agent system with Monte Carlo simulation as a supplementary
technique while IIM uses rating matrices and network theory with continuous
time-step simulation.
<table><caption>Table 10. Number of sectors per modeling approach.</caption><thead><tr><th>Modeling Approach</th><th>1 to 3 Sectors</th><th>4 to 6 Sectors</th><th>7 or More Sectors</th></tr></thead><tbody><tr><td>Agent Based</td><td>16</td><td>7</td><td>2</td></tr><tr><td>Network Based</td><td>13</td><td>4</td><td>2</td></tr><tr><td>Empirical</td><td>5</td><td>0</td><td>2</td></tr><tr><td>System Dynamics Based</td><td>4</td><td>3</td><td>2</td></tr><tr><td>Other</td><td>3</td><td>3</td><td>2</td></tr></tbody></table>

## 3.2 Technical Approach Based Comparison

Comparison of the modeling approaches used by the tools against the risk management stages they cover reveals that empirical tools mostly cover the early risk management stages (RI, RP). Agent based tools are mostly popular for RI while network based approaches usually cover three risk stages (RI, RIA, RMP). System dynamics and network based approaches are mainly used by the few tools that cover four risk management stages. Even fewer (only three) tools cover all five risk management stages, but there is no discernible trend with regard to the specific approaches that are used.

Critical infrastructure modeling tools mainly use mathematical models and simulation techniques combined with the above supplementary computational techniques. Table 10 shows the number of sectors per modeling approach. The majority of the agent and network based tools support up to three critical infrastructure sectors. Most tools that cover one or two sectors are geared for the energy, transportation and/or public health sectors. Multi-agent systems and system dynamics techniques appear to combine well with computational methods such as Monte Carlo simulation, discrete time-step simulation and continuous time-step simulation and are most suitable for obtaining optimal solutions [14, 22]. Agent based simulations combine well with geographical information systems to predict the performance of infrastructures during emergencies in specific geographical areas.

Relational databases are currently the predominant choice for storing data and records pertaining to critical infrastructure system properties. Relational databases are widely used in asset identification and can be combined with event monitoring, real-time recording, geographical information systems, error logs, access control, risk components, etc.

Rating matrices are useful for assessing risk severity and event occurrence. The modeling techniques include data processing in risk analysis and risk mapping to support decision making. Rating matrices are popular because they tend to combine well with every computational technique and also facilitate sensitivity analysis. Additionally, they are appropriate for data classification using geographical information systems and for monitoring events.

Graph theory is used to identify the most critical components or nodes in infrastructures using graphical models that depict relations and properties of
system components in a precise manner. The complexity of network theory models, however, can increase exponentially for large infrastructures.

The majority of the tools – 39 out of 69 tools – are dedicated to specific sectors (or one or two similar sectors), with the energy and transportation sectors being the most popular. NGAT, RTDS, FEPVA and EPRAM [6, 9, 16, 18] are dedicated to the energy sector. Some tools, namely ATOM, SIERRA, FastTrans [11, 21] and AIMSUN [1] are designed for the transportation sector. ATOM and SIERRA [11] cover more than four risk management stages and both tools incorporate network based method approaches. FastTrans is an agent based tool that covers three risk management stages (RI, RIA, RP).

SimCore is a meta-tool that combines multi-agent modeling with discrete time-step simulation. It utilizes a collection of simulation applications (ActivitySim, DemandSim, SessionSim, FastTrans and MIITS-NetSim), all of which engage the SimCore modeling paradigm as a library for building large-scale distributed memory discrete event simulations.

## 4. Conclusions

The primary goal of critical infrastructure protection tools is to help risk assessors and decision makers evaluate risk. The research has identified, classified and compared a number of tools that have been developed for analyzing critical infrastructures and supporting risk management. Emphasis has been placed on comparing similar tools based on their purpose and modeling approach.

The classification and comparison of tools based on the risk assessment stages in which they are used provide a valuable perspective. The analysis identifies the models used in each stage of risk assessment and mitigation, and reveals that most tools focus on the risk identification and risk impact assessment stages.

Classifying technical modeling approaches also provides useful information – most of the tools utilize multi-agent systems coupled with system dynamics, network theory and/or empirical approaches. The analysis reveals that multi-agent and network based modeling techniques are most commonly used in critical infrastructure protection tools.

As expected, no critical infrastructure tool is a “jack of all trades.” Indeed, the vast majority of tools specialize in specific parts of the risk management process.

It is important to note that the taxonomy is incomplete because many tools have been built for in-house use and few details are available about them. Additionally, many tools are unsupported, some of them are left unsupported as soon as one year after their development.

Future research should focus on tools geared for the later stages of risk assessment (RMP, EE) and tools that perform qualitative rather than quantitative analyses. Two approaches are suggested for developing new tools with the most utility – one approach is to create holistic meta-tools that can model all critical infrastructure sectors; the other is to create tools that focus on specific problems in specific sectors.
References

[1] J. Barcelo and J. Casas, Dynamic network simulation with AIMSUN, in *Simulation Approaches in Transportation Analysis: Recent Advances and Challenges*, R. Kitamura and M. Kuwahara (Eds.), Springer, New York, pp. 57–98, 2005.

[2] B. Bush, L. Dauelsberg, R. LeClaire, D. Powell, S. DeLand and M. Samsa, Critical Infrastructure Protection Decision Support System (CIP/DSS) Project Overview, LA-UR-05-1870, Los Alamos National Laboratory, Los Alamos, New Mexico, 2005.

[3] R. Chamberlain, W. Duquette, J. Provenzano, T. Brunzie and B. Jordan, Athena, *NASA Tech Briefs*, p. 12, December 2011.

[4] D. Dudenhoeffer, CIMSuite: Critical Infrastructure Modeling, Idaho National Laboratory, Idaho Falls, Idaho (www4vip.inl.gov/factsheets/docs/cimsuite.pdf), 2007.

[5] G. Giannopoulos, R. Filippini and M. Schimmer, Risk Assessment Methodologies for Critical Infrastructure Protection, Part 1: A State of the Art, JRC 70046, European Commission Joint Research Centre, Ispra, Italy, 2012.

[6] J. Kavicky, M. Jusko, B. Craig, E. Portante and S. Folga, A natural gas modeling framework for conducting infrastructure analysis studies, *Proceedings of the Winter Simulation Conference*, pp. 2891–2901, 2009.

[7] E. Lee, J. Mitchell and W. Wallace, Network flow approaches for analyzing and managing disruptions to interdependent infrastructure systems, *Wiley Handbook of Science and Technology for Homeland Security*, vol. 2(5), pp. 1–9, 2009.

[8] E. Lee, W. Wallace, J. Mitchell and D. Mendonca, Decision technologies for protection of critical infrastructures, *Proceedings of the Working Together: R&D Partnerships in Homeland Security*, 2005.

[9] S. McBride and G. West, Real Time Digital Simulator, Idaho National Laboratory, Idaho Falls, Idaho (www4vip.inl.gov/research/real-time-digital-simulator/d/real-time-digital-simulator.pdf), 2014.

[10] C. McLean, Y. Lee, S. Jain and C. Hutchings, Modeling and Simulation of Critical Infrastructure Systems for Homeland Security Applications, NIS-TIR 7785, National Institute of Standards and Technology, Gaithersburg, Maryland, 2011.

[11] National Infrastructure Simulation and Analysis Center, Network Optimization Models (RNAS and ATOM), Sandia National Laboratories, Albuquerque, New Mexico (www.sandia.gov/nisac/capabilities/network-optimization-models), 2012.

[12] B. Obama, Presidential Policy Directive – Critical Infrastructure Security and Resilience, PPD-21, The White House, Washington, DC, 2013.
[13] M. Ouyang, Review on modeling and simulation of interdependent critical infrastructure systems, *Reliability Engineering and System Safety*, vol. 121, pp. 43–60, 2014.

[14] P. Pederson, D. Dudenhoeffer, S. Hartley and M. Permann, Critical In-frastructure Interdependency Modeling: A Survey of U.S. and Interna-tional Research, INL/EXT-06-11464, Idaho National Laboratory, Idaho Falls, Idaho, 2006.

[15] R. Peimer, Target analysis, *Emergency Management* (www.emergencymgmt.com/safety/Target-Analysis.html), November 27, 2006.

[16] C. Shih, C. Scown, L. Soibelman, H. Matthews, J. Garrett, K. Dodrill and S. McSurdy, Decision support framework for electricity production vulner-ability assessment, in *Computing in Civil Engineering*, L. Soibelman and B. Akinci (Eds.), American Society of Civil Engineers, Reston, Virginia, pp. 427–434, 2007.

[17] K. Simunich, T. Perkins, D. Bailey, D. Brown and P. Sydelko, Demonstration of CBR Modeling and Simulation Tool (CBRSim) Capabilities, ERDC/CERL TR-09-39, Engineer Research and Development Center, U.S. Army Corps of Engineers, Champaign, Illinois, 2009.

[18] K. Stamber, T. Brown, D. Pless and A. Berscheid, Modeling and simulation for homeland security, *Proceedings of the Twentieth International Congress on Modeling and Simulation*, pp. 1103–1109, 2013.

[19] G. Stergiopoulos, P. Kotzanikolaou, M. Theocharidou, G. Lykou and D. Gritzalis, Time-based critical infrastructure dependency analysis for large-scale and cross-sectoral failures, *International Journal of Critical Infrastructure Protection*, vol. 12, pp. 46–60, 2016.

[20] U.S. Department of Homeland Security, National Infrastructure Protection Plan, Washington, DC, 2006.

[21] S. Thulasidasan, S. Kasiviswanathan, S. Eidenbenz, E. Galli, S. Mniszewski and P. Romero, Designing systems for large-scale, discrete-event simulations: Experiences with the FastTrans parallel microsimulator, *Proceedings of the International Conference on High Performance Computing*, pp. 428–437, 2009.

[22] J. Yusta, G. Correa and R. Lacal-Arantegui, Methodologies and applications for critical infrastructure protection: State-of-the-art, *Energy Policy*, vol. 39(10), pp. 6100–6119, 2011.