# Threat Modelling and Beyond-Novel Approaches to Cyber Secure the Smart Energy System
## 7 Risk Analysis Using Formal Methods
### UC2: Smart Home and Smart Meter Hijacking
#### 7.3.2 Results  
Figure 10 presents the results-risk exposure scores for the modeled system and attack properties.  
Table 13 presents the resulting values of the risk exposure score.  
Similarly to UC1, the presented analysis considers cases where the number of exploited vulnerabilities is in the range one to five (\(cost=(1:5)\)).  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Attack** & \(cost=1\) & \(cost=2\) & \(cost=3\) & \(cost=4\) & \(cost=5\) \\ \hline
2.1 Fraud & 0.0000 & 0.0000 & 0.2287 & 0.4098 & 0.4851 \\
2.2 Decrease bill & 0.0000 & 0.4012 & 0.5390 & 0.6467 & 0.6467 \\
2.3 Increase bill & 0.0000 & 0.4012 & 0.6467 & 0.6467 & 0.6467 \\
2.4 Increase bill, no alarm & 0.0000 & 0.3363 & 0.5063 & 0.5063 & 0.5063 \\ \hline \hline \end{tabular}
\end{table}
Table 13: Smart home and smart meter hijacking use case risk exposure scores.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Vulnerability** & **Associated Threat** & **Threat Id** & **Expl. Prob.** \\ \hline IHD–SM link & Link jammed: denied transmission & 903 & 0.65 \\ SM1, SM2 (reading) & Tailored context/incorrect reading & 880 & 0.68 \\ C (reading SM1/SM2) & Tailored context/incorrect reading & 857 & 0.57 \\ G (gain control) & Tailored context/incorrect reading & 1111 & 0.59 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Vulnerabilities, exploitation probabilities and associated threats for UC2.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Attack** & **Impact** & **Attack Properties** \\ \hline Attack scenario 2.1: Fraud & High & The user takes control over their and neighbor’s smart meter or \\  & & concentrator, decreases their own power consumption, increases their \\  & & neighbor’s power consumption, responsible actors are not alerted \\ Attack scenario 2.2: & Medium & The attacker takes control over their own smart meter or concentrator, \\  & & and decreases the power consumption \\  & & The attacker takes control over the user’s smart meter or concentrator, \\ Increase bill & & and increases the power consumption \\ Attack scenario 2.4: & Medium & The attacker takes control over the user’s smart meter or concentrator, \\ Increase bill, no alarm & & increases the power consumption, the user is not alerted \\ \hline \hline \end{tabular}
\end{table}
Table 12: Modeled attacks, their impact and properties for UC2.  
The results show that the attack 2.1 (fraud) has the least likelihood to be successful, under given assumptions. Attack 2.1 requires the exploitation of at least three vulnerabilities, while the other three scenarios considered in this use case can be conducted by exploiting only two vulnerabilities. Attack 2.1 requires the exploitation of at least five vulnerabilities for maximum likelihood, attack 2.2 requires exploitation of three, while attacks 2.3 and 2.4 only require the exploitation of two vulnerabilities for the maximum likelihood. It has to be emphasized that although both attacks 2.3 (or 2.2) and 2.4 require the exploitation of a minimum of two vulnerabilities to be successful, the risk exposure scores of 2.4 are lower because this attack requires the exploitation of parts of the system that have a higher security level (reflected in the lower exploitation probability).