# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 3 Case Study Analysis  
### Inference Tasks  
DBNs make possible several kinds of analyses, using different types of inference algorithms. In particular, let \(X^{t}\) be variables at time \(t\) representing either states of the system or the fact that a technique has been exploited by the attacker. Analytics provide a stream of observations over time, which is formally denoted as \(y_{a:b}\) when limited between time point \(a\) and time point \(b\), \(a\leq b\), and they consist of a set of instantiated variables \(Y^{j}_{i}\) where \(i\) denotes the specific analytic and \(j\) (\(a\leq j\leq b\)) the time instance. The following tasks can be performed on a DBN:  
* **Monitoring** can support the security analyst or system in online diagnosis and early detection, providing a means to compute in real time the chance that an attack attempt is taking place, according to the observations gathered by the analytics. It is enabled by the **filtering** approach that consists of computing \(P(X^{t}|y_{1:t})\), i.e., the probability of event \(X\) at time \(t\), given the observations \(y_{j}\) at all instants up to \(t\). This means tracking the probability of the system states, taking into  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Entry** & _localMITM_ & \((t-1)\) & \((t)\) & **prob.** \\ \hline
2 & 0 & 0 & 1 & 0 \\ \hline
3 & 0 & 1 & 0 & 1 \\
4 & 0 & 1 & 1 & 0 \\ \hline
5 & 1 & 0 & 0 & 0.982844 \\
6 & 1 & 0 & 1 & 0.017156 \\ \hline
7 & 1 & 1 & 0 & 0 \\
8 & 1 & 1 & 1 & 1 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Conditional probability table of the variable _SpoofRepMsg_.  
account the stream of observations (see Figure 5a). When this probability value exceeds a given threshold, the analyst/system can infer that an attack attempt is in progress.
* **Prediction** can support the analyst/system in identifying, on the basis of evidence obtained from the analytics, the subset of techniques that the attacker will more likely exploit in the future, thereby enabling the setup of defensive actions. The filtering approach is used in this case for computing \(P(X^{t+h}|y_{1:t})\) for some horizon \(h>0\) (see Figure 5b), i.e., predicting a future state, taking into consideration evidence gathered up to now (filtering is a special case of prediction with \(h=0\)).
* **Offline diagnosis** allows determining the probable causes of security events, either online, using filtering, or offline with **smoothing**. The latter consists of computing \(P(X^{t-\tau}|y_{1:t})\) for some \(\tau<t\), i.e., estimating what happened \(\tau\) steps in the past given all the evidence (observations) up to now (see Figure 5c). Therefore, while filtering enables diagnosis in real time, smoothing makes it possible to conduct a deeper _post-incident_ investigation based on evidence collected by the monitoring system during the DER operation.  
In this paper we focus on the monitoring (and online diagnosis) and prediction tasks. Different algorithms, either exact (i.e., computing exact probability values) or approximate, can be exploited in order to implement the above tasks. In this paper, to design and evaluate the DBN, we use the _Bayes Net Toolbox for Matlab_ (BNT) [44], and in particular, we resort to the _junction tree_ (JT) [2] algorithm for the exact inference of the DBN. All the following experiments were performed on a laptop with an Intel Core i7-8750h CPU at 2.20 GHz x 12 and 16 GB RAM with completion times of a few minutes.