# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 1 Introduction
### Related Work
In this paper we resort to DBN, a BN extension having a discrete temporal dimension. DBNs have already been applied in the domain of critical infrastructure security, for example, in [30] where a DBN is used for privacy violation detection; that model is actually simpler than the case study examined in our paper. In [31] the DBN was built according to AG, as is done in our paper, and a way to compute temporal scores from CVSS is investigated; such scores are necessary as initial probability parameters of the DBN. In this paper, besides CVSS, we resort to MITRE repository and ICS-CERT, we consider a wider case study, and both predictive and diagnostic analyses are performed. Decision networks (DN) are another BN extension, characterised by the addition of decision and value nodes, but without a temporal dimension. In [32] DNs are exploited to evaluate the security of a SCADA architecture; decision and value nodes are exploited to model countermeasures and their effects, respectively. In this paper we do not yet consider defence mechanisms, but this can be taken into account in the future work, together with the possibility to apply dynamic decision networks (DDN) [2]; i.e., DNs characterised by a temporal dimension, as in the case of DBNs. All such approaches start from AT or AG models to show how BNs/DBNs/DNs can be derived, stressing the evidence-based analysis allowed by these models. In our approach we follow the same model design procedure, but we adopt the event classification defined by MITRE ATT&CK (tactics, techniques, analytics) in the AG construction and in the definition of quantitative security indices (Sections 2 and 3). One of the key problems during the model construction is the quantification in terms of probability of the basic events in the model. This task can be rather difficult in the context of critical infrastructures due to the difficulty to access historical, realistic, or confidential data. In these cases, experts can be involved in the estimation of the parameters, or events can be classified according to a probability scale [22]; for instance, attack likelihood levels _trivial-moderate-difficult-unlikely_ may correspond to 0.9, 0.6, 0.3, 0.1. Another solution can be the execution of attacks in a laboratory setting, to collect statistics [33]. A further possibility is to exploit the information made available by existing sharing platforms, and in our approach we set the DBN initial parameters according to the data collected from available sources (Section 2). Historical data may be already encoded in software tools for security assessment, as in _securiCAD_[34] which allows the user to build the architecture of ICT infrastructures, from which the AG is automatically generated according to a predefined library of potential attack steps on the assets. The AG is implemented in the form of Bayesian-like networks to be evaluated by means of Monte Carlo simulation, providing the success rate as a function of the time to compromise, for every step and asset. Despite this advantage, the built-in attack steps and their logical dependencies make it difficult to validate the underlying model and the results, limited to the success rate. In our approach, we focus on more specialised attack scenarios, including both IT and OT assets. Our DBN model is based on the ATT&CK dataset and nomenclature; it exploits evidence-based analysis (instead of simulation); it distinguishes between predictive and diagnostic analysis; and it computes a set of measures (Section 3), oriented toward attack detection. Additionally, some other works investigate tools for the automated risk identification based on systematic risk assessment methodologies. For example, the blade risk manager tool [35] allows one to evaluate the compliance with reference to cyber security standards and guidelines. The tool combines the architecture information with a cyber security knowledge base containing information related to threats, undesired events, attacks and vulnerability patterns, and security controls.