# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 2 Methodology  
Our goal is the development of an analysis tool with a strong practical drive to provide guidance to security experts in assessment and planning of security measures, and in monitoring and detection of adversarial behaviours.  
We base our methodology on (non exhaustive) real world data provided by the MITRE Corporation in its IT and ICS ATT&CK frameworks. The knowledge bases are compiled using publicly available data on attacks. Data are collected manually analysing reports written in English; attack processes are split into basic steps (called _techniques_) which are then classified according to the general goal they aim to achieve (the _tactic_). Although the MITRE knowledge base is not complete, the ATT&CK corpus of data is invaluable for the head start of a diagnostic and predictive analysis of cyber systems; this in turn will give a better understanding of the context and guide the collection of further data, which, later integrated in the methodology, will lead to a more specific and informed approach.  
We model attack processes as sequences of techniques organised as paths of an attack graph (AG)--a directed multigraph in which nodes represent states (capabilities that an attacker has attained), and edges are attack steps (techniques). We envisage an AG modelling the entire ATT&CK matrices extended to and specialised for the energy control environment, enriched with the causal relationships that are not explicitly expressed in the matrix. Such a graph would provide a complete model of possible adversarial behaviours. This model is static; it represents prerequisites for the application of a technique and intermediate goals achieved by attackers, but does not take into account the evolution of the process in time. It is, in our approach, a first modelling step that is then instantiated, and completed with temporal capabilities, in a DBN. The DBN is a probabilistic graphical model where a directed acyclic graph is used to connect discrete random variables (nodes) to depict their dependency relation (as in BNs), with the additional concept of _time slice_ that models a specific time instance. All independent nodes are parametrised with a priori probabilities that describe the likelihood of occurrence of the event they model, and all dependencies are parametrised by conditional probabilities, enabling the analysis of the evolution of the state of each single node over time. For example, if the attacker engages in exploiting a technique at a certain instant in time, this may result in the compromise of some part of the system at a subsequent instant. To model aspects related to detection, we include in our DBN also _security analytics_ from the MITRE CAR: security analytics describe events whose observation is significant from a security perspective. We propose some energy sector-specific analytics that are based on application knowledge and related to the selected DER control scenario. We define the DBN model in Section 2.4 and in Section 3.1 we explain how it can be used for giving insight into the security posture of a given OT architecture, offering support for assessment, detection, and forecasting.