# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## Abbreviations
### Predictions  
The experiments testing the prediction capabilities of the model assume an adversarial behaviour analogous to the experiment of Figure 8: at time \(t=15\) the attacker carries out a local MITM attack at plant controller and at time \(t=25\) spoofs DER reporting messages. In this setting, the security analyst/system has a view of evidence up to the prediction time and must forecast adversarial moves based on this data. We carry out three experiments with predictions made at times \(t_{p}=10\), \(t_{p}=20\) and \(t_{p}=30\), for all successive instants. When the prediction is made at time \(t_{p}=10\), no analytic has raised an alert, and therefore up to that moment, monitoring enables to conclude that no attack was in progress. This is evidenced in Figure 10 by the fact that the probability of occurrence of all events monitored is negligible. After \(t_{p}=10\) the analyst/system has no evidence to depend upon, since we are assuming that \(t_{p}=10\) is the present and therefore all instants \(t>10\) lie the future. Then all that can be said about probabilities of future attack depends on the _a priori_ probabilities of techniques (that were computed as in Section 2.4). In Figure 11 we plotted the probabilities of the same events, in the setting in which no monitoring system is deployed into the DER architecture (the same experiment reported in Figure 6 but showing different events). It can be seen that the slopes of all curves after \(t_{p}=10\) in Figure 10 are identical to the slopes in Figure 11, since the security analyst/system has no monitoring information in the future: the fact that there have been no attacks up \(t_{p}=10\) cannot be used to infer security of the system afterwards, or equivalently stated, the analyst cannot relax simply because the system has not been attacked so far. Figure 12 assumes that the security analyst/system is monitoring the infrastructure at time \(20\) (prediction at time \(t_{p}=20\)). Before \(t_{p}=20\) more information has been collected from the monitoring system. In particular the analytics monitoring a local MITM attack at plant controller have raised an alarm at time \(15\). Then, at time \(t_{p}=20\) it is already known that the attacker has taken that first step. This knowledge has an influence on the prediction, as will be discussed in detail later, which shows the significance of the model, since it gives the analyst/system a tool to forecast adversarial moves based on previous observations. Precisely, it can be seen that the probability that the attacker manages to make the system unstable is significantly higher at time \(t=30\), say, than it was for the prediction at time \(t_{p}=10\) (\(0.3680\) as opposed to \(0.2425\)), and increases faster: for instance if we compare the probabilities predicted for \(30\) time units in the future (\(t_{p}+30\)), for the prediction made at \(t_{p}=10\) it is less than \(0.4\) at time \(t_{p}+30=40\), and over \(0.6\) at time \(t_{p}+30=50\) for the prediction made at \(t_{p}=20\). The probability that the adversarial activity will be completely successful is anyway not very high, since no other attack steps have been observed. Additionally, notice that the slopes of probabilities that the attacker will try to manipulate the DER control (_Manipulation of Control_ ) or that the system will correctly react on wrong data (_correct reaction to wrong data_) are noticeably steeper in the prediction at time \(t_{p}=20\) than they were in the prediction at \(t_{p}=10\): this is due to the fact that both techniques have local MITM at plant controller as a precondition, and in the case \(t_{p}=20\) it is known that the precondition has occurred. Finally, Figure 13 shows the results of a prediction suppose the security analyst/system at \(t_{p}=30\). Up to \(t=30\) all evidence from the monitoring system are available, and therefore the information is the same as in the monitoring task of Figure 7. After that, the analyst/system no longer has monitoring evidence, and therefore must resort to a prediction.