# A Comprehensive Analysis of Smart Grid Systems against Cyber-Physical Attacks
## 5 Bayesian Attack Graph for the Smart Grid Cyber Domain
### Likelihood of Compromise  
We use the CVSS [39] to compute the PoC for a set of vulnerabilities for a cyber system. CVSS consists of three scores: base, temporal and environmental. The base score consists of properties that provide information about the exploitability of a vulnerability: Attack Vector (AV), Attack Complexity (AC), User Interaction (UI), required or not, Privileged Required (PR) or not, confidentiality, integrity and availability levels. We compute the probability of exploiting the vulnerability by considering the exploitability score and impact as described in the CVSS specification. We use the online CVSS calculator to compute the base score (probabilities) that uses Equation (1) to compute the exploitability sub-score. We take the base score and divide by 10 to compute the probability since all scores are out of 10.  
\[\text{P(Exploitability Sub-Score)}=(8.22\text{ * AV * AC * UI * PR)}/10 \tag{1}\]  
Table 1 represents the CVSS PoC corresponding to all the vulnerabilities we have chosen for the test network. For instance, ECC has a buffer overflow vulnerability. The value for parameters for buffer overflow are: AV: local; AC: low; PR: no; UI: required; scope: unchanged; confidentiality: high; integrity: high; and availability: high. The value for these parameters according to CVSS is 7.8. We divide this score by 10 to get the PoC for buffer overflow that is 0.78. Similarly, we compute the probabilities for other vulnerabilities (Table 1). The value of parameters for each vulnerability is stored by engineers into their database and should be updated via CVSS website [39].  
When multiple exploits are present in a system, we compute the Local Conditional Probability Distribution (LCPD), using the following equations: P (Y! Parents(Y)) = \(\Pi_{1}\text{N}\)P(Exploiti) when AND operation and P (Y! Parents(Y)) = \(1-\Pi_{1}\text{N}\) (\(1-\text{P(Exploiti)}\)) when OR operation. LCPD of a system X depends on the exploits and its parents Y. For instance, MDM has three parents that are connected to different components of the MDM and have access to different exploits. We create three columns  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Vulnerabilities** & **Probability of Compromise** \\ \hline Remote code execution & 0.84 \\ Buffer Overflow & 0.78 \\ Denial of Service & 0.74 \\ SQL Injection MS SQL Server & 0.72 \\ Open SSL Heart Bleed & 0.75 \\ Open SSL POODLE & 0.31 \\ Cross Site Scripting & 0.61 \\ Cross Site Request Forgery & 0.88 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Probability of compromise using the CVSS online base score.  
Figure 7: Vulnerability Bayesian network: test network.  
for LCPD, one for each parent system exploiting vulnerabilities to the component to which they are connected. The idea behind this is that if the attacker has compromised a parent of MDM, he/she has access to the MDM system component, which is connected to it, not others. The probabilities of compromise of a particular system will change over time. Therefore, posterior probabilities of system components are useful to evaluate such risk in the dynamic environment using Bayes' rule.