# Mapping Automated Cyber Attack Intelligence to Context-Based Impact on System-Level Goals
## 3 Proposed Method
It employs a Bayesian framework to propagate probability changes through the dependency tree, enabling a comprehensive understanding of how individual component risks impact overall system goals. These features make ODM particularly well-suited for our objective of linking automated attack detection to system-level risk assessments, thereby providing actionable insights into the cascading impacts of cyber attacks on digital ecosystems. Furthermore, the Dependency Modelling method develops a top-down model of a system from an overall goal to its first-level dependencies by asking the question 'what does this goal depend on? '; and then to next-level dependencies, and so on, until a tree of dependencies is built. 'Leaf' nodes sit at the bottom of the tree and do not have explicit dependencies in the model. These are 'uncontrollables' and require only a probability to be added (a value between 0 and 1 representing the probability of success--where 0 is guaranteed failure and 1 is guaranteed success). The tree can be treated as a directed graph, meaning changes in probability at the leaf nodes are used (in a Bayesian model) to propagate probability changes back up the tree. Thus, by assuming certain dependencies can be underpinned by cyber-physical components (e.g., IoT devices) to partially fulfil goals (e.g., in converged IoT/OT system), it is possible to suggest that intelligence about attacks detected on such components could be mapped onto the dependency model to adjust the probability value for leaf nodes and therefore update the whole model to show the impact the attack could have on the system, in real-time and in the context of all other operational goals. We demonstrate examples of this in action later in this paper. The open research question is how to turn cyber attack intelligence into a probability; a goal underpinned by a cyber-physical component will succeed or fail. This is our proposed contribution. There are two major step-changes in cyber risk modelling in this achievement. First, we move away from attack- or failure-based models that are vulnerable to incomplete and ever-changing knowledge about 'what could go wrong?'. Coming at the problem from the perspective of 'what needs to go right?' is more intuitive and likely to be readily accessible through individuals responsible for managing risk to these systems. As we move towards more intelligent ways of detecting cyber attacks, this information can be utilised, regardless of the attacker methodology. Second, the impact of a changing probability shows the impact on other operational goals in the context of a systems view. Previous approaches may use financial or qualitative (low, medium, high) measure for impact. But where does this information come from? Without a clear understanding of the impact on interdependent component parts of the system, these figures often relate only to the failure of a single asset (e.g., what if this server goes down?). The reality is, this failure will likely have a knock-on effect. Our proposed method captures this to provide more context for financial and qualitative decisions to be made.