# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 2 Methodology
### Dynamic Bayesian Networks  
BNs are defined by a directed acyclic graph where nodes correspond to discrete random variables having a conditional dependence on the parent nodes. DBNs extend BNs by providing an explicit discrete temporal dimension. In this work context, the temporal dimension is introduced for capturing the time dependencies of attack steps and their effects on the operating system's behaviour. **Definition 1** (Dynamic Bayesian Network). : _Given a set of time-dependent state variables \(X_{1}\ldots X_{n}\) and given a BN \(N\) defined on such variables, a DBN is essentially a replication of \(N\) over two time slices \(t-\Delta\) and \(t\) (\(\Delta\) being the so-called time discretisation step), with the addition of a set of arcs representing the transition model. Let \(X_{i}^{t}\) denote the copy of variable \(X_{i}\) at time slice \(t\); the transition model is defined through a distribution  
Figure 3: Example of mapping security analytics to tactics/techniques. \(P[X_{i}^{t}|X_{i}^{t-\Delta},Y^{t-\Delta},Y^{t}]\) where \(Y^{t-\Delta}\) is any set of variables at slice \(t-\Delta\) different from \(X_{i}\) (possibly the empty set), and \(Y^{t}\) is any set of variables at slice \(t\) different from \(X_{i}\) (possibly the empty set)._  
The DBN derived from the AG (Figure 2) and related analytics are shown in Figure 4 where each variable (technique, state, or analytic) is binary: the value (state) 0 means \"did not occur\"; 1 means \"occurred\". An arc connecting two variables (nodes) means that the state of a variable influences the state of another variable. For example, the arc going from _localMITM_ to _ManCtrl_ is necessary because the technique _manipulation of control_ may occur only after the success of the technique _Local MITM_. The state of a variable in a time-slice is influenced by the state of the same variable in the previous time-slice. As an example, the arc connecting _localMITM_ to itself represents the temporal evolution of this technique: if _localMITM_ was inactive in the previous time-slice, it may occur in the current time-slice with a given probability. In Figure 4 all arcs labelled by a tag with the indication of the time step (always 1 in the figure) are inter-slice arcs. The arc from _localMITM_ to _ServBintMod_ expresses that the analytic server binary modification is activated by the technique _local MITM_. In this case, we deal with intra-slice arcs establishing influences holding inside a time-slice. Figure 4: DBN model of ICS attack. The dependencies of a node are quantified in terms of conditional probabilities and are stored in its _conditional probability table_ (CPT). The probability in every table entry has to be set according to the state of the parent nodes (possibly including the copy of the node in the previous time slice). As an example, Table 1 shows the CPT of the variable _SpoofRepMsg_ influenced by itself and its parent node _localMITM_. The technique _SpoofRepMsg_ may occur only if _localMITM_ is active. Thus, for entries 1-4, the probability that _SpoofRepMsg_ is active (state 1) is null because _localMITM_ is inactive (state 0). For entries 5 and 6, we have that _SpoofRepMsg_ was inactive at time \(t-1\) and _localMITM_ occurred; therefore, _SpoofRepMsg_ may happen at time \(t\) with probability 0.017156 (and may not happen with the opposite probability). For entries 7 and 8, we have that _SpoofRepMsg_ was active at time \(t-1\) and _localMITM_ still works; the probability that _SpoofRepMsg_ is still active at time \(t\) is 1 because we assume that a technique maintains its state once activated. The parameters for the techniques _new ICS service_ and _masquerading_ were obtained from the scores derived from the MITRE IT ATT&CK matrix. These techniques are applied to the ICS world, but they are identical to their IT counterparts, thereby justifying our choice. For all techniques that are proper in the ICS world, we derived our scores from the US Department of Homeland Security's ICS-CERT Advisories [5].