# Mapping Automated Cyber Attack Intelligence to Context-Based Impact on System-Level Goals
## 3 Proposed Method  
The overarching aim in this paper is to advance the way we link automated alerts and detection of cyber attacks with systems and component-level risk assessment methods in a contextually relevant manner. We aim to measure the direct impact on a component, alongside the broader impact of a successful attack on the processes and operational goals that depend on it (a systems view). The methods in the paper are established to propose a defensible approach of mapping the outputs of an automated (e.g., rule or machine learning-based) component-view attack detection tool, to probabilities that system-level or organisational goals will be achieved. To achieve this, we first set out a range of statistical distributions, then take input relating to the confidence that an attack is occurring (in this case, the output from a machine learning classifier of the range 0 to 1), and map this to a goal success probability score (of the range 0 to 1). As an example of a machine learning attack detection tool, [26] developed an approach that was highly accurate at detecting attacks on popular commercially available IoT devices, while deploying 12 attacks from 4 main network-based attack categories, such as: Denial of Service (DoS), Man-In-The-Middle (MITM)/Spoofing, Reconnaissance, and Replay. Each output from the classifier includes the attack type and a confidence of the network features it has analysed that relates to attacks of this type (between 0 and 1). Not all attacks are equal. For instance, a spoofing attack is much less likely to achieve a massive impact on goals immediately than a DDoS attack that has an immediate and significant impact on a set of goals. Thus, the rationale behind the statistical distributions is to capture this variance. The paper is intended as a first step towards using cyber attack intelligence in a contextually relevant model to produce actionable risk management information relating to its impact. To help develop the framework, we ground the work in cyber attacks on IoT devices. The reason for this is because widespread adoption of IoT (for example, in the manufacturing sector) provides an excellent example to highlight the limitations we presented in related work--that new attacks require a rethink of an entire risk model when considering attack/failure modes and interdependence between assets. The addition of IoT (proposed as 50 billion new devices by 2050 in some cases [27]) highlights the scale at which such adaptation would need to be undertaken. This is not feasible--hence the need for our proposed method. There are several dependency modelling techniques available, each with its own strengths. Bayesian networks are graphical models that represent probabilistic relationships among variables and are particularly useful for modelling uncertainty and updating probabilities based on new evidence. Fault Tree Analysis (FTA) is a top-down, deductive failure analysis technique that uses Boolean logic to combine a series of lower-level events to analyse an undesired state of a system. Markov chains are stochastic models that represent systems with states and transitions, useful for modelling randomly changing systems where future states depend only on the current state. However, to make use of the proposed statistical distributions, we integrate the Dependency Modelling methodology proposed in the Open Dependency Modelling (O-DM) standard, published by the Open Group [28]. The concept of Dependency Modelling is explained and contrasted with standard failure-oriented, asset-based risk modelling in [29]. The advantages of this include its flexibility, which allows for modelling complex interdependencies within a system. This is crucial for accurately assessing cyber risks in converged IoT/ICS environments; it supports dynamic updates to the dependency model as new attack intelligence is gathered, making it highly adaptable to evolving cyber threats.