# Mapping Automated Cyber Attack Intelligence to Context-Based Impact on System-Level Goals
###### Abstract  
Traditionally, cyber risk assessment considers system-level risk separately from individual component-level risk, i.e., devices, data, people. This separation prevents effective impact assessment where attack intelligence for a specific device can be mapped to its impact on the entire system, leading to cascading failures. Furthermore, risk assessments typically follow a failure or attack perspective, focusing on potential problems, which means they need to be updated as attacks evolve. This approach does not scale to modern digital ecosystems. In this paper, we present a Data Science approach, which involves using machine learning algorithms and statistical models to analyse and predict the impact of cyber attacks. Specifically, this approach integrates automated attack detection on specific devices with a systems view of risk. By mapping operational goals in a top-down manner, we transform attack intelligence on individual components into system success probabilities.  
cyber risk; machine learning; statistical modelling; risk management; industrial control systems  
entire system's goals and objectives. [PERSON] provides a perspective on what constitutes good and bad risk metrics [3], including the need for consistent measurements that are collected in an automated way and contextually relevant enough for decision makers to take action. Previous research has focused on developing systems and methods for measuring malicious network activity in evolving digital ecosystems (e.g., [4, 5]). Although these methods successfully identify cyber attacks, they do not necessarily produce contextually relevant information in order to enable decision makers to take action. They focus mostly on detecting the attack rather than the relationship between the possible attack and its impact on the wider system. In other words, the research field currently lacks a methodology to integrate metrics and measurements relating to cyber attacks with systems and component views of risk assessment. Tools such as Symantec and Metasploit (metasploit.com) have developed a severity scale to rate the 'impact' of various attacks. However, this rating is a general score, which refers only to the attack and does not consider its risk in the context of a specific digital ecosystem. Advancing the domain and enabling the measurement of impact of cyber attacks in rapidly evolving environments, for instance, converged IoT and industrial control systems, is crucial in order to be able to plan countermeasures and understand the hardware/system implications and financial impact of cyber attacks. Context is everything.  
This paper introduces a novel methodology that determines the severity of a cyber attack in a digital environment. While the methodology is exemplified in a converged IoT/ICS context for the purposes of this paper, it is designed to be broadly applicable to various digital environments, including, but not limited to, IoT contexts. The approach can be adapted to different digital ecosystems by considering the specific operational goals and interdependencies present in those environments. It achieves the above by linking: (i) measurements automatically collected from machine learning classification methods to detect attacks on IoT devices; (ii) systems-level goals and their interdependencies with component-level devices; and (iii) statistical distributions to calculate the reduction in probability of achieving system-level goals when component-level attacks occur on (IoT) devices. As far as we are aware, this is the first proposal for an integrated Data Science-based attack detection system coupled with a harmonised systems-component risk assessment method, giving'real-time' contextually relevant updates on the cascading impact of cyber attacks on devices across a digital ecosystem--paving the way for _trusted_ (industrial control) systems.