# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 1 Introduction
### Related Work  
A survey on the main technologies used in power systems, the major vulnerabilities, and the cybersecurity requirements, is presented in [12]. The impact of cyber attacks to DER connecting grids has been assessed in [13]. Several works present analysis methodologies and strategies to mitigate the cyber risks in critical systems. In [14] the methodology models the main IT components, attack steps, and countermeasures to identify the critical assets and secure the supervisory control and data acquisition (SCADA) system. In [15] ensemble classifiers learn the (low entropy) benign traffic in a smart grid to later detect anomalies. In [16] an attack chain designed for industrial Internet of Things (IoT) environments is introduced: it considers the multilevel architecture of an ICS, and uses machine learning classification techniques to map security alerts to the attacks phases. In [17] graphs are used to model cybersecurity properties on the smart grid and to evaluate the effectiveness of security mechanisms. Detection systems in the power grid are mostly rule and pattern-matching recognition oriented [18] and protocol whitelisting [19]. On the other hand, there is a very recent line of research [20] dynamically collecting the SCADA information from phasor measurement units through the wide area monitoring system, for real-time, high granularity monitoring to increase the stability of the power system. This information could be useful to the security analyst to integrate existing detection systems with application level intelligence. Probabilistic models have been adopted for security level assessment. For example, in [21] several attack objectives have been analysed in terms of vulnerabilities, modelling the SCADA weaknesses by means of attack trees (AT); and in [22] an AT formulation representing power system control networks is used to evaluate system vulnerabilities and attack goals. Using attack graphs (AG), the model of the attack must not follow a tree structure and can include the characteristics of the adversary [23]. In this paper the preliminary model of the attack scenario is an AG; the use of ATs instead of AGs could be justified by the presence of only one final goal in the scenario, but sequential order constraints on events cannot be represented in standard ATs, where in contrast, events are independent and can be combined only using Boolean gates (AND/OR). Bayesian networks (BN) [2] and their variants are inherently interpretable models, meaning that it is possible to ascertain why a conclusion was reached and validate how model changes affect the inference results, in contrast with \"black box\" models such as neural networks [24] where such a possibility is typically precluded and is an open problem in the explainable AI [25]. The adoption of BNs has been advocated by several works in the field of security assessment for critical infrastructures; for example, in [26] a BN model of the system under attack is derived from the AT of the same system; in our paper we resort to AG instead of AT for the reasons expressed above. In [27] the initial parameters of the BN are elicited by means of CVSS and predefined discrete probability levels (certain, probable, expected, unlikely, improbable, impossible). In [28] an algorithm for BN inference (analysis) is adapted to be applied to an AG; this permits avoiding the constraint of no cycles in the BN graph, which can be present in the AG. In [29] the authors propose a cyber-to-physical risk assessment model to quantify the impact of cyber threats on physical process safety in ICS. Said model was based on the analysis of BNs where the initial parameters are derived from CVSS scores. In all these works, differently from our approach, the model is a standard (static) BN, and thus not able to cope with the temporal evolution of the system, and the main objective is risk assessment; hence, it does not exploit the capability of BNs to support an analyst/system in diagnostic tasks.