# Opportunities for Early Detection and Prediction of
## 4 Research Direction and Future Work
### Research Direction: Situational Awareness Ransomware Prediction Framework
#### 4.1.2 Comprehension Phase  
In the comprehension phase of the situation-awareness-based framework, the data acquired from the previous phase will be used to construct three lists, namely, the situational vulnerability list, asset list, and situational threat list. The combination of data will be introspected for constructing a risk tree and situational vulnerability assessment. The situational vulnerability list consists of a set of vulnerabilities in the SCADA system that ransomware could expose to break into and carry out the attack. The set of vulnerabilities is built based on the current situation and the setting applied to the SCADA system. This includes, but is not limited to, the current topology, operational conditions, workload, type of interaction, and amount of data. The vulnerability list is situational because it is derived based not only on the devices and assets that are potential targets but also on the current  
Figure 1: The proposed situational awareness ransomware incident response. operating conditions and number of resources in the SCADA allocated to support these operations. This list changes according to the change in the situation. The asset list will be constructed based on the topology of the SCADA system. The assets include hardware, software, data, services, and applications. Communication channels and protocols are also considered assets. Additionally, items in the asset list will be paired with the priority of that asset. This priority will be used to measure the importance of the asset. Such importance will be determined based on the potential that this asset contributes to ransomware attacks. The proximity of an asset to the operational data is another factor to be considered when assessing the importance of the asset. Nevertheless, the importance of certain assets increases or decreases based on the situation. Adding a new device, sensor, and/or service could increase (or decrease) the importance of another asset. By adopting the situational awareness, items in the asset list will be reprioritized at any change in the SCADA system. Therefore, the importance of the items changes as such. The third list that will be constructed during the comprehension phase is the situational threat list. In this list, the items are added and removed based on the degree of threat severity, and how much it contributes to successfully carrying out ransomware attacks. In such a manner, threats against data and devices where these data are stored and/or processed will have the highest priority. As a situational list, the items change based on the data-related factors such as the amount of data, processing capability, transmission efficiency, and real-time dependency. The three lists will be combined to construct the risk assessment that will be used as input for the projection, which is the third stage in the situational awareness framework. To build the risk assessment, a threat tree will be constructed based on the vulnerability and asset lists. The threat tree takes as input the items in the asset list and the vulnerability list. The asset list will be categorized into three types, namely, hardware, software, and data. Likewise, items in the vulnerability list will be put under three categories: confidentiality, integrity, and availability. Each vulnerability category will then be used as the root of the threat tree. From each root, three branches will emit, each of which will be related to one category of the assets, i.e., hardware, software, and data. Each asset category will then be branched into several branches corresponding to the number of assets under that category. The leaves of the tree represent the set of threats to that asset. Each leaf in the threat tree will be assessed with two values: vulnerability level, and threat level. These values are estimated based on two factors: the relevance to operational data and the current situation within the SCADA system.