Poster: Using Causal Inference to Extract Hidden Information from Dependency Modelling Ayodeji Rotibi Computer Science and Informatics Cardiff University Cardiff, United Kingdom rotibiao@cardiff.ac.uk Neetesh Saxena Computer Science and Informatics Cardiff University Cardiff, United Kingdom saxenan4@cardiff.ac.uk Pete Burnap Computer Science and Informatics Cardiff University Cardiff, United Kingdom burnapp@cardiff.ac.uk Abstract—Dependency Modelling is an established Probabilis- tic Risk Analysis method that is frequently used to identify and quantify cyber risks in complex environments, such as Industrial Control Systems. The method is useful for examining the inter- relationships between different variables, but the limited data exposure in the modelling restricts its ability to analyse multiple independent variables simultaneously or sequentially. In response to this limitation, we present a new technique that leverages the Bayesian Network method to draw inferences from unrelated events and uncovers hidden insights that Dependency Modelling may overlook. We conducted an evaluation of our proposed technique using lab-generated data that mimics Colonial pipeline operations. Our results demonstrated that the proposed technique exposes previously undetected aspects of the dependency model, providing business and asset owners with a more comprehensive understanding of their cyber risks and facilitating better decision- making. Our technique represents a significant advancement and is the first to apply this inference method to Dependency Modelling. Index Terms—Cyber risks, Dependency Modelling, Bayesian Network, Variable Elimination I. INTRODUCTION The industrial technology landscape is continually evolv- ing, resulting in an increased connection of processes and components that enhance productivity and bottom-line impact. However, this transformation also brings new risks to oper- ational technology (OT) systems and operations, increasing complexity and posing significant cybersecurity challenges [1]. Despite continuous efforts by industries and governments to enhance cybersecurity, major industrial cyber breaches remain as likely today as they did ten years ago. Recent cyber attacks on Colonial Pipeline and JBS Foods have highlighted the consequences of cyber threats and the vulnerabilities of exchanging data and dependencies in enterprise systems [2]. Successful attacks can lead to a complete system failure, emphasising the need to evaluate alternative approaches to mitigate cyber risks in complex systems. Dependency Modelling (DM) provides a comprehensive framework for establishing links between system events, pro- cesses, and dependencies, enabling accurate risk assessments This work has been supported by the Knowledge Economy Skills Scholar- ships (KESS2) - a major pan-Wales operation supported by European Social Funds (ESF) through the Welsh Government, and Thales UK to support informed decision-making and enhance cyberse- curity [3]. Despite its capabilities, DM’s limitations prevent it from providing sufficient insights to fully understand a system’s complexity beyond conventional approaches, high- lighting the need for alternative methods. Contribution: Our proposed technique introduces causal inference into Dependency Modelling (DM) which allows the analysis of multiple independent nodes and accounting for simultaneous or sequential changes within the model. This multi-nodal analysis increases the identification of cyber risks that are synonymous with the tight coupling characteristics phenomena in complex systems where multiple events can fail synchronously. We believe this enhancement positions DM as a preferred method to identify cyber risks in complex environments, including Industrial Control Systems (ICS). II. RELATED WORK The potential of Bayesian Networks (BN) as an adaptable and effective tool in handling incomplete or uncertain informa- tion has been recognised by researchers [4]. Previous studies, such as