Extended multilevel flow model-based dynamic risk assessment for cybersecurity protection in industrial production systems

Abstract

Cybersecurity protection becomes an essential requirement for industrial production systems, while industrial production systems are moving from isolation to interconnection with the development of information and communication technology. Dynamic risk assessment plays an important role in cybersecurity protection, providing the real-time security situation to the industrial production systems managers. Currently, few researches in this domain focus on the physical process of industrial production systems, let alone considering the combination of attack propagation in cyber space and the abnormal events happening in physical space for risk assessment. In this article, an extended multilevel flow model-based dynamic risk assessment approach for industrial production systems is proposed, where the extended multilevel flow model models the production process graphically and describes the relationships among devices, functions, and flows quantitatively. Based on the extended multilevel flow model of industrial production systems, a Bayesian network is built to analyze the attack propagation over time, and the consequences of cyber attack in production process are assessed quantitatively. Some simulations on a chemical process system are carried out to verify the effectiveness of the proposed approach. The results demonstrate that this approach can assess the dynamic cybersecurity risk of industrial production systems in a quantitative way.

Manufacturing Systems for Unexpected Events: An Exploratory Review for Operational and Disruption Risks

“…Zhu, et al [112] designed a multilevel flow model-based dynamic risk assessment approach for cyber attacks in MSs. They developed a Bayesian network to quantitatively analyze the effects of cyber attacks in the production process and their propagation.…”

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

“…Zhu et al [22] introduced a model to quantitatively assess the risk in IPSs by calculating the probabilities and consequences of an abnormal event (tampering with control strategies). The model consists of two parts, probability inference and loss calculation, which were combined to produce real-time risk.…”