Probabilistic Event Graph to Model Safety and Security for Diagnosis Purposes

Abstract

Diagnosing accidental and malicious events in an industrial control system requires an event model with specific capacities. Most models are dedicated to either safety or security but rarely both. And the latter are developed for objectives other than diagnosis and therefore unfit for this task. In this paper, we propose an event model considering both safety and security events, usable in real-time, with a probabilistic measure of on-going and future events. This model is able to replace alerts in the context of more global scenarios, including with reinforcements or conflicts between safety and security. The model is then used to provide an analysis of some of the the security and safety events in the Taum Sauk Hydroelectric Power Station.

PROS2E, a Probabilistic Representation of Safety and Security Events for Diagnosis

“…In this article, we present PROS 2 E, an event model used for diagnosis. It reuses some results proved by Bourget et al [5] but goes much further in the logical and probabilistic modelling in order to have enhanced modelling and diagnosis capacities. Thanks to these changes, our new model PROS 2 E allows for an accurate modelling of the time, integrates countermeasures, is able to retroactively propagate the nature of events and has much more enhanced sequence modelling capabilities.…”

“…Analysis through Petri nets is limited to exponential distributions due to the underlying Markov process. Bourget et al presented an event model to represent safety and security scenarios that can lead to the realisation of undesired events [5]. To achieve this objective, they adapted LAMBDA [15], a pre/postconditions model working in tandem with CRIM [16,17], a correlation engine, to output extensive attack scenarios out of elementary attack steps modelled by a security expert.…”

“…The formulas to recombine pdf in those three situations are summarised in table 1. Proof of these formulas can be found in [5].…”

“…Moreover, these methods often limit themselves to exponential distributions that can only accurately describe a subset event: they are memoryless distributions that cannot take the increased wear of a mechanical component over time, for instance. A similar approach to [5] has been presented by Arnold et al [22] mapping pdf to actions taken by an attacker and recombining them to obtain a probabilistic evaluation of the whole scenario. Yet, they limit themselves to acyclic phase-type distribution while we consider any distributions.…”

“…After this introduction, Section 2 presents our motivating example that justifies our study and illustrates issues investigated in this paper. Section 3 overviews existing work in the literature that addresses the problems of sequential modelling and time counting, as well as a summary of the model of Bourget et al 2018 [5]. Sections 4 and 5 presents PROS 2 E, the event model with integrated countermeasures and advanced sequential and time modelling.…”