A Model-Data Integrated Cyber Security Risk Assessment Method for Industrial Control Systems

Rapid development and application of ICT technologies in industrial control systems (ICS) has introduced serious security problem, as the cyber-attack can cause physical damage, ensuring the cyber security is extremely important. Risk assessment is a key component in security protection process, but existing methods of risk assessment generally lack the capacity of quantification and the adaptability to the dynamic evolution of ICS. In this paper, we discuss a model-data integrated risk assessment method. In the proposed method, Bayesian network model is applied to achieve quantitative risk assessment, and the model is optimized dynamically using an online data-driven parameter learning strategy, which can improve the accuracy of real-time dynamic assessment result. The effectiveness of proposed method is demonstrated with a case study on a simulated process control system.