Attack Graph-Based Quantitative Assessment for Industrial Control System Security

Industrial control systems (ICSs) are facing serious security challenges due to their inherent flaws, and emergence of vulnerabilities from the integration with commercial components and networks. To that end, assessing the security plays a vital role for current industrial enterprises which are responsible for critical infrastructure. This paper accomplishes a complex task of quantitative assessment based on attack graphs in order to look forward critical paths. For the purpose of application to a large-scale heterogeneous ICSs, we propose a flexible attack graph generation algorithm is proposed with the help of the graph data model. Hereafter, our quantitative assessment takes a consideration of graph indicators on specific nodes and edges to get the security metrics. In order to improve results of obtaining the critical attack path, we introduced a formulating selection rule, considering the asset value of industrial control devices. The experimental results show validation and verification of the proposed method.