An application of fuzzy logistic regression for predicting CVSS severity category of industrial control systems

Abstract

Cybersecurity is rapidly gaining significance due to growing use of computers in daily life and business sectors. Likewise, industrial sector has also become more vulnerable to cyber threats (CT) exclusively with the onset of Industry 4.0, which is a digital transformation evolved with industrial control systems (ICS). Nowadays industrial organizations aim to build capacity towards protection of ICS to be cybersafe. To assess the effects of vulnerabilities in ICS, organizations utilize CVSS (Common Vulnerability Scoring System), which calculates severity categories/scores. CVSS is based on categorical variables defined by verbal statements rather than numerical values. When data collection is based on verbal/linguistic terms, uncertainty in data caused by human assessment inherently occurs. Randomness in data can be readily handled by classical statistical models, but to deal with uncertainty and especially when statistical assumptions for classical models don’t hold, fuzzy models with fuzzy numbers are appropriate to use. Therefore, we implement fuzzy logistic regression (FLR) on ICS vulnerability data, based on CVSS, to predict the severity category of ICS. Furthermore, the model is improved by applying metaheuristic algorithms to optimize the spread of fuzzy numbers representing input variables. This study is expected to contribute to practical application of vulnerability categorization of ICS.