I-HMM-Based Multidimensional Network Security Risk Assessment

Abstract

Cyber-physical systems (CPS) are vulnerable to network attacks because communication relies on the network that links the various components in the CPS. The importance of network security is selfevident. In this study, we conduct a network security risk assessment from the perspectives of the host and the network, and we propose a new framework for a multidimensional network security risk assessment that includes two stages, i.e., risk identification and risk calculation. For the risk identification stage, we propose a multidimensional hierarchical index system for assessing cybersecurity risk; the system's security status is determined in three dimensions, i.e., basic operation, vulnerabilities, and threats, and these dimensions guide the data collection. In the risk calculation stage, we use a hidden Markov model (HMM) to assess the network security risk. We provide a new definition of the quality of alert and optimize the observation sequence of the HMM. The model uses a learning algorithm instead of setting the parameters manually. We introduce the concept of network node association to increase the reliability and accuracy of the risk assessment. The simulation results show that the proposed index system provides quantitative data that reflect the security status of the network. The proposed network security risk assessment method based on the improved HMM (I-HMM) reflects the security risk status in a timely and intuitive manner and detects the degree of risk that different hosts pose to the network. INDEX TERMS Hidden Markov model, network node correlation, network security risk, risk assessment. I. INTRODUCTION Cyber-physical systems (CPS) are complex systems that use sensors, computing and network technology for computation, communication and control to link the physical world and the network. Since the communication of the CPS relies on a network, CPS are plagued by security issues [1], [2]. Malicious activities that specifically target networks [3], [4] and security incidents are occurring with increasing frequency [5]. The types of network security incidents [6] include information system vulnerabilities, phishing, and malicious programs [7]. There are two reasons for the occurrence of network security incidents [8]. First, weak links exist in the network system [9] and second, the emergence of various automated attack tools has caused a sharp increase in intrusions into network systems [10], [11]. The associate editor coordinating the review of this manuscript and approving it for publication was Zhen Ling.

A Novel Model for Vulnerability Analysis through Enhanced Directed Graphs and Quantitative Metrics

“…Hu et al [ 68 ] propose a network security risk assessment method that is based on the Improved Hidden Markov Model (I-HMM). The proposed model reflects the security risk status in a timely and intuitive manner, and it detects the degree of risk that different hosts pose to the network.…”

Research on Network Security Situation Awareness Based on the LSTM-DT Model

“…Network security situation prediction means predicting the future network situation according to the current network state and historical data. In recent years, the rapid development of machine learning provides a new solution for network situation prediction, such as the support vector machine (SVM) [ 12 ] and hidden Markov model (HMM) [ 13 ]. Then, deep learning applies to network security situation assessment: for example, [ 14 ] summarizes the artificial intelligence related to network security as well as the progress and challenges of current research; [ 15 ] studies the performance of different neural networks in the NSSP; and [ 16 ] proposes an LSTM network security situation prediction model based on the sigmoid weighted reinforcement mechanism, which can improve the convergence rate.…”

“…In the training process of the dataset, the loss function is used to measure the difference between the estimated value and the observed value of the model. The formula is as follows: loss : L(ŷ, y) = ω(θ)(ŷ − y) 2 (13) where ω(Θ) is the weight of the real value, y is the real value, andŷ is the output of the model. Figure 5 shows the image of the loss function when training the dataset after applying the LSTM model.…”

Risk Assessment Methods for Cybersecurity in Nuclear Facilities: Compliance to Regulatory Requirements

“…Risk assessment plays an important role in understanding and evaluating risks [14] to ensure cybersecurity and to calculate impacts caused by undesired events [15]. Therefore, risk assessment for cybersecurity comprises identifying threats, vulnerabilities, and property assets available within the attack targets [58] and is intended to minimize the negative impacts of potential threats. As the demands for cybersecurity increase to secure data, peripherals, and systems, the need for risk assessment on cybersecurity, especially those implemented at critical infrastructures, including nuclear facilities, also increases.…”