Bayesian network model to distinguish between intentional attacks and accidental technical failures: a case study of floodgates

Abstract Water management infrastructures such as floodgates are critical and increasingly operated by Industrial Control Systems (ICS). These systems becoming more connected to the internet, either directly or through corporate networks. This makes them vulnerable cyber-attacks. Abnormal behaviour in ICS could be caused both (intentional) attacks (accidental) technical failures. When operators notice abnormal behaviour, they should able distinguish between those two causes take appropriate measures, because for example replacing a sensor case of intentional incorrect measurements would ineffective not block corresponding attack vector. In previous work, we developed attack-failure distinguisher framework constructing Bayesian Network (BN) models enable causes, including knowledge elicitation method construct directed acyclic graph conditional probability tables BN models. As full study framework, this paper presents model constructed failures problem floodgates, addressing floodgate operators. We utilised experts who associate themselves with safety and/or security community validate qualitative part model. The is usable water accidental measurements. help decide on response strategies avoid further complications