Search

Due to the increasing reliance on networks, defending a cyber system is of vital importance. In this paper, we consider an important mechanism of early warning for defending a cyber system that has become a key component of constructing network defense in practice. We study the reliability of a system under attack from single or multiple sources. In particular, we discuss the effect of an early warning mechanism on the system reliability. We then propose the optimal strategy for defending a cyber system with early warning components in the worst attack scenario. The theoretical results are further validated by simulation evidence.

In this paper we investigate a cybersecurity model: An attacker can launch multiple attacks against a target with a termination strategy that says that the attacker will stop after observing a number of successful attacks or when the attacker is out of attack resources. However, the attacker's observation of the attack outcomes (i.e., random variables indicating whether the target is compromised or not) has an observation error that is specified by both a false-negative and a false-positive probability. The novelty of the model we study is the accommodation of the dependence between the attack outcomes, because the dependence was assumed away in the literature. In this model, we characterize the monotonicity and bounds of the compromise probability (i.e., the probability that the target is compromised). In addition to extensively showing the impact of dependence on quantities such as compromise probability and attack cost, we give methods for finding the optimal strategy that leads to maximum compromise probability or minimum attack cost. This study highlights that the dependence between random variables cannot be assumed away, because the results will be misleading.

The PMU network has been utilized to monitor the system operation of a smart grid in recent decades. This brings a significant cyber risk for the power grid as the attacker can manipulate the PMU network to introduce the false positive and false negative observation errors. A novel risk model is proposed for the PMU networks by considering the observation errors. It is discovered that ignoring the due observation errors can severely underestimate the PMU risks as shown by the theoretical and simulation studies. The risk mitigation strategies for improving the safety levels of PMUs with the observation errors are studied. It is found that the optimal mitigation strategy can be different when the observation errors are present. Numerical examples are presented for illustrations as well.