Risk-based Decision-Support for Vulnerability Remediation in Electric Power Networks
Risk-based Decision-Support for Vulnerability Remediation in Electric Power Networks
复制标题
基于风险的电力网络漏洞修复决策支持
DOI：
10.1145/3307772.3330157
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
H. Meer
中科院分区：
文献类型：
--
作者：
Ali Alshawish;H. Meer
电网变得越来越智能化。然而，他们的运营技术（OT）环境和（脆弱的）IT网络之间的界限往往会消失。在这样的系统中，若干技术和经济因素会对升级决定产生重大影响。这些因素包括，仅举几例，有限的时间和预算以及法律的限制。为了科普这些挑战，相关的决策者必须谨慎地优先考虑可能的漏洞补救措施。确定优先级的关键目标是有效地降低系统所面临的固有安全风险。由于电力系统的关键作用，其决策者倾向于增强系统对极端事件的弹性。也就是说，他们试图避免与极端（不利）后果相关的决策选项。因此，我们提出了一个综合的基于风险的决策支持方法，优先风险补救活动。它利用（i）妥协时间（TTC）度量来定量评估安全风险，以及（ii）博弈理论模型来支持决策过程。博弈模型仔细考虑了决策者在跨电力组织的补丁管理过程中的具体风险态度。
Power grids are becoming increasingly intelligent. However, the boundaries between their operational technology (OT) environments and the (vulnerable) IT networks tend to dissolve. In such systems, several technical and economic factors can significantly affect the upgrading decisions. These factors include, just to name a few, limited time and budget as well as legal constraints. To cope with these challenges, an involved decision maker has to prudently prioritize the possible vulnerability remediation actions. The key objective of prioritization decisions is to efficiently reduce the inherent security risk to which the system in question is exposed. Due to the critical role of power systems, their decision makers tend to enhance the system resilience against extreme events. That is, they seek to avoid decision options associated with extreme (adverse) consequences. Therefore, we propose an integrated risk-based decision-support methodology for prioritizing risk remediation activities. It leverages (i) the Time-To-Compromise (TTC) metric to quantitatively assess the security risk, and (ii) a game-theoretical model to support the decision-making process. The game model considers carefully the specific risk attitude of the decision makers involved in the patch management process across electric power organizations.