The widespread adoption of e-commerce and its lucrative, decentralized, multi-agent nature have made these systems vulnerable to cyber-attacks. Traditional signature-based approaches have been successful in detecting instances of fraud, however, they continue to struggle against unknown attacks. To this end, we present PALM, a framework that bridges the data-oriented process mining community with model-based security engineering with an aim to detect novel cyber-exploit automatically from a given event-log. It relies on the insight that security attacks on digital infrastructures seek to modify the system behaviour inducing unsafe states. Consequently, we propose an approach to represent the behaviour of the system and establish a signature-based attack database that can be used to predict unseen exploits. Building on the success of process-mining community, our framework first discovers a Petri Net model automatically from an event-log using the "Inductive Miner (IM)" algorithm. Next we, explicitly map the system features onto the discovered Petri-Net. Subsequently, the Petri-Net model is trained over contextual attack signatures. This step is crucial for capturing the nuances of system dynamics and identifying potential vulnerabilities or attack surfaces that may be exploited by malicious actors. Graph Convolution Network is then employed to look for malicious feature correlations and information flows, indicating a likelihood of a link between unconnected neighbouring nodes. Using a sample event-log, we test the efficacy of our framework, achieving 83.33% accuracy and an AUC-ROC of 0.9186, signifying its potential in identifying novel attack paths.

Engineering safety-critical infrastructures for continuous operation is a challenging task. With increasingly integration and automation, these systems are overwhelmingly exposed to disruptions - arising from both accidental causes and malicious threats. In this paper, we report on our work on developing quan-titative risk assessment methods to ensue such infrastructures remain resilient to disruptions. Our approach involves building the quantitative domain models to carry: a) continuous risk analysis - estimating the likelihood of system disruption and quantify its damaging impact. b) identify the most crucial system components to keep the system operational. c) dictating optimal incident response strategies. Technically, we model the system in a compositional manner by building and composing stochastic timed automaton of each system component. Along with metrics of interest, these models are fed to the statistical model checker of UPPAAL SMC. Metrics of interest are disruption scenarios in the system model. A scenario is encoded in a variant of temporal logic for its use in the model checker. We use a realistic industrial case-study of steam-boiler system to showcase the methodology.

Cyber-physical system such as automatic metering infrastructure (AMI) are overly complex infrastructures. With myriad stakeholders, real-time constraints, heterogeneous platforms and component dependencies, a plethora of attacks possibilities arise. Despite the best of available technology countermeasures and compliance standards, security practitioners struggle to protect their infrastructures. At the same time, it is important to note that not all attacks are same in terms of their likelihood of occurrence and impact. Hence, it is important to rank the various attacks and perform scenario analysis to have an objective decision on security countermeasures. In this paper, we make a comprehensive security risk analysis of AMI, both qualitatively and quantitatively. Qualitative analysis is performed by ranking the attacks in terms of sensitivity and criticality. Quantitative analysis is done by arranging the attacks as an attack tree and performing Bayesian analysis. Typically, state-of-the-art quantitative security risk analysis suffers from data scarcity. We acknowledge the aforementioned problem and circumvent it by using standard vulnerability database. Different from state-of-the-art surveys on the subject, which captures the big picture, our work is geared to is provide the prioritized baselines in addressing most common and damaging attacks.

Attack trees (ATs) are a popular formalism for security analysis, and numerous variations and tools have been developed around them. These were mostly developed independently, and offer little interoperability or ability to combine various AT features. We present ATTop, a software bridging tool that enables automated analysis of ATs using a model-driven engineering approach. ATTop fulfills two purposes: 1. It facilitates interoperation between several AT analysis methodologies and resulting tools (e.g., ATE, ATCalc, ADTool 2.0), 2. it can perform a comprehensive analysis of attack trees by translating them into timed automata and analyzing them using the popular model checker Uppaal , and translating the analysis results back to the original ATs. Technically, our approach uses various metamodels to provide a unified description of AT variants. Based on these metamodels, we perform model transformations that allow to apply various analysis methods to an AT and trace the results back to the AT domain. We illustrate our approach on the basis of a case study from the AT literature.