Developing a Bayesian Network Framework for Root Cause Analysis of Observable Problems in Cyber-Physical Systems

Abstract

Because critical infrastructures rely on Cyber-Physical Systems (CPSs), appropriate response to problems in such infrastructures operated by CPSs is important. Firstly, it is essential for decision-makers to be able to determine whether the observed problem is due to an attack or technical failure. In previous work, we developed a framework for building Bayesian Network (BN) models to enable decision-makers to determine whether the observed problem is due to an attack or technical failure. However, this information alone is not adequate to choose effective response strategies for the observed problem. It is also essential for the decisionmakers to be able to determine the most likely attack vector used to cause the observed problem or failure mode caused the observed problem to choose effective response strategies. However, the decision support to determine the most likely root cause for an observed problem is missing. In this paper, we develop a framework for building BN models to enable decisionmakers to determine the most likely root cause of problems. We demonstrate the developed framework using an example problem in smart grids.