Ahmet Sayar
email: ahmet.sayar@kocaeli.edu.tr

Marlon E Pierce
email: mpierce@cs.indiana.edu

Chaining Data and Visualization Web Services for Decision Making in Information Systems

Keywords: Information Systems, Decision making, Web Services, Visualization, DIKW

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The World Wide Web and its associated Web programming models have revolutionized accessibility to data/information sources. At the same time, numerous incompatible data formats, data heterogeneity (both the data types and storage formats), and machine un-readability of data limit data integration and federation [START_REF] Huang | Dynamic Service Composition Based on Federated Agents[END_REF]. The seamless integration and sharing of data from distributed heterogeneous data sources have been the major challenges of information system communities and decision support systems [START_REF] Sayar | Unified Data Access/Query over Integrated Dataviews for Decision Making in Geographic Information Systems[END_REF]. In order to be able to integrate and share data/information, data sources need to be in interoperable formats and provide standard service interfaces interacted with standard message formats and transport protocols. The interoperability issues have been studied by many public and private organizations over the last two decades at the data and service levels. Among these are the Web Service standards (WS-I) [START_REF] Ws-I | WS-I[END_REF] for cross-language, platform and operating systems, and International Virtual Observatory Alliance (IVOA) [START_REF]IVOA: International Virtual Observatory Alliance[END_REF] and Open Geospatial Consortium (OGC) [START_REF]OGC Schema[END_REF] for defining domain specific data model and online service definitions in Astronomy and Geographic Information Systems (GIS), respectively. Information systems are mostly used by decision makers coming from various kinds of domains and from various expert levels. Decision making increasingly relies on analyses of data in visual formats such as images, animations, etc. Most of the analyses include creation of integrated data views in which data sources provided by heterogeneous services. By this way decision makers query the heterogeneous data sources as a single resource. This removes the hassle of individually accessing each data source.

Decision making in Information systems mostly require integrating multiple heterogeneous data sets from various heterogeneous resources, and analyzing them from a single access point by visualization tools. There are many ad-hoc solutionframeworks developed for application specific purposes [START_REF] Chan | Vispedia: Ondemand Data Integration for Interactive Visualization and Exploration[END_REF][START_REF] Cammarano | Visualization of Heterogeneous Data[END_REF]. However, no one defines such a framework in terms of requirements and constraints. Katsis et al. [START_REF] Katsis | View-based Data Integration[END_REF] defines view-based integration issues from the point of global and local data format heterogeneities. They specify the relationship of sources with the global view. They determine that view-based integration systems follow global as view (GAV), Local As view (LAV) and Global and Local as View (GLAV) approaches. In GAV, the global database (schema) is expressed as a function of the local database (schema). LAV on the other hand follows the opposite direction. Finally GLAV is generalization of the two. Another closely related work is visual integration tool for heterogeneous data types by unified vectorization [START_REF] Bourennani | Visual Integration Tool for Heterogeneous Data Type by Unied Vectorization[END_REF]. They propose a visual data integration technique to aid the end-users to identify semantically similar data attributes in a semi-automated fashion. This is achieved by using Self Organizing Map (SOM) to classify unfamiliar database entities. SOM is mostly used in text visualization related works, and applied in various projects.

We propose a framework for chaining data and visualization Web Services for decision making in information systems. The proposed framework is actually based on the idea of the Data-Information-Knowledge-Wisdom hierarchy (DIKW) [START_REF] Zins | Conceptual approaches for defining data, information, and knowledge[END_REF][START_REF] Rowley | The wisdom hierarchy: representations of the DIKW hierarchy[END_REF]. In DIKW, wisdom is defined in terms of knowledge, knowledge in terms of information and information in terms of data. The system does not allow actual physical data integration. Physical integration results in both high data maintenance and storage costs. Therefore, it is better to keep data sets at their originating sources and maintain their internal structures. This enables large degree of autonomy. Individual data sets are integrated to the system through mediator services (see Fig. 1).

Web Services provide key low level capability but do not define an information or data architecture. These are left to domain specific capabilities metadata and domain specific common data model. Each-domain has different set of attributes for the data and its model is defined in core language. These are defined by standard bodies of the corresponding domain. Cross-domain interoperability issues are not handled in this paper.

Fig. 1. Integrated data views

The remaining of the paper is structured as follows. Section 2 presents the proposed framework. Section 3 gives the details about the intercommunication and message exchange between the abstract components in the framework. Section 4 scrutinizes the three different information systems domains (GIS, Astronomy and Chemistry) and shows to what extent the proposed framework can be realized. Section 5 presents a sample ASIS framework for GIS domain, and Section 6 concludes the paper.

Application Specific Information Systems (ASIS)

This paper proposes blueprint architecture in terms of principles and requirements and calls it Application Specific Information System (ASIS). Developing such a framework requires first defining a core language expressing the primitives of the domain; second, key service components, service interfaces and message formats defining services interactions; and third, the capability file requirements (based on corelanguage) enabling inter-service communications to chain (link) the services for the federation (see Fig. 2).

The architecture proposed in this paper is a high level architecture that consists of abstract components and explains their data flow and components' interactions. In this section, we focus on the principles and requirements in terms of data and service interfaces in any information system domains. It should be noted that this abstract architecture is intended to be domain-specific. That is, it may be realized in chemistry or astronomy, for example, but we are not suggesting cross-domain interoperability.

Fig. 2. Application Specific Information System (ASIS)

ASIS consists of two groups of filter-like Web Services. These are Application Specific Feature Service (ASFS), which is actually a data service, and Application Specific Visualization Service (ASVS), which is actually a display service. These services also behave as mediators. ASFS perform their mediation services with adaptors converting any data to common data model encoded in application specific language (ASL) (number 1 in Fig. 2). ASFS also mediate resource specific heterogeneous service interfaces with standard service interfaces (number 2 in Fig. 2). Standard service API enables querying on data (e.g. GetASL) and their metadata (e.g. GetCapabilities). On the other hand, ASVS mediate any data in common data model (ASL) and convert into a visual format (an image) with pre-defined attributes such as bounding boxes, projections and resolutions (number 3 in Fig. 2). ASVS also enables querying of ASL through visual image representations through standard service interfaces (number 4 in Fig. 2). Those interfaces enable performing attribute-based querying of ASL through displays. ASVS also provide service interfaces to list the available ASL data with their attributes, which enables clients to make appropriate queries.

ASIS is a proposed solution to heterogeneous data integration. This solution enables inter-service communication through well-defined service interfaces, message formats and capabilities metadata. Data and service integration is done through capability federation of these services. ASFS and ASVS are Web Services, and each service is described by corresponding generic metadata descriptions that can be queried through Web Service invocations. In addition to allowing service discovery, this approach also enables at least three important qualities of services. First, services of the same type that provide a subset of the request can be combined into a "superservice" that spans the query space and has the aggregate functionality of its member services. Second, the capability metadata can be used to determine how to combine services into filter chains with interconnected input-output ports. Third (and building on the previous two), capabilities of super-services can be broken into smaller, selfcontained capabilities that can be associated with specific services. This enables performance gains through load-balancing.

ASFS and ASVS are filter-like Web Services and communicate with each other through capability metadata exchange interface. Capability metadata defines service and data attributes, and their constraints and limitations to enable clients to make valid queries and get expected results. Being a Web Service enables filter services to publish their interfaces, locate each other and chain together easily. Filters have interservice capabilities and are chainable. If the filter is capable of communicating and obtaining data from other filters, and updates (or aggregates) its capability metadata with these data (after capability files exchange), then it can claim that it serves these data. Filter Services are information/data services that enable distributed data/information access, querying and transformation through their predictable input/output interfaces defined by capability document. Filter located in the same community network can update their capability metadata dynamically through the standard service interface of the filters (e.g. getCapabilities). In addition, dynamically updating capabilities of filters enable removal of obsolete data or down filters. Capabilities metadata and ASL are closely related to each other. One defines the domain-specific data and other defines the query and response constraints over the service and data provided.

ASVS must visualize information and provide a way of navigating ASFS and their underlying database. ASVS must provide human readable information such as text and graphs (scalable vector graphic (SVG) [START_REF] Andersson | others: Scalable Vector Graphics (SVG) Specification Version 1.1[END_REF] or portable network graphic (PNG) [START_REF] Adler | Portable Network Graphics Specification (PNG)[END_REF]) images. These are final outputs of the system and might be called as knowledge. ASVS defines the knowledge (formats, types etc.) in terms of what data needs to be rendered from what services. Services are basically ASFS and possibly other ASVS. This definition is done in ASVS's capability metadata. An ASFS is an annotation service providing heterogeneous data in common data model with an attribute-based query capability. ASFS serves data in ASL, which must be realized as a domain specific XML-encoded common data model containing content and representation tags. Heterogeneity in queries and data formats is handled through resource specific mediators. ASL is a domain specific encoding of common data defining the query and response constraints over the service and data provided.

A sample scenario to apply the presented framework can be given in GIS domain. Pattern Informatics (PI) [START_REF] Holliday | A RELM Earthquake Forecast Based on Pattern Informatics[END_REF] is a project on earthquake forecasting. In PI, data sets are earthquake seismic data records collected from sensors. ASFS provide data records in global data format with attribute and spatial based standard queries. ASFS overlay seismic data records and earthquake forecast values [START_REF] Rundle | Statistical physics approach to understanding the multiscale dynamics of earthquake fault systems[END_REF] on satellite map images and enable interactive visual querying. Depending on the magnitudes of expected earthquake seismicity, maps are also possibly overlaid with hot-spot plots in colored boxes.

Inter-service Communications

Inter-service communication is achieved through common service interfaces and capability metadata exchange. The standard service interfaces can be grouped into three types: a) capability metadata exchange: inter-service communication (set-up stage); b) interactive data display: selecting layer composition and bounding box regions; and c) querying of data itself over the display, getting further information about the data content and attributes. As mentioned before, capability helps clients make valid requests for its successive queries. Capability basically provides information about the data sets and operations available on them with communication protocols, return types, attribute based constraints, etc. Each domain has different set of attributes for the data and it is defined in ASL common data model. For example, in GIS domain, attributes might be bounding box values (defining a range query for data sets falling in a rectangular region) and coordinate reference system.

Standard requests/query instances for the standard service interfaces are created according to the standard agreed-on request schemas. These are defined by open standards bodies in corresponding domains. The request instances contain format and attribute constraints related to the ASL common data model. For example in the GIS domain, getMap request defines a map images' return format (JPEG, PNG, SVG, etc.), height, width, bounding box values, and so on. Format, height and width are related to display, but bounding box values are related to the attributes of the data defined in its ASL representation provided by ASFS. In this specific example of the getMap request, ASVS must both visualize information through the getMap service interface and provide a way of navigating ASFS services and their underlying database. ASVS make successive queries to the related ASVS to get the ASL data and render it to create final display for its clients.

In ASIS, the task of mediators is to translate requests to the standard service interfaces to those of the information/data sources', and transform the results provided by the information source back to the ASIS's standard formats. For ASFS, the returned data is ASL, and for ASVS the returned results can be any kind of display format such as images.

Acting as a proxy of information source, the mediators communicate with an information source in its native language and API. They communicate with ASIS in a commonly agreed language (ASL) and Web Service API calls. Because of the obvious heterogeneity between different science domains, each will need to extend and create its own service interfaces, as well as queries for those services. Using common data model-ASL and common services make autonomous resource to be integrated into the system in a manageable way.

The mediators-wrappers enable data sources integrated to the system conform to the global data model (ASL) but enable the data sources to maintain their internal structure. At the end, this whole mediator system provides a large degree of autonomy. Instead of actual physical data federation, system makes distributed querying and response composition on the fly. Mediators perform query and data format conversions.

Abstract Components and Matching to Sample Science Domains

GIS is a mature domain in terms of information system studies and experiences. It has standards bodies defining interoperable online service interfaces and data models such as OGC (Open Geospatial Consortium) and ISO/TC211, but many other fields do not have this. We have surveyed two science domains (Astronomy and Chemistry). Table 1 presents the results briefly in terms of service counterparts (ASIS vs. science domains). Astronomy has a standards body, the International Virtual Observatory Alliance (IVOA), for defining data formats and online services that are somewhat analogous to the OGC standards. FITS (Flexible Image Transfer), Images and VOTable [START_REF] Williams | VOTable: A Proposed XML Format for Astronomical Tables[END_REF] are the data models. SkyNodes are database servers with an ADQL (Astronomy Distributed Query Language) based SOAP interfaces that return VOTable-encoded results. VOPlot and TopCat are two services to visualize the astronomy data in the format of VOTable, FITS and images. VOResource and UCD are the metadata definition and standards for the service descriptions [START_REF] Yasuda | Astronomical Data Query Language: Simple Query Protocol for the Virtual Observatory[END_REF].

Chemistry, although a vastly different field, does provide a common data model (CML [18]) that can be used to build up Web Services. Although many research groups have investigated service architectures for chemistry and chemical informatics, the field has (to our knowledge) no Web Service standards-defining body equivalent to the OGC or IVOA.

ASIS Application to GIS Domain

Data in GIS are stored in various places using various formats. These formats may be closed (i.e., proprietary dependent) or opened, normalized or not. A consequence is that the analysis and/or decision-making may be difficult or time-consuming due to this heterogeneity of formats. To avoid these drawbacks and in order to facilitate accesses and uses of these data, the Open Geospatial Consortium (OGC) defined some propositions. These propositions allow accesses to geographical data without taking into account physical aspects of communications (i.e., with an URL). They also propose a set of parameters, methods and communication rules to simplify accesses and manipulations as soon as clients and servers respect them. The Web Map Service (WMS) and Web Feature Service (WFS) are two well-known web services defined by OGC standards. WMS deal with dynamic production of maps as images, built with geo-referenced data. WFS are designed to provide an access and a manipulation tool of geographical data within a map. WMS and WFS provide standard service interfaces and their operations provide data associated with a geographical map or object.

Information may be alphanumerical such as a town name or graphical such as the segments defining a border of a town. WMS correspond to ASVS in the proposed framework. WMS standard induces three main operations. Fig. 3 presents these operations: GetCapabilities, GetMap, GetFeatureInfo. The most important facility for WMS is to provide a map from its available layers. Parameters such as desired layers, representation styles, size, relevant geographical areas, the projection system or the output format must be provided to the GetMap operation. The obtained result is a map, which is an image that can be displayed by conventional web browsers. This operation corresponds to a visualization process.

The GetFeatureInfo operation corresponds to a query process. An end-user does not manipulate structured data but an image. To be able to access data, an end-user must select an object on the image. The GetFeatureInfo operation provides this selection. Nevertheless, some limits appear in the sense that the provided schema is the set (or a sub-set) of available data for this/these object(s). No link is performed with the environment of this object. Furthermore, an end-user must be aware of the database schema in order to select only a sub-set of available data. This information is kept in Capabilities.xml document and provided by GetCapabilities service interface upon requests.

WFS in Fig. 3 correspond to ASFS in the proposed framework. WFS are OGC specifications for data access. It describes responses of a Web server to geographical data manipulation operations. These operations are based on the CRUD manipulations of geographic data based on alphanumeric/spatial constraints: creation (C), read (R), update (U) and deletion (D). The formalism used to model data exchanges for the WFS specification is GML (Geography Markup Language). GML correspond to ASL in the proposed framework. GML is a common data model for geographic data, and defined by OGC specifications. It is an XML dialect and is designed to encode, to manipulate and to exchange geographical data. The WFS specification defines five operations to send queries to a geographical data server and to get answers from it: GetCapabilities, DescribeFeatureType, GetFeature, Transaction and LockFeature. Fig. 3 presents the basic operations of the WFS specification.

The most important operation for a WFS server is the GetFeature operation. This operation delivers data instances typed by features, identifies properties that should be delivered and provides the results of spatial and non-spatial queries. Selection criteria are defined by using a filter. To get relevant data, a client specifies an object identifier in the filter. The WFS server receives the GetFeature query, determines the correct database, creates and sends a SQL statement to the database and formats the results. The filter is used to manage the "Where" clause of a SQL statement. Spatial data are handled with the spatial schema defined in the ISO 19107 norm. Before sending results to a client, the server transforms objects using a GML format.

In summary, Fig. 3 illustrates an application of ASIS in GIS domain. Such a framework has been used in some Geo-science projects [START_REF] Aydin | Building and Applying Geographical Information Systems Grids[END_REF][START_REF] Sayar | High Performance Federated Service Oriented Geographic Information Systems[END_REF][START_REF] Pierce | The QuakeSim Project: Web Services for Managing Geophysical Data and Applications[END_REF] with application specific extensions and modifications.

Conclusion

We have presented a service-oriented architecture for understanding and managing the production of knowledge from the distributed observation, simulation and analysis data through integrated data-views in the form of images. It enables unified data access/query and a display from a single access point. The infrastructure is based on a common data model, standard Web-Service components for data and visualization, and a federation service. The framework applies just-in-time (late-binding) federation in which the data is kept in its originating sources all the time. This enables autonomy and easy data maintenance.

The architecture proposed in this paper is a blueprint architecture defining the principles and requirements for application specific information systems for general science domains. We focus on the principles and requirements in terms of data and service interfaces in any information system domains. We have defined two general service types (ASFS and ASVS) with limited number of service interfaces. Service interfaces enable metadata exchange and data querying. Data flows from databases to users through ASFS and then ASVS. It should be noted that this abstract architecture is intended to be domain-specific. That is, it may be realized in chemistry or astronomy, for example, but we are not suggesting cross-domain interoperability. Due to the domain specific data heterogeneity, each domain should define its own ASL and corresponding queries.

Fig. 3 .

 3 Fig. 3. Application of ASIS to GIS Domain

Table 1 .

 1 Components and common data models matching for sample science domains

	ASIS


Inger Anne Tøndel
email: inger.a.tondel@sintef.no

Bodil Aamnes Mostue

Martin Gilje Jaatun

Gerd Kjølle

Towards improved understanding and holistic management of the cyber security challenges in power transmission systems

Keywords: information security, cyber security, power transmission, indicators

Information and Communication Technology (ICT) is increasingly utilised in the electrical power transmission system. For the power system, ICT brings a lot of benefits, but it also introduces new types of vulnerabilities and threats. Currently the interdependencies between the power and ICT system are not fully understood, including how threats (both malicious and accidental) towards the ICT system may impact on power delivery. This paper addresses the need for improved understanding between ICT security and power experts. It explains important terms used differently in the two disciplines, identifies main impacts on power systems that may result from ICT incidents, and proposes a set of indicators that can be used as a basis for selecting measures.

Introduction

The next-generation electric power system (the smart grid) is central in dealing with emerging energy challenges. In Europe, the goal of 20 % improvement in energy efficiency, 20 % share of renewable energy, and 20 % reduction in greenhouse gas emissions by 2020 is a driver towards a smarter grid where renewable energy can be more effectively introduced, failures can be more easily detected and managed and where customers and their smart appliances consume energy in a more flexible way.

The electric power system can be divided into three main areas: Generation of energy, transmission of energy at high voltage over long distances, and distribution of energy at lower voltage towards customers. The transmission system is already quite smart compared to the distribution system, and most of the smart grid initiatives thus introduce more intelligence into the distribution grid. Advanced Metering Infrastructure (AMI) is one such modernisation.

For power systems, the N-1 principle has guided the work on securing the infrastructure; the power system should withstand loss of any single principal component without causing interruptions of electricity supply. Today however, N-1 security is challenged, mainly due to reluctance towards new power lines, massive integration of renewable energy sources, and the liberalisation of the electricity market. To deal with this, more intelligence has been introduced into the power system. something that has increased the complexity of the power system [START_REF] Panciatici | Operating in the fog: Security management under uncertainty[END_REF]. At the same time as N-1 security is challenged, it is also clear that N-1 security is not enough to prevent major events in the power system, as clearly demonstrated by recent blackouts such as in the US/Canada, Sweden/Denmark and Italy in 2003 [START_REF] Andersson | Causes of the 2003 major grid blackouts in north america and europe, and recommended means to improve system dynamic performance[END_REF], and the Europe blackout in 2006 [START_REF]): Final reportsystem disturbance on 4 november 2006[END_REF].

To be able to secure the power system in a cost-effective way, it is important to understand where the system is most vulnerable and what measures will have most effect. Kröger and Zio [START_REF] Kröger | Vulnerable Systems. 1st edn[END_REF] have provided an overview of approaches for vulnerability assessments of critical infrastructure. All approaches listed require quite detailed knowledge of the system. This is also the case for the quantitative analytical approach commonly taken for risk analysis of electricity supply [START_REF] Kjølle | Risk analysis of electricity supply[END_REF], and for probabilistic modelling that have been pointed out by some as a way to increase cost-effectiveness in the security work [START_REF] Panciatici | Operating in the fog: Security management under uncertainty[END_REF][START_REF] Ciapessoni | Operational risk assessment and control: A probabilistic approach[END_REF]. The deep knowledge of the electricity system, detailed computer models and specialized computer tools required makes such approaches difficult to use when also introducing "new" aspects, such as ICT. The models of the power system are already complex, and ICT components are present all the way from the bays to the control centres, constituting a big distributed ICT system. Creating a unified model that is reasonably correct is not easy. There is also a need to estimate failure probabilities of ICT components. Achieving confidence in such estimates is challenging as estimates will have to be made with limited experience data available. Some of the ICT components are relatively new, the introduction of ICT happens fast, and the threat landscape is constantly changing.

Because of the above challenges, there is a need for approaches that can add value also without excessive modelling effort and that can improve understanding of the interdependencies between power and ICT. To that end, this paper:

contributes to increased mutual understanding between ICT and power experts identifies indicators that can be used to monitor trends when it comes to the risk of ICT security incidents in power systems Currently the interdependencies between the power and ICT system are not fully understood, including how threats (both malicious and accidental) towards the ICT system may impact on power delivery [START_REF]The GRID consortium: ICT Vulnerabilities of Power Systems: A Roadmap for Future Research[END_REF][START_REF]Risk and Interdependencies in Critical Infrastructures -A Guideline for Analysis[END_REF]. As a step towards increased understanding of these interdependencies, this paper address cyber security challenges of the transmission system, considering the ICT technology that can be found in such systems today. Though the focus is on the transmission system, many of the issues identified are likely to be also relevant for smarter distribution systems. The use of indicators can increase the Transmission Service Operator's (TSO's) understanding of the effects ICT have on power system security. This will improve the basis for current decision making at TSOs, especially when it comes to measures needed, and can improve foundations for detailed vulnerability assessments later on. The paper is organised as follows. Section 2 provides a brief overview of ICT components that are used in power transmission systems today. Section 3 provides an overview of central terms, with a main emphasis on terms that are used differently among ICT and power system experts. Section 4 identifies threats towards ICT systems that may impact power delivery. Section 5 gives an introduction to the role of indicators. Section 6 suggests and evaluates candidate indicators that can be used as a starting point by TSOs. Section 7 discusses the contribution of the paper, and Section 8 concludes the paper.

Overview of main ICT components in power transmission systems

The ICT systems used for transmission [START_REF] Egozcue | Smart Grid Security, Anex I. General Concepts and Dependencies with ICT[END_REF][START_REF] Wang | A survey on the communication architectures in smart grid[END_REF][START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF][START_REF]The Future of the Electric Grid[END_REF][START_REF] Wei | Protecting smart grid automation systems against cyberattacks[END_REF] include monitoring, control and regulation systems, protection systems, defence systems, automation systems and communication systems. The transmission system itself is highly distributed and complex. The ICT system is also distributed and dependent on efficient and reliable communication technology. Communication equipment and critical ICT components are usually duplicated. Wei et al. [START_REF] Wei | Protecting smart grid automation systems against cyberattacks[END_REF] divide the major functions of power grids into three levels: the corporate level, the control centre level and the substation level. The corporate level is concerned with business and operation management (more long term), while the control centre level and the substation level are involved in the real-time management of the power system. Important functions of the control centre level is forecasting of load and power generation sources, monitoring of system state, operation, system analysis, making recommendations, processing of alarms, training, logging and data exchange. At the substation level, the main functions are to perform normal operation (collecting data and alarms, sending them to the control centre, and executing commands from the control centre), exchange of protection data within the substation, emergency operation, engineering, logging and maintenance.

Typically, the power system is organised in a hierarchical fashion, where substations are under the control of a control centre, that again may be under the control of higher-level control centres [START_REF] Wei | Protecting smart grid automation systems against cyberattacks[END_REF]. This way you end up with Regional Control Centres (RCCs), National Control Centres (NCCs), and even also transnational control centres. Status information is measured at bay level, collected at substations, and then forwarded to the Supervisory Control and Data Acquisition (SCADA) system. State estimators make the system able to cope with missing or erroneous system variables [START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF]. The SCADA system and EMS (Energy Management System) provide operators with updated status information, and also the possibility to issue commands. Essential in this respect is the communication infrastructure connecting the control centres with the substa-tions and their bays. The substations also have control rooms with monitoring and control capabilities.

In addition to the centralised control scheme, the transmission system also consists of a large number of distributed autonomous intelligent devices that take part in ensuring safe and secure operation of the transmission grid. The most important example is represented by the protection devices [START_REF] Mesbah | Line and system protection using digital circuit and packet communication[END_REF] that have an important role in ensuring any failures have as little impact as possible, e.g. by disconnecting faulty parts of the grid. Protection devices come in different types. Many of them require communication in order to work effectively, and have strict requirements when it comes to response times. Protection devices are usually duplicated at the transmission level.

Lately, more intelligence has been introduced into the power system in form of Special Protection Schemes (SPSs) that are able to implement corrective actions automatically and cover a wider area, and Phase-Shifting Transformers (PSTs) and Static VAR Compensators4 (SVCs) that increase controllability [START_REF] Panciatici | Operating in the fog: Security management under uncertainty[END_REF]. Wide-Area Monitoring Systems (WAMS) provide enhanced situational awareness and thus assist in decision making at control centres [START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF].

It is worth noting that a lot of the components and systems mentioned above, like protections, are not traditionally considered to be ICT. Still, the current development has turned also these devices into small computers that rely on communication. In this paper they are thus considered part of the ICT system.

Terms: Communication challenges between ICT and power experts

Properly addressing the ICT risks of the combined ICT and transmission system requires cooperation between people from different disciplines: experts on electric power systems and experts on ICT, people with dependability background, people working on safety, and people with cyber security background. The terms used vary between the different disciplines, with one of the most confusing terms being "security".

Security, information security and cyber security

In the context of ICT, the work on protecting the systems is usually denoted information security. The key asset to protect is considered to be the information in the systems, and the goal of the information security work is to ensure [START_REF]Information technology -security techniques -information security management systems -requirements[END_REF]:

-Confidentiality: "the property that information is not made available or disclosed to unauthorized individuals, entities, or processes" [15] -Integrity: "the property of safeguarding the accuracy and completeness of assets" [START_REF]Information technology -security techniques -information security management systems -requirements[END_REF] -Availability: "the property of being accessible and usable upon demand by an authorized entity" [START_REF]Information technology -security techniques -information security management systems -requirements[END_REF] The terms computer security and (ICT) network security5 are also sometimes used, and when ICT is used in critical infrastructure, the term cyber security is common. The difference between information security, computer security, network security and cyber security is not clearly defined. It can be argued that information security is a broader term as it includes also information not processed, stored or communicated by means of ICT. Computer security and (ICT) network security is more centred on protecting (specific parts of) the ICT technology. Cyber security is focused on the threats coming from closer integration with the Internet, and seems to be primarily used when talking about the security of industrial control systems. The terms are however often used interchangeably, and their definitions are often quite similar. As an example, the NISTIR 7628 guidelines on smart grid cyber security [START_REF]The Smart Grid Interoperability Panel -Cyber Security Working Group: NISTIR 7628: Guidelines for smart grid cyber security: Vol. 1, smart grid cyber security strategy, architecture and high-level requirements[END_REF] explain cyber security in terms of ensuring confidentiality, integrity and availability of electronic information communication systems. For power systems, however, the term security has a different meaning. According to Kundur et al. [START_REF] Kundur | Definition and classification of power system stability IEEE/CIGRE joint task force on stability terms and definitions[END_REF], "Security of a power system refers to the degree of risk in its ability to survive imminent disturbances (contingencies) without interruption of customer service."

Dependability of ICT systems vs. information security

Dependability of ICT systems can be defined as "the ability to deliver service that can justifiably be trusted", or alternatively "the ability to avoid service failures that are more frequent and more severe than is acceptable" [START_REF] Avizienis | Basic concepts and taxonomy of dependable and secure computing[END_REF]. According to Avizienis et al. [START_REF] Avizienis | Basic concepts and taxonomy of dependable and secure computing[END_REF], dependability is comprised of the five attributes: availability, reliability, safety, integrity and maintainability. Thus, dependability and information security have two attributes in common: integrity and availability. These attributes are essential in automation applications. The confidentiality attribute of information security is however not considered for dependability. Traditionally, dependability has been concerned with non-malicious faults while information security has paid attention to the threats posed by malicious actors. There has however for a long time been a growing understanding among the dependability experts that limiting studies to non-malicious faults implies only addressing part of the problem. Among the information security experts, it is evident that also non-malicious faults can cause severe problems for the confidentiality, integrity and availability of information. This is reflected in standards such as ISO/IEC 27005 [START_REF]Information technology -Security techniques -Information security risk management[END_REF] on information security risk management that specifically states that analyses should include both natural threats and threats with human origin, and also both accidental and deliberate threats. In critical infrastructure protection, the term "all-hazard approach" is often used to emphasise the need to include both natural and man-made events, and also both intentional and unintentional actions [START_REF] Zio | An All-Hazard Approach for the Vulnerability Analysis of Critical Infrastructures[END_REF].

The terms "hazard" and "threat" have similar meanings. The term threat is defined in ISO/IEC 27002 as "a potential cause of an unwanted incident, which may result in harm to a system or organisation" [START_REF]Information technology -security techniques -code of practice for information security management[END_REF]. The term hazard is defined in IEC 61508 as "Potential source of harm" [START_REF]Functional safety of electrical/electronic/programmable electronic safety-related systems[END_REF]. The term hazard is more commonly used for safety and dependability analysis, whereas the term threat is more commonly used for information security6 .

ICT threats relevant for the power system

One step on the way towards a better understanding of the vulnerability that comes from the deep integration of power and ICT systems is to identify the main incidents that may happen in the ICT system, and that may have consequences for power delivery. According to Doorman et al. [START_REF] Doorman | Vulnerability analysis of the nordic power system[END_REF], the major unwanted situations in the energy sector are:

high price: the price of electricity is higher than usual for a long period load curtailment: rationing blackouts: interruptions for longer periods of time As ICT is deeply integrated with the power system, ICT failures may have consequences also along these lines. This is supported by results from the GRID project that identified direct effects ICT system failures may have at the transmission grid level [START_REF]The GRID consortium: ICT Vulnerabilities of Power Systems: A Roadmap for Future Research[END_REF]. Among the effects identified were power system instability, loss of generation capacity and loss of lines and/or corridors, malfunction of protection devices or other devices used for power control, and loss of or corrupted observability (e.g. SCADA or EMS).

As outlined in Section 2, the ICT systems used for transmission include monitoring, control and regulation systems, protection systems, defence systems, automation systems and communication systems. According to a survey performed by Gardner et al. [START_REF] Gardner | A survey of ICT vulnerabilities of power systems and relevant defense methodologies[END_REF], industry and research communities agree that the most critical areas are protection and control. This is because of the role that protection and control systems play in normal and abnormal operation, and also the potential consequences of single errors in these types of systems.

The NERC Cyber Attack Force [START_REF]NERC: Cyber Attack Task Force[END_REF] identified a set of cyber attack scenarios for power systems. The cyber attack scenarios were intended to be used as a basis for operational training, and cover the following unwanted situations: social engineering [START_REF] Orgill | The urgency for effective user privacy-education to counter social engineering attacks on secure computer systems[END_REF] where a false request or false information is sent to an operator; denial of service of EMS network; denial of service of EMS applications; spurious device operations, and; realistic data injection. The cyber attack scenarios listed first are considered more plausible than those listed last.

The different ICT subsystems have different characteristics and may be subject to different types of attacks or failures. Potential threats and vulnerabilities of relevant systems have been documented in several publications. As examples, Wei et al. [START_REF] Wei | Protecting smart grid automation systems against cyberattacks[END_REF] have identified potential network attacks on typical communication links used for smart grid automation systems, and also the potential adverse impacts of such attacks. In addition, they have identified the main targets of attacks on the SCADA system, including the Front End Processor (FEP), the Human Machine Interface (HMI), the Engineering Workstation (EWS), the database systems, the application server, and the controllers. The National SCADA TestBed (NSTB) [START_REF]Common Cyber Security Vulnerabilities Observed in Control System aSsessments by the INL NSTB Program[END_REF] has, based on a number of security assessments of SCADA systems, shared information about what types of cyber security vulnerabilities are commonly found in SCADA systems. Sridhar et al. [START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF] have identified potential cyber vulnerabilities related to state estimation, VAR compensation and Wide-Area Monitoring Systems.

In the following we describe unwanted situations in the ICT system that may cause the effects listed above. The unwanted situations are related to the control and protection area (most critical), and take into account the need for operators to see (observability) what is happening and act (controllability) on what they see. They also consider the potential goal of attackers to influence the state of the system (command injection).

Loss of or corrupted observability

Loss of or corrupted observability happens in cases where operators, either at a regional or national control centre (RCC/NCC), do not have a correct overview of the current state of the system. This may be due to information not being available (loss of observability) or because of erroneous information in the system (loss of integrity). The consequences of unavailable or erroneous information for the power system can vary from no consequences to high consequences. The consequence is dependent on the degree to which observability is lost or corrupted, i.e. the duration of the incident as well as how much of the system is affected. It is also dependent on the state of the system at the time, and what happens while observability is lost or corrupted. The ability to detect corrupted observability is also important. Consequences may be higher if operators are not aware that information is corrupted, and thus may act on the erroneous state information. Loss of or corrupted observability may happen due to:

-Failure of communication equipment or noise on the communication channel, causing data transmission errors, unavailability of the communication line or excessive delays in the communication -Failure of central systems at the RCC/NCC, causing the control centre to be unable to communicate or causing unreliable reception of status updates (random modifications) -Failure of components at the substations, causing the substations to be unable to communicate or causing unreliable status measurements or unreliable processing of status updates at substations -Attack on the communication ability between RCC and substations -Injection of false status information If loss of or corrupted observability is caused by deliberate attackers, this may intentionally hide other malicious activities in the system. Thus, operators are less able to detect the malicious activity and take action. In such cases, the consequences of lacking observability are likely to be higher than when caused by natural failures. False status messages that have been deliberately injected into the system are also more likely to be specifically tailored to trigger specific actions. The total observation of the state of the system may also be changed in a way that seems convincing. Such deliberate corruption of observability by an intelligent adversary is thus more likely to cause major consequences than random failures. Manipulating status information undetected is however very difficult for an attacker, as state estimators verify that the current status information is coherent. To be able to change the state in a coherent way, attackers will require detailed knowledge of the current situations. In addition, attackers must be able to modify all signals and measurements in a coherent way.

Uncontrollability of the system

Uncontrollability of the system happens in cases where operators of the SCADA system are not able to send commands in order to control the power system. Uncontrollability also happens if the components that act on the commands stop responding to commands or responds in an unintended way due to malfunction or an attack. Also in this case, the consequences are dependent on the duration and extent of the uncontrollability, and the state of the system at the time. Loss of controllability may happen due to:

-Failure of communication equipment or noise on the communication channel, causing data transmission errors, unavailability of the communication line or too high delays in the communication -Failure of central systems or components at the substations, RCC or NCC, causing the systems to be unable to communicate or causing unreliable sending or reception of messages -Failure of components that act on commands -Attack on the communication ability of central systems If uncontrollability is caused by attackers, as opposed to random failures, the consequences are likely to be more severe as attackers are likely to cause uncontrollability of central components at a time when such control is needed.

Command injection

Command injection happens if components receive commands that have not been sent by authorised operators. Commands may be injected by attackers that have gained access to system components or the communication channel, but may also happen due to malfunction of equipment. If attackers are able to inject commands that are acted upon (e.g. open/close breakers), they can cause a lot of damage. Though operators are trusted, it is also important to be aware of the potential of operators to cause harm intentionally or due to mistakes. Attackers may also cause injection of unnecessary and potentially harmful commands indirectly by tricking operators to take unnecessary actions. This may happen due to erroneous information in the system (see Section 4.1) or through social engineering attacks [START_REF]NERC: Cyber Attack Task Force[END_REF].

Protection system malfunction

Protection systems are essential for power system security, and protection system malfunction may have severe consequences for the power system [START_REF] Kjølle | Protection system faults -a comparative review of fault statistics[END_REF]. Protection system malfunction may be caused by, e.g.:

-Protection systems with incorrect settings, either by mistake or by intent -No communication or excessive delays in communication between protection systems -Spurious tripping (caused by technical fault or human error) -Desynchronized protection systems -Errors in protection communication, either due to failures or due to modification by a malicious attacker

It is important to be aware that the protection systems operate under strict time conditions, where fault detection, protection decision and isolating device operation must happen in the space of milliseconds [START_REF] Mesbah | Line and system protection using digital circuit and packet communication[END_REF].

An introduction to indicators

The potential unwanted situations described above motivate the need to properly include ICT in work on power system security. As pointed out in the introduction, this is however not trivial and there is a need for improved understanding on the role ICT actually plays and how to properly grasp this in power security analyses. Using indicators is one way to increase understanding.

An indicator is a measurable and operational variable that can be used to describe the condition of a broader phenomenon or aspect of reality [START_REF] Øien | Risk indicators as a tool for risk control[END_REF]. The word indicator comes from the verb indicate, which means to designate or to show. An indicator gives a simplified signal of a condition or change in condition, and indicators are typically used when the phenomenon itself is too complicated or too expensive to measure directly. The typical properties of indicators are [START_REF] Øien | Building safety indicators: Part 1 theoretical foundation[END_REF]:

-They provide numerical values (a number or a ratio).

-The indicators are easily updated at regular intervals.

-They only cover some selected determinants of overall safety, security or risk, in order to have a manageable set.

Both individual indicators and their combinations can be useful since one can create a simplified description of the vulnerability level in the system and assess the expected performance and its development. Indicators can be used to see the long-term evolution (trends over months or even years), but also to observe sudden changes. Indicators can be characterised as leading (proactive, i.e., things that happen before an incident) or lagging (reactive, i.e., things that happen as a cause of or after an incident).

Table 1. Overview of approaches to identify indicators Approach Description Risk based methods [START_REF] Øien | Risk indicators as a tool for risk control[END_REF][START_REF] Vinnem | Risk modelling of maintenance work on major process equipment on offshore petroleum installations[END_REF] Utilize a risk model as a basis. This is usually an existing risk model, but the development of a risk model may also be part of the method. Safety performance based methods [START_REF]Development process safety indicators. a step-by-step guide for chemical and major hazard industries[END_REF][START_REF]Process safety leading and lagging metrics[END_REF][START_REF]OECD): Guidance on developing safety indicators related to chemical accident prevention, preparedness and response[END_REF][START_REF]Final report on leading indicators of human performance[END_REF] Start from a set of influencing factors assumed to be important to safety. Incident based methods [START_REF] Øien | Development of early warning indicators based on accident investigation[END_REF] Identifies indicators by an in-depth study of one or more incidents or accidents. Resilience based methods [START_REF] Øien | Development of early warning indicators based on resilience engineering[END_REF] Identify indicators of human and organisational performance in a resilience perspective Table 1 provide an overview of existing approaches for developing indicators. Risk based methods are based on the hypothesis that risk control can be achieved through the control of risk influencing factors (RIFs), which are those factors having effect on risk. The conditions for this hypothesis to be true are that 1) All relevant RIFs are identified, 2) The RIFs are measurable and 3) The relationship between RIFs and risk is known. Safety performance indicators are based on important factors, but they are not related to a risk analyses. This also applies to incident based methods and resilience based methods. The resilience based method differs from the others by focusing on positive signals ("what went right" and why), rather than failures ("what went wrong").

The methods differ in scope and depth of analysis. The risk based approaches will cover the whole installation and all risks, since these methods narrow the focus to the most important risk factors. The resilience based approach can in principle also cover a complete installation with all its risks. The performance based methods will usually narrow the scope to certain systems or activities. The incident based methods will usually only cover specific systems and not a complete installation, but may go deeper into an area or system, which the other methods perhaps will not cover. Also, with the risk based methods it is easy to determine the risk significance, including relative risk importance between the various risk influencing factors. A main weakness with the other methods is that the risk significance and the relative importance of influencing factors or causes are unknown.

The literature describes a number of desirable properties for an indicator; but in practice, it appears very challenging to find indicators that meet all the requirements which are desirable. Below we list a selection of criteria for good indicators [START_REF] Rockhwell | Safety performance measurement[END_REF][START_REF] Kjellén | The safety measurement problem revisited[END_REF][START_REF] Kjellén | Prevention of Accidents through Experience Feedback[END_REF][START_REF] Vinnem | Risk indicators for major hazards on offshore installations[END_REF][START_REF] Herrera | Proposing safety performance indicators for helicopter offshore on the norwegian continental shelf[END_REF]:

-Relevance (meaning): The indicator value is assumed to be (strongly) correlated with either event frequency or consequence; or possibly with influencing factors or important parameters of a risk or vulnerability model; e.g. with Risk Influencing Factors (RIFs) of an influence diagram. -Availability: Data to calculate the indicator can be acquired at a reasonable cost. -Reliability: Data measured is regarded as being objective and without significant sources of error. -Completeness: The total set of indicators should be complete, i.e. should cover all major types of hazards and system vulnerabilities. -Ownership: A sense of "ownership" should be instilled in the users of the indicators (this is hopefully a consequence of the other criteria).

6 Cyber security indicators for TSOs: An initial set

To assess the vulnerability of the complete power and ICT system, it would be beneficial to create a risk model of the power system incorporating the ICT aspects, where all risk influencing factors are identified and measureable, and the relationships between the risk influencing factors are known. Risk indicators can then be used to describe the condition of risk influencing factors. However, it is very challenging to achieve this, because of the complexity of the system and the dynamics of an incident; there are many potential courses of events following a single incident, and human and organisational factors play a vital part in deciding how the skein will unravel. Furthermore, new types of threats and attacks are constantly emerging, and there is a lack of historical experience data. It is a challenge to estimate the contribution of human and organisational factors to the risk in a system. Detailed risk calculations will give results with considerable uncertainty due to the uncertainty related to such risk modelling, estimation of risk influencing factors, the relationships between them and lack of data. Due to the current limited understanding of how ICT influences power system security, we have chosen to use a more simple approach to identifying indicators in this work. The literature describes several metrics that can be useful to measure trends of risk influencing factors [START_REF]Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines (CAG)[END_REF][START_REF] Herrmann | Complete Guide to Security and Privacy Metrics[END_REF][START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF][START_REF] Øien | Development of early warning indicators based on resilience engineering[END_REF]. Based on this literature we have selected a set of indicators which can be relevant to improve understanding of the risk related to ICT incidents for transmission systems. About half of the indicators are based on indicators suggested by Gelbstein [START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF] (I3-5, I8, I13-14, I16, I18-20 in Table 2) and the rest were identified during a workshop with four experts on ICT, power systems and the use of indicators (I2, I6-7, I9-11, I17) or in discussions with colleagues before the workshop (I1, I12, I15). In the workshop all identified indicators were assessed based on their relevance, availability and reliability.

The selection of indicators has the following limitations:

-The hazards/threats mainly cover malicious attacks (security), but dependability issues (hardware and software problems) are also considered.

- The factors and conditions that are taken into account and that may influence the security of the transmission systems are: threats to the ICT system, unwanted events, the performance of barriers of the ICT system, availability of the ICT system, and resilience of the TSO's organisation. An overview of the indicators and their evaluation score, as regards relevance (C1), availability (C2) and reliability (C3), is shown in Table 2. Scores were given from 1-5, where 5 is best.

Discussion

Today, the electrical power system is strongly dependent on ICT. Common cause failures can affect both infrastructures due to location-specific and functional interdependencies. There is a need to analyse how power systems and ICT interact and depend on each other, and these insights are lost if the technologies from these two disciplines are only studied separately. For efficient cooperation between power system and ICT experts, it is however crucial to take into account the difference in culture and use of terms in the two disciplines.

The combined power and ICT system is complex and highly distributed. Existing methods for vulnerability analysis often require quite explicit and detailed knowledge of the system. Currently, such deep knowledge is not available when it comes to the interrelations between power systems and ICT. There is thus a need to improve the understanding of the role of ICT, including the potential consequences of unwanted ICT incidents when it comes to power delivery. In this paper we contribute towards this by providing an overview of potential ICT incidents that may have such consequences. We also propose an initial set of indicators that can be used to monitor and improve understanding of the security of the ICT components and their influence on power system security.

It is not possible to measure the safety, security or vulnerability of such a complex system directly. Indicators can be used to measure factors that are important for the vulnerability of a system, and particularly the trends associated with such factors. In a complex system, there are several such factors and thus a high number of potential indicators. Still, it is important to have a manageable set of indicators that can be regularly monitored and followed up. The indicators suggested in this paper represent a first step towards identifying relevant indicators for TSOs that wish to monitor ICT risks and their impact on power security. Further work should include further identification, evaluation and testing of indicators, and should examine more carefully the interrelations and coverage of the suggested indicators. The usefulness of indicators depend on how they are used in the organisation. An indicator or a combination of indicators with values outside the predetermined acceptable limits usually require actions. Input from indicators can also be used in deciding whether additional measures are necessary.

Conclusion

Terminology is a challenge in a multidisciplinary field, and best results are achieved when terms are explicitly defined. Many information security challenges can affect power transmission systems, and using indicators is a promising way to work proactively with information security in a traditionally safety-oriented domain.

  A variant of a safety performance based method is used in the development of indicators, i.e. identifying indicators from factors that influence the security based on literature and expert knowledge. -The identified indicators must be considered as examples, not an exhaustive list. -The indicators are numerical values, monitored automatically or easily updated at regular intervals.

Table 2 . 3 I6: 3 I7: 4 I9: 4 5 4 I10: 4 I11: 3 I13: 45 ] 3 4 4 I14: 5 I19: 4 I20:

 2334444345454 Overview of indicators; C1 = Relevance, C2 = Availability, C3 = Reliability Influencing factor Indicator C1 C2 C3 Threats I1: Measurement describing the network traffic 3 5 5 I2: Number of events (e.g. number of malicious attacks) of a certain type during e.g. the last month of orphaned accounts for access to sensitive information or critical systems [45] 4 4 Percentage share of identified software vulnerabilities not patched 4 3 Number of former employees still having access 4 5 4 AvailabilityI8: Total downtime (per critical ICT system) in the period reported (planned and not planned)[START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF] 3 5 Total downtime in the power system due to ICT interruptions in the period reported (planned and not planned) Number of interruptions with downtime in the ICT system (operation regularity) 3 5 Number of interruptions with downtime in the power system due to ICT (operation regularity) of personnel (%) working in ICTsystems with formal expertise in ICT 4 4 Number of unfilled positions in the ICT organisation [Number of "near misses" in information security activities where no incident occurred, but could happen with small changes in the events[START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF] of related critical audit recommendations that have not been implemented[START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF] 4 4 Number of high impact items registered where mitigation activities have not been completed[START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF] 4 4 Number of information security processes or activities carried out by a single individual for whom there is no immediate backup or replacement[START_REF] Gelbstein | Designing a Security Audit Plan for a Critical Information Infrastructure (CII)[END_REF]

Volt-Ampere Reactive (VAR) compensators control reactive power injection or absorption in order to improve the performance of the transmission system[START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF]

The term 'network' in network security' refers to the ICT network, not the power network.

Note that some definitions of the term "threat" only include intentional and malicious acts[START_REF] Zio | An All-Hazard Approach for the Vulnerability Analysis of Critical Infrastructures[END_REF].

Acknowledgments

The work has been done as part of the AFTER project funded by EU, grant. nr. 267188. The authors would like to thank the other partners in this project for their cooperation, and especially the Coordinator Emanuele Ciapessoni from RSE.