Richard White

Aaron Burkhart

Edward Chow

Logan Maynard

A Decision Support Tool for a Unified Homeland Security Strategy

Keywords: Risk management, asset vulnerability model, decision support tool

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The events of September 11, 2001 and their aftermath exposed the vulnerability of the critical infrastructure to asymmetric domestic attacks. The 2002 Homeland Security Act made critical infrastructure protection a core mission of the Department of Homeland Security (DHS). From the outset, DHS's goal has been to develop a program that would "establish standards and benchmarks for infrastructure protection and provide the means to measure performance" [17]. Quantifiable metrics are not only essential to developing coherent strategy, but they are also the law under the 1993 Government Performance and Results Act. Nevertheless, despite successive attempts over the ensuing years [START_REF]Draft National Infrastructure Protection Plan, Base Plan[END_REF][START_REF]Presidential Directive 8: National Preparedness[END_REF][4][5], a 2010 review of DHS's approach to risk analysis conducted by the National Research Council [START_REF]Review of the Department of Homeland Security's Approach to Risk Analysis[END_REF] "did not find any DHS risk analysis capabilities and methods that are as yet adequate for supporting DHS decision making." Arguably, the absence of viable metrics and standards have beset attempts to identify the critical infrastructure [START_REF] Moteff | Critical Infrastructure: The National Asset Database, CRS Report for Congress, Order Code RL33648[END_REF], assess and analyze risks [START_REF]Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments[END_REF] and allocate resources [START_REF] Masse | The Department of Homeland Security's Risk Assessment Methodology: Evolution, Issues and Options for Congress[END_REF] all of them basic steps in the Risk Management Framework that underpins the current National Infrastructure Protection Plan [START_REF]NIPP 2013: Partnering for Critical Infrastructure Security and Resilience[END_REF]. While much research has been conducted on infrastructure [START_REF] Lewis | Model-based risk analysis for critical infrastructures[END_REF] and terrorism [START_REF] Loo | The evolution of terrorism risk modeling[END_REF] risk modeling, a cursory analysis of 21 models [START_REF] Giannopoulos | Risk Assessment Methodologies for Critical Infrastructure Protection, Part I: A State of the Art[END_REF] determined that not one of them satisfied fundamental challenges cited in the National Research Council report [START_REF] White | Towards a unified homeland security strategy: An asset vulnerability model[END_REF]. That no effective metrics have been found is indicated by the lack of supporting risk analysis in the 2014 DHS budget request to Congress [START_REF]Budget-in-Brief, Fiscal Year 2014[END_REF]. Without a viable metric, DHS is unable to assess the current protective status, evaluate future protective improvement measures and justify national investments.

This paper describes a decision support tool based on an asset vulnerability model (AVM) that is designed to lend strategic direction to critical infrastructure protection efforts [START_REF] White | Towards a Computational Unified Homeland Security Strategy: An Asset Vulnerability Model[END_REF]. AVM-DST is a web-based application that allows decision makers to view infrastructure asset risk profiles that highlight various features of interest, select protective improvement measures within a given budget based on investment strategies or other criteria, and evaluate protective purchases against varying probabilities of attack over a given period of time.

AVM Overview

In 2013, an asset vulnerability model (AVM) was developed to overcome the challenges cited in the National Research Council report [START_REF]Review of the Department of Homeland Security's Approach to Risk Analysis[END_REF] and provide DHS with a quantitative means to guide strategic investments in critical infrastructure protection [START_REF] White | Towards a Computational Unified Homeland Security Strategy: An Asset Vulnerability Model[END_REF]. AVM is a risk analysis methodology that works within the DHS Risk Management Framework to provide a baseline analysis, cost-benefit analysis and decision support tools that provide guidance in selecting critical infrastructure protective improvement measures. AVM is predicated on a measure designated as Θ, which represents the attacker's probability of failure. The selection of Θ was informed by the game theoretic research of Sandler and Lapan [START_REF] Sandler | The calculus of dissent: An analysis of terrorists' choice of targets[END_REF] that evaluates defensive strategies based on an attacker's choice of target. The Θ formulation is constructed from five parameters corresponding to the five phases of emergency management -prevent, protect, mitigate, respond and recover [START_REF] Lindell | Fundamentals of Emergency Management[END_REF]:

Θ = P (dis) • P (def ) • P (den) • P (dim) • P ct(dam) ( 1 )
where P (dis) is the probability that an attack can be detected or disrupted, P (def ) is the probability that an attack can be defeated, P (den) is the probability that a worst case disaster can be averted, P (dim) is the probability that 100% of the survivors can be saved and P ct(dam) is the decrease in economic output times the percentage increase in mortality rate.

P (dis) corresponds to the "prevent" phase of emergency management and is calculated from known intelligence data by dividing the number of thwarted attacks by the number of planned attacks (only planned attacks that were discovered; presumably they were thwarted before execution) and executed attacks culled from available sources such as the Global Terrorism Database (www. start.umd.edu/gtd). P (def ) corresponds to the "protect" phase of emergency management and is derived from the protective measure index (PMI) assessed by Argonne National Laboratory [START_REF]Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments[END_REF] from data collected in DHS security surveys and vulnerability assessments. P (den) corresponds to the "mitigate" phase of emergency management and may be derived from the resilience index (RI), also calculated by Argonne National Laboratory [START_REF] Giannopoulos | Risk Assessment Methodologies for Critical Infrastructure Protection, Part I: A State of the Art[END_REF], that assesses failure modes and redundancies. P (dim) corresponds to the "response" phase of emergency management and may be expressed as the percentage of survivors that first responders can rescue and treat within 72 hours of a catastrophe as determined by DHS data collected from the Threat and Hazard Identification and Risk Assessment (THIRA) Program [START_REF] White | Towards a Computational Unified Homeland Security Strategy: An Asset Vulnerability Model[END_REF]. The P ct(dam) parameter represents both the "recovery" phase of emergency management and the magnitude component of the risk formulation. The parameter is computed as the product of the change in the Gross Domestic Product (GDP) and national homicide rates expected from the loss of a particular asset. According to data from the Bureau of Economic Analysis and the National Center for Health Statistics, the 9/11 attacks registered a 47% decrease in the GDP, down from 6.43% in 2000 to 3.38% in 2001, and a 20% increase in national homicides, up from 5.9 to 7.1 deaths per 100,000 from 2000 to 2001.

The chief criticism leveled by the National Research Council was the inability to produce reliable threat estimates (i.e., "probability of attack") for humaninitiated (i.e., "threat-driven") events because of a dearth of data to support robust statistical analysis [START_REF]Review of the Department of Homeland Security's Approach to Risk Analysis[END_REF]. AVM overcomes this challenge by adopting an "asset-driven" risk assessment methodology and replacing "threat estimation" with "threat localization." Threat localization realizes that even with a robust set of data, as in the case of natural phenomena, it is still impossible to predict exactly where and when the next natural disaster will occur. The best forecasters can do is localize the problem to justify protective investments. Thus, while earthquakes are national phenomena, their prevalence along the West Coast justifies the more stringent seismic standards imposed in California compared with those imposed in Connecticut. Localization can be similarly achieved for the critical infrastructure without the benefit of a robust data set.

Homeland Security Presidential Directive #7 directs the protection of assets "whose exploitation or destruction by terrorists could cause catastrophic health effects or mass casualties comparable to the use of a weapon of mass destruction... [or] have a debilitating effect on security and economic wellbeing" [START_REF]Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization and Protection[END_REF]. Of the sixteen infrastructure sectors currently categorized by the federal government [START_REF]The White House, Presidential Policy Directive -Critical Infrastructure Security and Resilience, Presidential Policy Directive/PPD-21[END_REF], only the nine sectors listed in Table 1 may be targeted to precipitate mass or debilitating effects. According to the National Research Council, a good risk analysis (i) conveys current risk levels; (ii) supports cost-benefit analysis; (iii) demonstrates risk reduction effects across multiple assets at different levels of management; and (iv) measures and tracks investments and improvement in overall system resilience over time [START_REF]Review of the Department of Homeland Security's Approach to Risk Analysis[END_REF]. Working within the DHS Risk Management Framework, AVM can convey current risk levels through a baseline analysis of the critical infrastructure sectors identified in Table 1 using the Θ risk formulation in Equation [START_REF] Clauset | Estimating the historical and future probabilities of large terrorist events[END_REF]. AVM can further facilitate cost-benefit analyses of proposed protective improvement measures using the following formulation:

∆Θ = P (∆dis) • P (∆def ) • P (∆den) • P (∆dim) • P ct(dam) D(∆Θ) = D(∆dis) + D(∆def ) + D(∆den) + D(∆dim)
Each proposed measure has an associated ∆Θ protective gain and D(∆Θ) implementation cost. Multiple protective improvement measures may be proposed for a given asset, for assets within a region or for assets across the nation. AVM cost-benefit analysis calculates a ∆Θ and D(∆Θ) for every combination of proposed improvement measures and identifies the combination that provides the greatest protective gain for the least cost. In this manner, AVM can narrow down a list of candidates to those that offer the best value.

AVM works with and supports the DHS Risk Management Framework. Starting in Step 2 (Identify Infrastructure) of the framework, AVM restricts the problem set to the nine critical infrastructure sectors identified in Table 1, overcoming past problems with developing a definitive National Asset Database, assessed by a DHS Inspector General as containing "many unusual or out-ofplace assets whose criticality is not readily apparent, and too few assets in essential areas" [START_REF] Moteff | Critical Infrastructure: The National Asset Database, CRS Report for Congress, Order Code RL33648[END_REF]. An AVM baseline analysis unifies data collection efforts by the DHS Enhanced Critical Infrastructure Protection (ECIP) Program [START_REF]Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments[END_REF] working inside the perimeter and by the Threat and Hazard Identification and Risk Assessment System working outside the perimeter [8] in Step 3 (Assess and Analyze Risks) of the Risk Management Framework. AVM cost-benefit analy- sis, perhaps conducted by the National Infrastructure Simulation and Analysis Center (NISAC), can identify the optimum combination of proposed protective improvements competing for Homeland Security Grant Program (HSGP) funding in Step 4 (Implement Risk Management Activities) of the Risk Management Framework. At every step and at all levels of the Risk Management Framework, AVM-DST can facilitate strategic analysis and decision making as described in this paper.

AVM-DST Capabilities and Functions

AVM-DST is a web-based application that allows decision makers to view infrastructure asset risk profiles that highlight various features of interest, select protective improvement measures within a given budget based on defined investment strategies or other criteria, and evaluate protective purchases against varying probabilities of attack over a given period of time.

Viewing a Risk Profile

Figure 1 shows a critical infrastructure risk profile by asset ID number. Real data is not available because it is protected from disclosure under the 2002 Homeland Security Act, even overriding requests made under the Freedom of Information Act. In the AVM-DST display, the current Θ protective values of assets are represented by blue bars. The current Θ protective values are derived from the AVM baseline analysis. The taller the bar, the better the asset is protected. The notional ID number of an asset is listed on the xaxis. Red bars indicate ∆Θ, which is the additional protection to be gained by purchasing measures recommended by AVM cost-benefit analysis.

AVM-DST enables decision makers to examine the current critical infrastructure risk profile from a number of different perspectives. For example, Figure 2 shows the same assets sorted by Θ, identifying the most protected to the least protected assets. Similarly, the data may be sorted by asset type to display the relative protection of assets in the same sector, or by asset location to depict the relative protection of assets in a given geographic region. Other views may also be generated as desired.

Selecting Protective Improvements

AVM-DST assists decision makers with selecting protective improvements for purchase. Each protective improvement, indicated by a red bar in Figure 2, has an associated cost value. AVM-DST assists decision makers in selecting protective improvements within the available budgetary constraints. AVM-DST does this by allowing decision makers to select improvements individually or collectively. Individually, the decision maker can select protective improvements by simply clicking on the associated red bars. Collectively, the decision maker can have AVM-DST automatically select protective improvements based on one of seven investment strategies: (i) least cost; (ii) least protected; (iii) region protection; (iv) sector protection; (v) highest ∆Θ; (vi) highest consequence; or (vii) random protection.

The least cost investment strategy purchases all protective improvement measures based on the lowest cost. Given a fixed budget, this strategy attempts to purchase as many protection measures as possible, regardless of their individual protective gain. The advantage of this strategy is that it affords the purchase of the largest number of protective measures, which may make it politically attractive to "share the wealth" among more congressional districts.

The least protected investment strategy purchases protective improvement measures for the assets that have the least protection as determined by their Θ values. This strategy has the intuitive advantage of allocating resources where they are most needed or at least towards assets that are the most vulnerable. The region protection investment strategy purchases protective improvement measures for regions of the country that are deemed to be more susceptible to attacks than others. This strategy is similar to that used by the Urban Area Security Initiative (UASI) Grant Program administered by DHS.

The sector protection investment strategy allocates funds to a specific sector that is deemed to be more susceptible to attack or whose incapacitation or destruction is considered to have significant damage effects.

The highest ∆Θ investment strategy allocates funds to protective improvement measures that provide the highest ∆Θ protection gain regardless of cost. This may be considered to be a cost optimization scheme by purchasing protective measures that provide the highest return on investment.

The highest consequence investment strategy allocates funds to assets with the highest magnitude component in terms of national economic and mortality consequences as determined by the product of their P (dim) and P ct(dam) values. Like the least protected investment strategy, this strategy has the intuitive advantage of allocating resources where they are most needed in terms of the damaging effects.

The random protection investment strategy purchases protective improvements without regard to any properties of the measure or asset. This strategy was created to gain insight into the effects of non-systematic purchases, roughly mimicking current practice.

To engage a strategy, the decision maker must select the desired strategy, enter the amount of budgeted funds and click "Allocate." AVM-DST automatically selects the available protective improvements within the given budget amount and uses green bars to indicate their purchase. Additional information regarding each selected improvement is displayed in the detail grid panel as shown in Figure 3. Decision makers may further customize their choices by clicking on asset records in the detail grid panel and deleting them from the selection.

Evaluating Protective Improvements

AVM-DST assists decision makers in evaluating their proposed protective improvement purchases through an attack simulator. The attack simulator is engaged by specifying the probable period of attack and number of simulations before clicking the "Simulate" button. The attack simulator graphs the total amount of damage suffered over the probable attack period across a range of attack probabilities as shown in Figure 4. Clauset and Woodard [START_REF] Clauset | Estimating the historical and future probabilities of large terrorist events[END_REF] have estimated that there was an 11% to 35% chance of a 9/11-scale terrorist attack in the 40-year period between 1968 and 2007. Moreover, they estimated a 19% to 46% chance of another such attack over the next ten years.

AVM-DST uses the revised Θ values from protective improvement purchases to compute the damage based on the probability of a successful attack. The simulation begins by calculating an annual attack expectancy. The attack expectancy is calculated by dividing the current probability of attack by the probable attack period. So, for example, an estimated 30% probability of attack over ten years has a 3% annual attack expectancy. AVM-DST generates a uniform random number between zero and one that represents the probability of attack during a given year. A probability of attack that is less than the annual attack expectancy indicates that an attack was initiated. Whether or not the attack is successful depends on the target. AVM-DST selects the target with the lowest Θ value in accordance with the position of Sandler and Lapan [START_REF] Sandler | The calculus of dissent: An analysis of terrorists' choice of targets[END_REF] that attackers will choose targets for which they are the least likely to fail. AVM-DST then generates a uniform random number between zero and one that represents the attacker's probability of success. Next, it calculates a probability of failure as the product of P (dis), P (def ) and P (den) for the selected target. These components correspond to the prevent and protect phases of emergency management. If the probability of success is greater than the probability of failure, then the attack is deemed a success and the asset is removed from further simulation. AVM-DST calculates the damage from a successful attack as the product of P (dim) and P ct(dam) corresponding to the response and recovery phases of emergency management. The collective damage assessments for each attack probability are averaged over the number of specified simulations. More simulations provide finer results, but they also take longer to execute.

AVM-DST User Features and Options

The range of AVM-DST robust capabilities and functions are easily accessible from a compact interface that supports a variety of user features and options.

Compact User Interface

The AVM-DST user interface is differentiated into six display panels presented on a single screen as shown in Figure 5. Each panel facilitates a different application function. The three panels at the top are the control panels, which facilitate user input and control over AVM-DST capabilities. The two panels in the middle are the chart panels: Panel 4 is the main chart that shows assets by their current and improved Θ protective values and Panel 5 is the secondary chart that shows the damage results from attack simulations across a range of probabilities. Both chart panels are fully interactive and support zooming and panning. Panel 6 at the bottom is the asset detail grid panel, which displays detailed record information for each asset selected for protective improvement purchases. This panel is interactive in that records may be added, sorted and deleted from display.

Data Handling and Visualization

AVM-DST provides an extensive set of data handling and visualization capabilities to (i) import assets; (ii) visualize assets; (iii) sort assets; (iv) edit improvements; and (v) export improvements.

Import Assets: AVM-DST imports critical infrastructure asset data from AVM cost-benefit analysis in the comma-separated value (CSV) format. The output file from AVM cost-benefit analysis contains a single record for each asset that identifies its attributes and nominated protective improvements. The following actions must be performed to import an asset file:

-Click the "Browse" button on the chart control panel (Figure 6).

-Select the desired asset file to upload.

-Click "Open" to import the file.

Visualize Assets: Imported assets are automatically displayed in the main chart panel. Each asset is depicted as a bar that represents its current Θ value. The greater the value, the more the asset is protected. The Θ value is updated and displayed as a green bar when protective improvements are selected. The main display also places an "X" below assets that are destroyed in an attack simulation. The damage results from an attack simulation is displayed in the secondary chart panel. The chart shows the calculated damage for different attack probabilities. The following actions must be performed to zoom and pan in each display:

-Zoom into the chart by clicking and dragging from one point on the chart to another to expand the corresponding subsection of the chart. -Pan the chart after it has been zoomed by clicking "Pan" and then click and drag the chart to scroll the chart horizontally. To go back to the zoom mode, click "Zoom." -Click "Reset" to restore the chart to maximal zoom.

Sort Assets: AVM-DST also allows users to examine critical infrastructure assets from different perspectives by sorting assets in the main chart panel. The following actions must be performed to sort assets: -Click the "Sort By" box and select the field to use in sorting.

-Click the "Direction" for sorting and select either ascending or descending.

-Click "Sort" to update the chart.

Edit Improvements: The record details for assets selected to receive protective improvements are displayed in the asset detail grid panel. AVM-DST allows users to sort this data by clicking the column header associated with the field that is to be sorted. AVM-DST also allows users to remove selected asset improvements by right clicking on the desired record and choosing "Delete."

Export Improvements: Selected improvements may be exported in a CSV file to support implementation efforts. The following actions must be performed to export selected improvements:

-Click "Export" on the chart control panel (Figure 6).

-Depending on the browser being used, open the file immediately by selecting the program with which to open it or save the file to the browser-specific download directory.

Selection of Protective Improvements

As described above, AVM-DST assists decision makers in selecting the desired protective improvements either individually or collectively. To select an improvement individually, a user has only to click on the desired asset indicated by a blue or red bar. The Θ value for the selected asset is updated and is replaced by a green bar. Additionally, the record details associated with the selected asset are displayed in an Excel-like format below the main chart panel. The following actions must be performed to select improvements collectively using one of the predefined investment strategies: Click the "Selection Model" dropdown box (Figure 7).

For the region protection and sector protection models, specify the desired region and sector numbers.

Enter a dollar amount in the "Budget" field.

Decision Analysis and Evaluation

As described above, AVM-DST provides a means for a decision maker to assess the effectiveness of an investment strategy by running attack simulations. Each simulation determines if assets are attacked and calculates the total damage due to the attacks over a given period of time. Presumably, the best strategy results in the least amount of damages. The attack simulation results are displayed in the secondary chart panel. The following actions must be performed to run an attack simulation: Enter a number of years in the "Probable Attack Period" field in the simulate control panel (Figure 8).

Enter the number of times to run simulations in the "Number of Simulations" field.

Click "Simulate." AVM-DST executes the specified number of simulations and displays the results in the secondary chart, showing the total damage corresponding to each attack probability. The assets that have been destroyed are marked with an "X" on the main chart.

AVM-DST Implementation

AVM-DST was constructed in phases using an incremental development process. Phase 1 developed the visualization and data handling capabilities. Phase 2 added the decision support and decision analysis features. AVM-DST is written in JavaScript and utilizes the Ext JS application framework along with the CanvasJS charting plugin. This enables AVM-DST to run with any browser.

Architecture

AVM-DST is a stand-alone, client-side, browser-oriented web application built using JavaScript and HTML5. It does not currently contain any server side components. It was built using the model-view-controller paradigm, which is recommended, albeit not required, for Ext JS applications. In this paradigm, the model is the representation of the data to be used. The model describes the objects and their fields and specifies object relationships and hierarchies. It also includes the functions used to manipulate the data. Ext JS uses data stores to load, handle and manipulate collections of model instances. A view serves as the visual interface between the user and the application. This includes windows panels and widgets that facilitate input from the user and display output. The controller handles the business logic of the application. It reacts to events and updates the models and views accordingly.

Development

AVM-DST v1.0 was a proof-of-concept prototype. It included the basic functionality for importing, displaying and sorting asset data. AVM-DST v1.0 used Ext JS built-in charts that did not support zooming and panning. Also, performance issues restricted the number of assets to no more than a few hundred.

AVM-DST v2.0 used CanvasJS to dramatically increase performance and add zooming and panning. This one change enabled AVM-DST to be used to manipulate thousands of assets. It also allowed record details of selected assets to be displayed below the main chart are exported in the CSV format.

AVM-DST v3.0 marked the Phase 2 development by incorporating decision support and analysis tools. It included the control panels, but only the chart and allocate panels were functional. AVM-DST v3.0 did not implement the attack simulation functionality.

AVM-DST v4.0 added the attack simulation functionality. It also added the secondary chart panel to display the results.

AVM-DST v5.0, the current version, fixed the bugs identified in the previous version and optimized the attack simulation algorithm to run faster and accommodate more simulations over longer probable attack periods.

Performance

AVM-DST was tested on a machine running Windows 7 64-bit with a 3.2 GHz Intel Core i7-4770k CPU and an NVIDIA GeForce GTX 770 GPU. The browser used during testing was Firefox 26.0 and the input test file contained 1,000 records. The least cost investment strategy required the most time to run for this data set, so it was used predominantly during performance testing. Simulation times were recorded using a ten-year probable attack period with ten simulations and 1,000 simulations. The time to run simulations is not always directly proportional to the number of simulations because of a constant pre-processing time for tasks (e.g., sorting) that are only done once regardless of the number of simulations. Table 2 shows the run times of various functions.

Lessons Learned

Performance is always a concern when handling thousands of data records, especially when using web technology. AVM-DST is a stand-alone client-side web application. Because it does not require server-side interaction after it is initially loaded, it does not experience network delays or server-side processing delays that are commonly associated with web applications. AVM-DST was tested using a data file containing 1,000 records and is expected to be able to handle much larger data files.

Initially, the application utilized the built-in Ext JS charts that rely on SVG technology. Because of this, AVM-DST experienced performance problems when handling charts. The browser crashed when the application was tested on the 1,000-record file. Efforts were made to mitigate the problem by implementing paging functionality that loads portions of the data at a time. However, this was not ideal. For this reason, CanvasJS was incorporated because it can quickly and seamlessly handle thousands of data points in the charts.

The asset selection decision support tool must sort the data based on the selection model and then iteratively evaluate each asset for selection. This process is fairly quick so the real performance bottleneck arises when populating the grid with the selected assets.

The performance of the decision analysis tool does not depend on the size of the input file because it only considers the asset that is most likely to be attacked at each iteration. Instead, it is dependent on the probable period of attack and the number of simulations to be performed. Before optimization, this algorithm removes the destroyed assets from the data set during each iteration and then restores and re-sorts them during the next simulation. To prevent the browser from becoming unresponsive, the number of simulations was limited to ten and the probability of attack was incremented in five percent intervals. After optimization, the algorithm sorted only once, then maintained a counter that referenced the next asset being considered and incremented the counter when it was destroyed. On the next simulation, the counter was then reset to zero. In this manner, a substantial amount of file overhead was eliminated by performing only a single sort and not removing the destroyed asset records. These changes resulted in significant performance improvement. They also afforded greater simulation resolution, allowing the probability of attack to be incremented only one percent at each iteration, but still executing 1,000 simulations in less than three seconds.

Conclusions

AVM-DST leverages the AVM risk methodology to enable decision makers to view infrastructure asset risk profiles that highlight various features of interest, select protective improvement measures within a given budget based on seven defined investment strategies and other criteria, and evaluate protective purchases against varying probabilities of attack over a given period of time. Built as a stand-alone, client-side, browser-oriented web application using JavaScript and HTML5, AVM-DST offers a robust range of capabilities and functions that are easily accessible from a compact interface supporting a variety of user features and options. Performance tests show that AVM-DST is capable of handling large data sets with no noticeable delays; it promptly displays simulation results for thousands of assets. Indeed, the AVM-DST research demonstrates that it is possible to guide strategic critical infrastructure protection efforts by assessing the current protection status, evaluating future protective improvement measures and justifying national investments.

Future work related to the AVM-DST web application includes developing additional analytics for the analysis and evaluation component, improved simulation of attack scenarios based on intelligence, support for enhanced trade-offs and extensions for including additional investment strategies. Metrics will be added to the simulations to provide insights into the effectiveness of investment strategies. Additionally, display and visualization enhancements will be implemented, especially optimizing the rendering of the grid panel when the investment allocation tool populates it with the selected assets.

Figure 1 .

 1 Figure 1. AVM-DST display of 100 simulated assets.

Figure 2 .

 2 Figure 2. Critical infrastructure risk profile by Θ value.

Figure 3 .

 3 Figure 3. Protective improvement purchase using the highest consequence strategy.

Figure 4 .

 4 Figure 4. AVM-DST attack simulation and damage estimate.

Figure 5 .

 5 Figure 5. Application user interface.

Figure 6 .

 6 Figure 6. Chart control panel.

Figure 7 .

 7 Figure 7. Allocate control panel.

Figure 8 .

 8 Figure 8. Simulate control panel.

Table 1 .

 1 Targeted critical infrastructure sectors.

	ID Infrastructure Sector
	1	Chemical Plants
	2	Dams
	3	Energy
	4	Financial Services
	5	F ood andAgriculture
	6	Information Networks
	7	Nuclear Reactors, Materials andW aste
	8	T ransportation Systems
	9	Water and Wastewater Systems

Table 2 .

 2 Performance of AVM-DST functions.

	AVM-DST Function	Time
	Import File	65 ms
	Render Main Chart	60 ms
	Render Secondary Chart	6 ms
	Run Allocation Algorithm	174 ms
	Render Grid	840 ms
	Run 10 Simulations	96 ms
	Run 1,000 Simulations	2,287 ms
	Sort Data	67 ms


Valerio Formicola

Antonio Di

Abdullah Alsubaie

Salvatore D'antonio

Jose Marti

Salvatore D ' Antonio

Assessing the Impact of Cyber Attacks on Wireless Sensor Nodes That Monitor Interdependent Physical Systems

Keywords: Cyber attacks, wireless sensor networks, attack impact

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cyber attacks against supervisory control and data acquisition (SCADA) systems [START_REF] Roman | The role of wireless sensor networks in the area of critical information infrastructure protection[END_REF] have shown that security violations can compromise the proper functioning of critical infrastructures. The Stuxnet worm [START_REF] Falliere | Stuxnet Dossier, Version 1.4[END_REF] exploited vulnerabilities in the information and communications technology layer (primarily deficient security policies and bugs in special purpose systems), ultimately affecting the operation of programmable logic controllers and the uranium hexafluoride centrifuges they controlled. Cyber attacks typically induce faults in sensors and actuators, and alter supervisory mechanisms and notification systems. Once activated, the faults become errors and result in improper operations. These can cause failures in critical infrastructures and eventually affect services, facilities, people and the environment.

Sophisticated wireless sensor networks [START_REF] Baronti | Wireless sensor networks: A survey on the state of the art and the 802.15.4 and ZigBee standards[END_REF] are increasingly used to monitor critical infrastructure assets, including dams and pipelines [START_REF] Bai | Design of wireless sensor network in SCADA system for wind power plant[END_REF][START_REF] Poulsen | Slammer worm crashed Ohio nuke plant network, Security Focus[END_REF]. In fact, sensor networks are rapidly being integrated in SCADA environments. Wireless sensor networks are often deployed in hydroelectric power plants and dams to monitor feed water supply, power generation, structural stability, environmental conditions and pollution levels. A single dam can have a thousand sensors, with additional sensors deployed in areas surrounding the water reservoir. Wireless sensor networks expose SCADA systems to new threats introduced by the information and communications technology layer. Unlike traditional sensor systems, wireless sensor networks are also vulnerable to signal eavesdropping and physical tampering, along with new ways of compromising data confidentiality, integrity and availability. The effects of cyber attacks against a dam include: (i) anomalous variations in seepage channel flows; (ii) uncontrolled gate opening; (iii) excessive turbine and infrastructure vibrations; (iv) structural instability; and (v) reservoir level variations.

Despite the adoption of security policies and the implementation of countermeasures, SCADA systems and wireless sensor networks continue to be vulnerable [START_REF] Alcaraz | A security analysis for wireless sensor mesh networks in highly critical systems[END_REF][START_REF] Martins | Wireless sensor network attacks and security mechanisms: A short survey[END_REF]. SCADA systems are generally unable to cope with cyber attacks primarily because they were not designed with security in mind. Protection from cyber attacks has to be provided by additional security mechanisms that must be integrated with existing SCADA systems in a seamless manner. Logical security is commonly provided by security information and event management (SIEM) systems, which are specifically designed to manage and operate information and communications technology applications.

This paper presents a next-generation SIEM platform that performs realtime impact assessment of cyber attacks against monitoring and control systems in interdependent critical infrastructures. Run-time service level analysis is performed in the SIEM workflow. This is enabled by three novel contributions: (i) enhanced security event collectors (probes) that perform advanced semantic analysis of non-IP domains (e.g., wireless sensor networks) in the SIEM framework; (ii) impact assessment based on interdependency simulation; and (iii) transformation of SIEM risk assessment metrics to critical infrastructure operational levels (i.e., levels of services provided by the attacked systems). The approach also helps predict service level variations when limits are imposed on information sharing among different critical infrastructures.

Romano, et al. [START_REF] Romano | Protecting the WSN zones of a critical infrastructure via enhanced SIEM technology[END_REF] have proposed the use of an enhanced SIEM system to monitor the security level of a traditional dam that incorporates legacy control systems and wireless sensor networks; the system was designed to collect data from physical devices (sensors) and correlate physical events with events generated at the logical layer. This paper further enhances the SIEM system to assess the impact of cyber attacks against a dam that exhibits interdependencies with other critical infrastructures. The goal is to improve risk analyses performed by SIEM systems with qualitative and quantitative analysis of service level variations. This ultimately reduces the time required for decision making and improves decision outcomes in the presence of impending failures. The impact assessment module of the SIEM system relies on i2Sim [START_REF] Marti | Multisystem simulation: Analysis of critical infrastructures for disaster response, in Networks of Networks: The Last Frontier of Complexity[END_REF], an infrastructure interdependency simulator that models resource flows between critical infrastructures and assesses how the output of one critical infrastructure is affected by the availability of resources provided by other critical infrastructures.

Related Work

This section discusses related work on next-generation SIEM systems for service level monitoring and models for evaluating critical infrastructure interdependencies.

Collections of events occurring in network systems enable the SIEM framework to assess the security level of network domains. A common way to store this information is to save it in logs generated by security probes and logical sensors. Since logs have heterogeneous formats (semantics and syntax), it is necessary to convert log data into a common representation. The overall process encompasses data gathering, parsing, field normalization and format conversion. Mostly, this process is executed by SIEM agents that collect data from several sources. In order to use SIEM systems to protect critical infrastructures, obtain a holistic view of security and enable impact analysis of cyber attacks on service levels, it is necessary to incorporate enhanced data collectors [START_REF] Coppolino | Enhancing SIEM technology to protect critical infrastructures[END_REF]. Specifically, enhanced data processing has to be introduced at the edge of the SIEM architecture to perform multi-level data aggregation and to manage data processing in the organizational domain [START_REF] Coppolino | Enhancing SIEM technology to protect critical infrastructures[END_REF].

Two widely-used data collectors, OSSIM-Agents [START_REF] Alienvault | OSSIM Sensor[END_REF] for the Open Source Security Information Management (OSSIM) SIEM platform and Prelude-LML for the Prelude OSS SIEM system [START_REF]Prelude-IDS, Prelude LML[END_REF], collect data using transport protocols (e.g., Syslog, Snare, FTP and SNMP) and produce OSSIM and IDMEF [START_REF] Debar | The Intrusion Detection Message Exchange Format (IDMEF)[END_REF] messages, respectively. Both types of collectors execute format translation tasks, but do not perform content analysis and advanced data manipulation such as aggregation, filtering, correlation, anonymization and content-based encryption. Coppolino, et al. [START_REF] Coppolino | Integration of a system for critical infrastructure protection with the OSSIM SIEM platform: A dam case study[END_REF] have demonstrated that the OSSIM SIEM system can be used to protect critical infrastructures in a non-intrusive manner (i.e., without modifying SIEM framework components). They also show how to process physical layer data on the OSSIM server. Specifically, the server is configured to analyze environmental and physical measurements to detect physical anomalies in the SCADA workflow of a dam infrastructure. The introduction of SIEM technology in a dam protection system enables a massive number of messages to be sent from data sources (measurement collection points) located in the field towards the core of the OSSIM architecture (OSSIM server).

In the area of interdependency models, researchers have adopted a variety of techniques (e.g., agent-based systems, input-output inoperability, system reliability theory, nonlinear dynamics and graph theory) to model different types of interdependency phenomena [START_REF] De Porcellinis | Modeling critical infrastructure via a mixed holistic reductionistic approach[END_REF][START_REF] Rinaldi | Identifying, understanding and analyzing critical infrastructure interdependencies[END_REF]. Satumitra, et al. [START_REF] Satumitra | Synthesis of modeling and simulation methods in critical infrastructure interdependencies research[END_REF] have demonstrated that it is possible to distinguish between physical, social, logical, geographical and cyber interdependencies. Ghorbani, et al. [START_REF] Ghorbani | The state of the art in critical infrastructure protection: A framework for convergence[END_REF] have presented a classification and comparison of agent-based interdependency modeling and simulation tools. The work described in this paper is based on i2Sim [START_REF] Marti | Multisystem simulation: Analysis of critical infrastructures for disaster response, in Networks of Networks: The Last Frontier of Complexity[END_REF], a simulation environment that models critical infrastructure interdependencies based on resource requirements and distribution. Using specific components called production cells, i2Sim is able to model the high-level behavior of a critical infrastructure by specifying the level of input resources that the critical infrastructure needs in order to provide a certain quantity of output. i2Sim also makes it possible to model the reduction of output quantity due to a reduction of input resources or an internal failure (e.g., due to a physical or cyber event).

Although SIEM systems can be enhanced to provide a multilayer view of system events and cope with sophisticated cyber attacks against service infrastructures, they do not use infrastructure interdependency models to evaluate real-time cascading effects [START_REF] Di Pietro | Taxonomy of SCADA systems security testbeds[END_REF]. The approach described in this paper incorporates an infrastructure interdependency model in a SIEM system in order to evaluate how cyber attacks against wireless sensor nodes impact interdependent systems. The proposed methodology is effective in current information sharing contexts where only limited amounts of information can be exchanged between interdependent infrastructures. Theoharidou, et al. [START_REF] Theoharidou | A multi-layer criticality assessment methodology based on interdependencies[END_REF] discuss related work on risk and impact assessment, but they neither consider security-related risks and technologies nor information sharing constraints.

Cyber Attack Impact Assessment

The proposed SIEM platform analyzes data from diverse sources and assesses the impact of cyber attacks on the services provided by interdependent critical infrastructures. The SIEM platform implements a novel level of intelligence (with respect to state-of-the-art commercial solutions), enabling a holistic view of security. The solution also supports the introduction of sophisticated detection mechanisms to discover attacks in non-IP networks (e.g., wireless sensor networks) and in the business layer. This feature is key to enhancing SIEM system intelligence and assessing the impact of attacks on critical infrastructure services.

Figure 1 shows the architecture of the enhanced SIEM platform. The platform incorporates the following main components: SIEM Collector: This component collects data from the monitored infrastructures to provide a multilayer view of system events and crosscorrelate data in the proximity of the collection points. The modules responsible for data aggregation are called security probes. The security probes observe data related to specific services and detect anomalous behavior. Information expressed in the resulting alarms is valuable for security risk assessment as well as service level impact assessment.

SIEM Correlation Server:

This component correlates events from security probes located in the proximity of critical infrastructure field systems. The SIEM server generates high-level alarms when cyber attacks against the monitored critical infrastructures are detected. The alarms contain a risk metric and information about the targeted assets. This information is used to assess the impact of attacks on critical infrastructure services. In this work, the SIEM correlation server is the OSSIM server.

Critical Infrastructure Impact Assessment: This component assesses the impact on the services provided by interdependent critical infrastructures, some of which may be victims of cyber attacks. First, a mapping is performed between the alarms triggered by the SIEM correlation server and the operability levels provided by i2Sim. Next, an i2Sim simulation is executed to assess how the services provided by other critical infrastructures are affected by the new operability levels given the existing interdependencies. The alarms are weighted based on the relevance of the targeted assets to other critical infrastructures. The weighted alarms are sent to human experts or to decision support systems (DSSs) to identify the appropriate countermeasures.

Enhanced Collection

The SIEM collector is called the generic event translation (GET) framework [START_REF] Romano | Protecting the WSN zones of a critical infrastructure via enhanced SIEM technology[END_REF]. It comprises modules that gather, parse, filter, anonymize, normalize, translate, aggregate and correlate low-level events (micro-events) across different layers. This workflow generates semantically-rich messages (macroevents) and dramatically reduces the volume of data generated by the sensors and directed to the SIEM server. Moreover, the GET framework confines the processing of private data within the domain boundaries of the collection points (e.g., company and organization networks). The GET framework operates as a data parser (i.e., it preprocesses data and translates content representation) and also correlates and analyzes data. A useful tool for producing pattern detectors is the State Machine Compiler [START_REF] Rapp | Home of SMC: The State Machine Compiler[END_REF], which facilitates the deployment of complex state machines represented as state charts. Each security probe receives messages from a subset of parsers and uses the information to provide input to the state machines.

Central Correlation

The SIEM correlation server is responsible for analyzing all the events collected by the GET framework. As shown in Figure 1, the SIEM correlation server receives data from event sources installed in the critical infrastructures (e.g., intrusion detection systems, firewalls, and servers running different operating systems) and from security probes in the GET framework.

The correlation engine is typically configured using detection patterns stored in rule databases. In order to assess the security level of the overall system, the SIEM correlation server operates in a centralized manner. By correlating events and security information, the SIEM server reduces the volume of alerts that reach the higher security event analysis layers (e.g., security administrators and, in our case, the critical infrastructure impact assessment module). Indeed, the SIEM server essentially reduces the number of false positives. For instance, consider the deployment of Linux servers and network intrusion detection systems that generate alerts due to malicious packets that target Windows Servers; the alerts are correlated with the current software characteristics (i.e., Linux operating systems) and no alarms are generated. Also, by correlating events from distributed security sources, the SIEM server can reveal malicious activities that are perpetrated in a distributed manner.

Correlation servers differ from each other in the correlation logic (logical tree, complex event processor, etc.). Their main task is to assess the risk posed by the events that occur. Outputs are reported as concise and meaningful alarms containing indicators of the risk levels reached by the events composing an attack sequence. Indicators are expressed as numerical values or qualitative indices. For instance, OSSIM SIEM uses numerical risk values in the range zero (lower risk) to ten (higher risk). Prelude OSS generates alarms with an assessment ("severity" in the IDMEF standard) expressed as info, low, medium high along with a flag that states if the attack was successful. In this work, risk (and severity) are important to calculate the impacts of the cyber attacks that are detected.

The impact assessment process can be described as follows:

Each event e is normalized by the GET framework in order to have a standard structure and appear as an information vector of the monitored activity e(x 1 , ..., x N ) where N is the number of fields that comprise the normalized event format.

The SIEM server stores all the information that can help improve the accuracy of detection by the organization that hosts the SIEM system. This information includes the real vulnerabilities that affect a targeted host (e.g., known bugs) and the relevance of the target as a company asset. This information is referred to as "context information" or simply "the context" and is expressed as a vector of the additional data a(s 1 , . . . , s m ).

It is worth noting that this information is known only to the organization in charge of the targeted asset, (e.g., a company that manages the infrastructure) because it includes very sensitive information such as hardware characteristics, IP addresses, software versions and business relevance. This information cannot be shared with other infrastructures.

The correlation process operates on sequences of events (e(k)) and additional data vectors (a). At the end of the process, alarms may be triggered if the security thresholds are exceeded. The SIEM server applies a risk assessment function R to calculate the risk associated with a sequence of events e in conjunction with the a information, i.e., R(e, a).

For example, consider the implementation of risk assessment as provided by OSSIM SIEM. The OSSIM rules are called directives. When a directive is fired, the following function is applied:

Risk = (P riority × Reliability × Asset)/25 (1)
In OSSIM, the Priority range is zero to five, the Reliability range is zero to ten and the Asset range is zero to five. Thus, Risk ranges from zero to ten. Priority and Asset are assigned through an offline analysis of host vulnerabilities, the typology of the attack and the relevance of the targeted asset to the organization; these constitute the context vector in the model above. Reliability is computed by observing the e sequence and by summing the Reliability of each event. In OSSIM, Reliability is taken to be the probability that an attack is real, given current events observed in the system. Note that lower Risk values (e.g., zero) are not dangerous because they mean that one of the assessment parameters has very low security relevance.

Critical Infrastructure Impact Assessment

The core function of the critical infrastructure impact assessment module is provided by i2Sim, which is an event-driven, time-domain simulator that is used to model infrastructure interdependencies. i2Sim uses a cell-channel approach, which provides a multi-system representation at multiple hierarchical levels (e.g., local, municipal and provincial/state) and can be used in real time to assess the effects of resource allocation decisions during disasters. In addition, i2Sim provides a dynamic simulation environment that integrates different systems in a common simulation platform [START_REF] Alsubaie | A platform for disaster response planning with interdependency simulation functionality[END_REF]. i2Sim determines the output of a critical infrastructure using two measures: resource mode (RM) and physical mode (PM). RM is determined by the availability of input resources from other critical infrastructures whereas PM is determined by the internal conditions of the critical infrastructure itself (e.g., level of physical damage to a building). Therefore, the output of a critical infrastructure modeled in i2Sim is a function of the availability of input resources and its physical integrity.

Metric Transformation

In order to relate alarms resulting from SIEM analysis to physical modes of each i2Sim cell, the risk assessment value (R) is combined with the service criticality metric (C). Criticality considers the relationships between the attacked nodes (e.g., sensors and actuators) and services (e.g., electric power and water supply). The mixed holistic reductionist (MHR) approach [START_REF] De Porcellinis | Modeling critical infrastructure via a mixed holistic reductionistic approach[END_REF][START_REF] Di Pietro | Assessing the impact of cyber attacks on interdependent physical systems[END_REF] is used to define service criticality. The approach considers interdependency phenomena using three-layers: (i) a holistic layer that considers the evaluation of an event within a critical infrastructure; (ii) a service layer that specifies the services delivered to end users; and (iii) a reductionist layer that models the functional interdependences among different critical infrastructures. The reductionist layer evaluates the impact on a critical infrastructure. i2Sim translates this impact to the impacts on physical resource flows between infrastructures.

Figure 2 shows the transformation function. The transformation function f is factorized and the parameters are used to adapt the OSSIM risk values to i2Sim (x is the sensor and y is the secondary critical infrastructure). There is a subtle, but substantial, difference between the concepts of context and criticality. Context embraces the relevance of an asset (e.g., sensor) to the primary infrastructure, namely the relevance of an asset to the business of the infrastructure providing a service. Criticality refers to the relevance of an asset to the infrastructure that uses a service. Thus, criticality is not a unique parameter, but is strictly dependent on the infrastructure that consumes the service; it is computed by the provider based on information shared with the consumer. Indeed, criticality focuses on the need as indicated by the consumer infrastructure, which is not aware of the systems in the provider infrastructure. Given the information supplied by the consumer, the provider calculates a criticality value for each asset that is involved.

Example Scenario

The example scenario uses an attack on wireless sensor network nodes to demonstrate how the enhanced SIEM system can help evaluate the impact of an attack on infrastructure services. Figure 3 shows the scenario involving a dam that feeds a hydroelectric power station, which feeds a power distribution substation through a transmission network (not modeled for simplicity). Arrows in the figure indicate functional dependencies between critical infrastructures.

The dam provides water to the hydroelectric power station through a gate that is remotely controlled to release basin water and activate the power plant turbine. The dam and hydroelectric power station are controlled by a SCADA system that utilizes a wireless sensor network. Water fed to the hydroelectric power station is conveyed through pipes called penstocks. It is important to guarantee that the water flow values in the penstocks are within the operational range. Lower values can result in low power generation while higher values can lead to excessive turbine rotational speed and turbine vibration, which can result in physical damage to the infrastructure [START_REF] Hasler | Investigating Russia's biggest dam explosion: What went wrong[END_REF]. A hospital, water distribution station and manufacturing plant receive electricity from the power distribution substation. All the dependencies are modeled using i2Sim. A cyber attack is launched against the wireless sensor network that monitors the dam; the objective is to measure the impact on the operability level of the hospital, which requires electricity and water. Table 1 shows the electrical demands of the critical infrastructures in the scenario.

The wireless sensor network enables the SCADA system to monitor physical parameters. Four types of sensors are used: (i) three water flow sensors placed in the penstocks (WF1, WF2, WF3); (ii) two water level sensors that monitor erosion and piping phenomena under the dam wall (WL1 and WL2); (iii) a tilt sensor placed on the dam gate to measure the gate opening level (inclination); and (iv) a vibration sensor placed on the turbine. The sensors, which correspond to nodes in the wireless sensor network, send their measurements at regular intervals to the wireless sensor network base station (BS). The base station acts as wireless remote terminal unit (RTU) that forwards measurements to the remote SCADA server. Opening commands are issued by the remote SCADA facility to the gate actuator. The information and communications technology components deployed include a network-based intrusion detection system (N-IDS) installed in the remote SCADA server facility, a host-based intrusion detection system (H-IDS) positioned in the dam facility and a SIEM platform with a correlation engine located in a remote office. Figure 4 shows the results of applying the MHR approach, which models the services and equipment that are relevant to the critical infrastructure impact assessment module of the SIEM platform.

i2Sim Model

The i2Sim model provides a high-level abstraction of the physical components. In the i2Sim ontology, physical infrastructure entities are modeled as cells connected through channels that transport resources (e.g., electricity and water). The implemented model includes five cells that are used to represent the dependent infrastructures: hydroelectric power station, power distribution substation, water distribution station, manufacturing plant and hospital. The hydroelectric power station cell represents both the dam and the turbine. Alarms generated by the SIEM correlator are mapped to physical modes of the considered critical infrastructures. Changes to the physical modes of i2Sim result in changes to the RMs of the affected cells that measure their operability levels.

Attack Execution and Identification

The scenario considers an attack targeting the wireless sensor network nodes that involves several steps. At the end of the attack, the physical measurements collected by the wireless sensor network nodes are altered to induce incorrect situational awareness about the SCADA system. The SIEM framework detects this complex attack by correlating security events generated by the security tools installed in the dam facility, specifically the intrusion detection systems and GET security probes.

The assumption is that the attacker is a dam employee who can physically access wireless sensor network zones and connect to the network that hosts the SCADA server. The attacker has limited administrator rights and is not responsible for the cyber security of deployed systems (e.g., not responsible for security configuration policies and does not know the credentials needed to change the configuration or the cryptographic keys used for wireless sensor network communications).

The attack is performed in two phases. In the first phase, the attacker steals the wireless sensor network cryptographic key (e.g., via a side-channel attack as described in [START_REF] Dyka | Improving the security of wireless sensor networks by protecting the sensor nodes against side channel attacks[END_REF]). In the second phase, the attacker targets the SCADA server since he can access a host that monitors the dam (e.g., a human-machine interface (HMI) or engineering station). The attacker exploits a SCADA server vulnerability via malware that is installed by inserting a USB device into a SCADA network machine (as in the case of the Stuxnet worm [START_REF] Falliere | Stuxnet Dossier, Version 1.4[END_REF]).

After the SCADA server is compromised, the attacker connects to the wireless sensor network RTU host. Having gained access to the wireless sensor network master node, the attacker reprograms the wireless sensor network nodes (e.g., via over-the-air programming). The new program is configured with the cryptographic key obtained during the previous phase. The new malicious code executes the routing protocol by altering the data forwarded from the water flow sensors to the master RTU. Water flow measurement data is altered in order to exceed the control threshold by adding a constant offset to the measured values. In this way, the gate is forced to limit water release and ultimately cause low turbine rotation. The final effect of the attack is a reduction in the electricity supplied to the power grid.

In order to detect the attack, we consider events generated by the security probes that oversee the wireless sensors. These security probes detect physical inconsistencies in the sensor data and generate alarms that are processed by the SIEM server: seepage channel sensors should report similar values of water levels; water flow sensors should measure values in the same range; and the gate opening sensor should report a value that is consistent with the water flow in the penstocks. The security probes aggregate the sensor data and verify their consistency.

Figure 5 shows the trends in the wireless sensor network data collected by the security probes (measurements). The SCADA server regulates the gate opening level (level 1 is low and level 2 is medium) based on the average water flow level provided by the three sensors. When the gate opening is at level 2, the water flow level is 12.5 cm/sec. The attack compromises the sensors so that they indicate a water flow level of 25.0 cm/sec. This causes the SCADA system to set the gate opening to level 1 to reduce the water flow below the flow measurements and lead to low or over energy production, thus impacting the dependent critical infrastructures.

In this scenario, the Risk (R) of the attack is 8 while the event criticality (C) is in the range 0 to 0.5 (0 is not critical and 0.5 is highly critical). Given that the energy production is affected by the wireless sensor network measurements by a factor of 0.5, the resulting impact is PM = R × C = 8 × 0.5 = 4. The physical mode (PM) value is the physical mode in i2Sim where a value of one corresponds to fully operational and a value of five corresponds to not operational. Specifically, PM = 4 indicates that the cyber attack moves the physical mode functionality down to its lowest energy production level. The 0.5 factor was chosen because the wireless sensor network affects the total productivity of the power plant. Figure 7 shows a scenario where a cyber attack against the water flow sensors is detected. Due to the existing interdependency phenomena, the cyber attack degrades the operability level of the hospital.

Conclusions

The next-generation SIEM platform described in this paper is designed to support the real-time impact assessment of cyber attacks that affect interdependent critical infrastructures. The platform can detect cyber attacks against wireless sensor network nodes and can conduct real-time assessments of the impact of the attacks on the services provided by the wireless sensor nodes as well as the potential cascading effects involving other critical infrastructures. As demonstrated in the scenario, the i2Sim tool can be used to model the physical layer and services of an interdependent system (i.e., a dam and hydroelectric power plant) in order to analyze the impact of service degradation. The scenario helps understand how the interdependent system reacts to an attack that impacts water flow from the dam. The resulting functioning levels of the hydroelectric power plant and the effects on other critical infrastructures can be provided as inputs to an operator dashboard to help make decisions about appropriate mitigation strategies. Our future research will continue this line of

Figure 1 .

 1 Figure 1. Enhanced SIEM platform architecture.

Figure 2 .

 2 Figure 2. Metric transformation function.

Figure 3 .

 3 Figure 3. Sample scenario.

Figure 4 .

 4 Figure 4. MHR model of the example scenario.

Figure 5 .

 5 Figure 5. Water flow measurements forged by a malicious sensor.

Figure 7 .

 7 Figure 7. i2Sim results.

Table 1 .

 1 Electricity demands of the critical infrastructures.

	Critical Infrastructure	Electricity Demand
	Hospital	13.47 MW
	Water Distribution Station	52.5 MW
	Manufacturing Plant	9.47 MW

inquiry, in particular, validating the approach and the SIEM platform using a realistic testbed that incorporates a dam equipped with sensors and actuators.

Acknowledgement

This research was supported by the Seventh Framework Programme of the European Commission (FP7/2007-2013) under Grant Agreement No. 313034 (Situation Aware Security Operations Center (SAWSOC) Project). The research was also supported by the TENACE PRIN Project (No. 20103P34XC) funded by the Italian Ministry of Education, University and Research.

control threshold. The result of the attack is that the gate opening moves to level 1 although measurements indicate that the gate opening is at level 2 (last measurements in the sequence in Figure 5). The anomaly is revealed by two security probes: the first (WF SP) reveals an inconsistency in the water flows and the second (G F) reveals a gate opening level inconsistency for all three sensors. Note that another security probe that monitors the water level in the seepage does not show any inconsistency for WL1 and WL2. The alarms from the security probes are correlated by the SIEM platform according to the rule shown in Figure 6. The rule takes into account the two events from the H-IDS and N-IDS due to the worm activities and access to the wireless sensor network RTU host. The final alarm generated by the SIEM server contains evidence that the wireless sensors exhibit anomalies. In particular, the security probes indicate that WFx in the Penstock1 zone exhibits anomalous conditions. Such parameters, despite being irrelevant to the rule, are crucial to understand the impact of the attack (i.e., reduction in the power supplied by the hydroelectric power station). The parameters are used by i2Sim to evaluate the impact of the attack. In the rule, the Priority is highest (5), Reliability is 8 (sum of single event reliabilities) and Asset has the highest value [START_REF] Baronti | Wireless sensor networks: A survey on the state of the art and the 802.15.4 and ZigBee standards[END_REF]. Thus, the Risk is (5 × 8 × 5)/25 = 8. This value must be associated with the service criticality of the wireless sensors with respect to the power production service in the critical infrastructure impact assessment module.

Critical Infrastructure Impact Assessment

Using the MHR approach, services and equipment that exhibit high event criticality can be identified. The graph in Figure 7 shows the estimated rate of treated patients depending on the hospital operability level following the cyber attack on the water flow sensors. As far the scenario is concerned, the flow sensors placed at different points in the penstocks (WF1, WF2 and WF3) exhibit high service criticality because, if attacked, they may alter the water


Simona Cavallini

Fabio Bisogni

Marco Bardoscia

Roberto Bellotti

Assessing Potential Casualties in Critical Events

Keywords: Cascading effects, consequence calculation, casualties, failure trees

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The European Commission Directive 2008/114/EC of 2008 [5] defines a critical infrastructure as "an asset, system or part thereof located in [m]ember [s]tates which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a [m]ember [s]tate as a result of the failure to maintain those functions." The directive clarifies a European critical infrastructure as one that is located in a European Union (EU) member state whose destruction or malfunction would have a significant impact in at least two EU member states. The significance of the impact should be assessed in terms of cross-cutting criteria, including the effects of cross-sector dependencies involving other infrastructures.

According to Article 3 of Directive 2008/114/EC [5], the identification process of each member state should be based on the following cross-cutting criteria:

Casualties Criterion: Assessed in terms of the potential numbers of fatalities and injuries.

Economic Effects Criterion: Assessed in terms of the significance of economic loss and/or degradation of products and services, including potential environmental effects.

Public Effects Criterion: Assessed in terms of the impact on public confidence, physical suffering and disruption of daily life, including the loss of essential services.

To define and identify critical infrastructures at the national level, each EU member state has adopted a perspective that can be related to one of the following approaches [START_REF] Bisogni | The European perspective of telecommunications as a critical infrastructure[END_REF]: (i) service-oriented approach, in which the key elements are vital services and/or essential societal functions; (ii) asset-oriented approach, in which the key elements are impact and/or risk assessment; and (iii) operatororiented approach, in which the key elements are public/private organizations that manage/own infrastructures because of their decision-making role.

A sector-based approach may be considered close to an operator-oriented approach when, in a given area, the number of operators is limited (i.e., natural oligopoly or monopoly) and/or the opportunity to replace their services is difficult in the short term. In this perspective, a critical infrastructure corresponds to key elements of a productive sector at the national level, where the sectors must be identified using official statistical classifications such as NACE in the EU context.

The malfunction or destruction of an infrastructure, especially due to an unexpected event, affects social and economic activities. The relevance of critical infrastructure failures is, in general, not only due to their direct role in socio-economic activities, but also because of their interconnections. Tight interconnections among critical infrastructures and the cascading effects that can occur in the case of failures of one or more infrastructures have been extensively investigated at the theoretical [START_REF] Bisogni | Assessing the economic loss and social impact of information system breakdowns[END_REF][START_REF] Cavallini | Study for the Development of a Methodology and Research of Quantitative Data on the Economics of Security and Resilience in Critical Communications and Information Infrastructures (CIIS) -SMART-SEC[END_REF] and empirical levels [START_REF] Van Eeten | The state and the threat of cascading failure across critical infrastructures: The implications of empirical evidence from media incident reports[END_REF]. In both cases, strong connections have been identified in certain sectors that can cause cascading effects in specific cases.

With regard to preventive actions and crisis management, civil protection authorities and first responders would benefit from a preliminary assessment of potential damage caused by accidental or intentional failures of socio-economic sectors. According to an intervention perspective related to the emergency roles of civil protection personnel and first responders, the focus is on evaluating the impacts, especially casualties, in the time frame starting from the end of the direct effect of the event of interest.

This paper describes the consequence calculation model (CCM), which integrates quantitative data and qualitative information in order to evaluate the socio-economic impacts of sector failures. The model has been developed by the FORMIT team and applied in the DOMINO Project [START_REF] Perucchini | Domino Effects Modeling Infrastructure Collapse -DOMINO, Final Report of the Project Supported by the DG Home Affairs of the European Commission[END_REF]. The concrete application of the model provides indications of priorities of intervention in different sectors in order to contain the potential consequences to the extent possible.

Consequence Calculation Model

The primary goal of the consequence calculation model is to evaluate the effects of failures of socio-economic sectors, including critical infrastructures. The main inputs to the model are time series of the operativity levels of the sectors of interest. The main outputs are time series of the potential impacts in terms of casualties (injured and fatalities), economic effects and public effects due to failures of the affected sectors. The effect of each sector failure at a certain time instant is summarized by an indicator per impact.

In order to assess the impacts (i.e., casualties, economic effects and public effects) of an unexpected event that affects a country (as in the DOMINO Project), the output of the consequence calculation model can be represented using a failure tree for each of the potential impacts (casualties, economic effects and public effects) that captures the dependencies existing among the impacted sectors. In a failure tree, the sectors affected by a critical event and the sectors affected by disruptions of other sectors are represented by considering the time dimension. Figure 1 shows a failure tree that reports the economic effects (EE), public effects (PE), injuries (I) and fatalities (F) by sector.

Model Assumptions

The proposed model for computing the consequences of a disruption of each sector relies on the following assumptions: Independence of Sector Impacts from Disruption Causes (A1):

The estimated impacts, in terms of economic effects, public effects and casualties, due to the disruption of the i th sector are not affected by disruptions of other sectors that occur before or after the disruption of the i th sector. The cause of the failure of the "first" sector does not affect the operativity levels of the other sectors.

Time Homogeneity (A2):

The estimated impacts are not affected by their absolute time positions in a failure tree. In other words, the sequences of affected sectors shown in failure trees are used as timeinvariant information by the consequence calculation model. The total consequences at time t of the entire failure tree is defined as the sum of the individual impacts generated by the disrupted sectors (see Figure 1 for the effects by sector).

Lower/Upper Bounded Operativity Levels (A3): The operativity level x i of each sector ranges from zero to one. A value of zero corresponds to the total disruption of the sector, while a value of one corresponds to full (normal) operativity of the sector. The consequence calculation model is constructed to work with discrete operativity levels (i.e., x i ∈ {0, 1}) as well as continuous operativity levels (i.e., x i ∈ [0, 1]).

Note that, according to Assumption A1, the impacts of the affected sectors are independent, while the disruption of one sector is strictly related to the disruption of one or more other sectors.

Model Hypotheses

The computation of the three indicators of the model relies on the three preceding assumptions and three hypotheses.

The first hypothesis (H1) is that, when a sector fails, its recovery is no longer possible. As a consequence, the effects of a sector disruption and of the consequent failure tree may proceed indefinitely.

The second hypothesis (H2) is that the disruption of a specific sector can occur only once. For example, if the disruption of Sector A could be caused by both Sector B and Sector C, and if, in the failure tree, the disruption of Sector C occurs before the disruption of Sector B, then Sector A fails because of Sector C, but not because of Sector B.

The third hypothesis (H3) is that an outage occurring to a sector cannot be partial, but only complete at least for the first time period. This implies that the operativity levels are discrete.

Calculating Potential Impacts

The aforementioned European Commission directive [START_REF]Non-Binding Guidelines for the Application of the Directive on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve their Protection[END_REF] defines casualties (C) in terms of injured persons (I) and fatalities (F). In addition, the nonbinding guidelines for the application of the directive specify that:

A casualty is either an injured person or a fatality.

An injured person is defined as a person who requires more than 24 hours of hospitalization.

There is no limit on the maximum time following an event that causes the disruption or destruction of an infrastructure during which fatalities should occur.

The potential impacts in terms of casualties are computed in the consequence calculation model according to the metrics suggested by the European Commission directive [START_REF]Non-Binding Guidelines for the Application of the Directive on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve their Protection[END_REF]. According to the assumptions listed above, the estimated impacts in terms of casualties (C) (injured persons and fatalities) due to the disruption of one sector are not affected by disruptions of other sectors (occurring before or after) (Assumption A1) and by the absolute time position in the potential failure tree (Assumption A2) (Figure 2).

In the case of a critical event, the indicators of the total impacts in terms of injured persons I(t) and fatalities F (t) at time t for the entire failure tree are computed as the sum of the injured persons and the sum of the fatalities occurring in all the affected sectors. Without any loss of generality, the model for assessing the impact in terms of injured persons and fatalities can be described, in general, as casualties and applied to the two cases. Given n sectors, only m c of the sectors (m c ≤ n) suffer effects in terms of casualties. In the proposed model, the casualties caused by the disruption of the j th sector at time t are linked to the operativity levels according to the equation:

C j (t) = α j Θ[θ j -x j (t)] (1)
where C j (t) is the number of casualties induced at time t by the disruption of the j th sector; α j is a positive real parameter that represents the average number of casualties induced by the complete disruption of the j th sector per unit of time (α j takes different values for injured persons and fatalities); θ j is a real parameter that can be interpreted as an operativity threshold of the j th sector ranging from zero to one; x j (t) is the operativity level of the j th sector at time t ranging from zero to one; and Θ is the step function:

Θ[θ j -x j (t)] = 1, if x j (t) < θ j 0, otherwise
Equation ( 1), which gives the casualties caused by a disruption of the j th sector at time t, includes a threshold mechanism: the operativity level of the j th sector at time t must fall below the threshold θ j to contribute to the casualties by an amount α j at time t. The total casualties at time t, denoted by y j (t), is the sum over all the sectors that potentially suffer effects in terms of casualties (Assumption A1):

y(t) = j α j Θ[θ j -x j (t)]. (2)
Equation ( 2) implies that the outage of the j th sector has an instantaneous effect (at the same instant of time) on the casualties. This is relaxed by introducing a delay time t j for the j th sector and modifying the equation accordingly:

y(t + t j ) = j α j Θ[θ j -x j (t)]. (3)
Thus, the operativity level of the j th sector at time t influences the casualties at time t + t j . To this point, the additional hypotheses have not come into play. In the case that the operativity levels do not take values in the real interval [0, 1], but only take discrete values of 0 or 1 (Hypothesis H3), the parameter θ j has no meaning. In fact, it is perfectly reasonable for a completely functional sector not to have any effect on the casualties, while a completely non-functional sector must have some effect on the casualties. In this case, Equation (3) reduces to:

y(t + t j ) = j α j [1 -x j (t)]. (4)
If the interest is only in the cumulative casualties Y (T ), then the integral of the casualties up to the final instant of time T must be computed:

Y (T ) = T 0 y(t)dt.
(5) Time delays do not play any role. Indeed, it can be shown that the integrals over time of the terms in Equation ( 5) are left unchanged by a time translation. Analogously, it is possible to define the cumulative casualties up to time t as:

Y (t) = t 0 y(t)dt. (6)
However, in this case, the time delays can play an important role.

Information Collection

Several academic and empirical works have attempted to assess casualties due to critical events. For example, Cavalieri, et al. [START_REF] Cavalieri | Quantitative assessment and social losses based on physical damage and infrastructural systems[END_REF] evaluate the number of casualties (injuries and fatalities) based on the number of displaced people in the case of an earthquake or damage to infrastructure systems. Hirsch [START_REF] Hirsch | Modeling the consequences of major incidents for health care systems[END_REF] assesses casualties due to critical events based on health care system response.

Casualty assessment in the consequence calculation model employs a general approach. Four pieces of information are needed to validate the model with discrete operativity level values (Hypothesis H3): (i) sectors that potentially cause casualties (m c ); (ii) average number of casualties induced by the complete disruption of the j th sector per unit of time (α j ); (iii) delay time of the j th sector (t j ); and (iv) number of casualties induced at time t by the complete disruption of the j th sector (for validation purposes) (C j (t)).

Casualty information needed by the consequence calculation model for an Italian case study was collected from four data sources (DS1-DS4): DS1: A pilot survey involving nearly 200 sector experts that collected information pertaining to the identification of sector components and the assessment of potential impacts due to sector failures.

Limitations of Information Collection

Information collected by the pilot survey (DS1) was compared with that in the reference database (DS3) and analysis was conducted using real-world data. The pilot survey (DS1) was used to identify the m c sectors to be investigated, while the desk research (DS4) enabled the analysis of casualty information (i.e., α j and C j (t)) pertaining to real-world critical events.

With regard to the assumptions and hypotheses, it is important to emphasize that the estimated effects have to be considered as the maximum potential impact affecting the area of interest. Detailed information provided by experts (DS2) was the primary source for estimating the maximum potential number of injured persons and the maximum potential number of fatalities caused by the complete failure (100% loss of service) of a sector.

Estimating the model parameters involves several considerations. The reason is that a portion of the casualties in a disaster occur as a consequence of outages of critical infrastructures in specific sectors and another portion occur as immediate and direct consequences of the disaster itself (e.g. injuries caused by the collapse of a building during an earthquake).

Another obstacle is the unstructured manner in which information is collected, especially in the case of critical events. In the vast majority of cases, only heterogeneous data is available. For example, official data about the L'Aquila earthquake on April 6, 2009 only provides the total number of deaths (298) and injured (1,500) [START_REF] Civile | Guido Bertolaso in audizione alla Commissione Ambiente del Senato[END_REF] without any details about their causes.

After selecting the subset of sectors in which an outage might produce casualties, efforts were focused on retrieving information about these sectors from widely-accessible sources (non-specialized press articles, websites, etc). Deep scanning of several types of information sources for unexpected critical events (e.g., peer reviewed articles, newspapers and gray literature) (DS4) did not provide useful indications about the distributions of injured persons and fatalities over time.

Official statistics, such as those disseminated by the Italian National Institute of Statistics [START_REF]Cause di morte[END_REF], provide information on the numbers of injured persons and fatalities by cause, but the majority of them (about 85%) are related to health problems. The remaining 15% include four main causes -accidents, suicides, homicides and undetermined events -a classification that is not appropriate for investigating the consequences of critical events.

Limitations due to Data Requirements

Information related to the total number of casualties for a critical event is difficult to adapt with respect to the assumption of independence of sector impacts and disruption causes (Assumption A1) and time homogeneity (Assumption A2). The challenge is related to the fact that the idiosyncratic nature of an event (e.g., earthquake or terrorist bombing) causes an unpredictable number of casualties that cannot be reduced in the time frame of the event. Because of the intervention perspective of civil protection personnel and first responders, the main interest is in evaluating the number of casualties caused in the time frame starting right after the end of the direct effects of an event. This perspective is considered in the concrete application of the consequence calculation model, which seeks to provide indications of intervention priorities in different sectors in order to contain the potential consequences. For example, in the case of the L'Aquila earthquake, analysis of the data using the consequence calculation model should discriminate between casualties (injured persons and fatalities) directly caused by the event and the casualties caused by consequent failures of infrastructures in the affected area.

Another challenge arises because, in the consequence calculation model, each sector is supposed to have a deterministic impact in case of a total failure regardless of the timing of the failure (Assumption A2). For example, in the case of the L'Aquila earthquake, data on casualties caused by consequent failures of infrastructures in the affected area were not collected with respect to detailed time frames (e.g., casualties due to the electricity sector outage after one hour, one day or one week).

Direct Collection Approach

The lack of useful structural data from official statistics and information on casualties forced the use of a direct data collection approach for some sectors. In addition, a direct data collection approach was necessary because of the assumption that the numbers of injured persons and fatalities follow the same distributions over time, but with sector-specific parameters.

Direct data collection involved the following steps:

Step 1: Identification of the subset of sectors with potential casualties. For example, these are sectors for which experts questioned in the pilot survey (DS1) answered "Yes" to the question: "According to your opinion/experience, do you believe that a complete service outage of the sector may directly cause fatalities/injuries?" and provided an answer to: "If yes, please quantify the number of casualties as a function of the service outage time (e.g., nothing until two hours, from one to five until 18 hours, and from six to ten until two days)."

Step 2: Second round of interviews with the experts for the selected sectors. The experts were given an ad hoc questionnaire (Questionnaire for impact evaluation in terms of casualties in the event of sector failures) (DS2).

Step 3: Final identification of the sectors to be considered.

Step 1 yields the sectors that cause casualties. In theory, a total disruption of any sector would cause casualties in the long term. The sectors that cause casualties are those that have higher probabilities of generating injuries and fatalities in the short term. The selection of sectors was made on the basis of information provided by experts in the pilot survey and a "reasonability assessment" made by the research team. A preliminary cut was made of the sectors that might be directly responsible for the occurrence of casualties.

The key element of Step 2 was the interviews of sector experts (DS2). General considerations regarding the propensity of a sector to generate casualties in the short term due to a complete and prolonged outage came with detailed information on the impacts along the time dimension. In particular, the Italian sector experts were asked to provide indications to help construct casualty curves of injured persons and fatalities (Figure 3). The casualty curves can help overcome the limitations of Hypothesis H1 by adding a time after which no more impacts occur. Note that the non-recovery of a sector implies the indefinite generation of new casualties.

The key information provided by the experts for their sectors of reference included:

The instant of time when the effects start and the instant of time when the effects end with respect to the instant of time when the failure occurs.

The average percentage of casualties in the total population of interest per time unit.

The two parameters α j and t + t j in the consequence calculation model were estimated using input from experts. The interviews with experts constituted the final criterion to determine the subset of sectors that potentially suffer effects in terms of casualties. A reduced list of sectors for which the casualty effects can be computed was specified based on the availability of data and the possibility of estimating the parameters needed to generate and propagate the casualties that occur during complete sector failures.

Conclusions

Consolidated approaches are required to assess the consequences of critical events, especially the casualties that potentially occur when critical infrastructures are disrupted, damaged or destroyed. The consequence calculation model is readily applied to any structured classification of socio-economic activities with a predefined geographical scope. The model relies on the definition of sectors of economic activity as identified in official statistical classifications (e.g., NACE for the European context), but it can also be implemented by classifying socio-economic activities in any coherent manner. Moreover, the consequence calculation model can be applied to assess the effects of critical events regardless of the approach used to represent interdependencies (e.g., input-output relationships and direct recognition).

The application of the consequence calculation model in the Italian context proved to be a challenging task. Due to the paucity of publicly-available data, it was necessary to solicit information from sector experts to apply the model and validate the results. Nevertheless, the model and its failure trees are invaluable to operators and strategic decision makers.

Future research will focus on alleviating the limitations induced by the assumptions and hypotheses, thereby providing civil protection personnel and first responders with an effective planning instrument for analyzing potential casualties. Extending the scope to additional countries is another important research topic -it will help tune the model and enhance strategies for reducing event consequences, especially casualties, that directly affect populations.

Figure 1 .

 1 Figure 1. Failure tree reporting effects by sector.

Figure 2 .

 2 Figure 2. Failure tree reporting eventual effects in terms of casualties by sector.

DS2:

  A questionnaire submitted to one expert from each sector that potentially suffers casualties. The information helped refine the assessment of the potential casualties occurring as a result of sector failures. DS3: Public databases maintained by the Italian National Institute for Statistics (ISTAT) [8]. DS4: Desk research.

Figure 3 .

 3 Figure 3. Occurrence of injured persons after a total failure of Sector A.

Acknowledgement

This research was initiated under Project DOMINO, which was supported by the Prevention, Preparedness and Consequence Management of Terrorism and Other Security Related Risks Programme launched by the Directorate-General Home Affairs of the European Commission. Project DOMINO research was conducted by the Ugo Bordoni Foundation (Italy), FORMIT Foundation (Italy) and Theorematica (Italy) with the support of the Presidency of the Council of Ministries (Italy), Home Office (United Kingdom), SGDN (France) and Ministry of Emergency Situations (Bulgaria).