Antonio Di

Stefano Panzieri

Andrea Gasparri

Situational Awareness Using Distributed Data Fusion with Evidence Discounting

Keywords: Distributed data fusion, cautious conjunctive rule, evidence discounting

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Combining pieces of information through data fusion techniques can enhance the security of critical infrastructure systems by providing improved situational awareness that supports decision making. Usually, critical infrastructure systems combine the information coming from their sensors individually, without sharing information regarding their operating states with other infrastructures. This is mainly due to the fact that the delivery of sensitive information to external entities poses security issues (see, e.g., [START_REF] De Porcellinis | A holisticreductionistic approach for modeling interdependencies[END_REF][START_REF] Sutton | The contribution of Neisas to EP3R, in Critical Information Infrastructure Security[END_REF]). However, in real-time environments, there are numerous scenarios in which allowing full information exchange could be beneficial.

Foglietta et al. [START_REF] Foglietta | A networked evidence theory framework for critical infrastructure modeling[END_REF] have applied an algorithm based on the work of Gasparri et al. [START_REF] Gasparri | A networked transferable belief model approach for distributed data aggregation[END_REF] to share information among a set of critical infrastructures in order to produce common knowledge and decrease the possibility of producing cascading effects. In their approach, the infrastructures -implemented as "agents"constitute a connected network and combine their local information about their operating states using a distributed algorithm. However, the approach requires the network to have a spanning tree topology.

Ducourthial et al. [START_REF] Ducourthial | Self-stabilizing distributed data fusion, in Stabilization, Safety and Security of Distributed Systems[END_REF] have proposed a distributed algorithm that implements data fusion in unknown topologies. The algorithm computes the confidence of each node by combining all the data received from its neighbors using a "discounted cautious operator" and without relying on a central node for data collection. The algorithm converges for any initial configuration and for any unknown network topology. However, the algorithm requires the network topology to become stable (i.e., nodes and links are fixed and agents do not perform any dynamic observations) in order to reach convergence.

Considerable research has focused on applying data fusion techniques to enhance the security of critical infrastructures. Genge et al. [START_REF] Genge | Data fusion based anomaly detection in networked critical infrastructures[END_REF] have employed cyber-physical data fusion based on the Dempster-Shafer theory [START_REF] Dempster | A generalization of Bayesian inference[END_REF][START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] to combine knowledge from the cyber and physical dimensions of critical infrastructures in order to implement an anomaly detection system. The system was validated in a scenario involving distributed denial-of-service attacks on an information network whose disturbances propagated to a simulated power grid. However, the centralized nature of this approach (i.e., all the data must be collected by a single node that performs data aggregation) limits its robustness to single node failures.

Oliva et al. [START_REF] Oliva | Distributed consensus under ambiguous information[END_REF] have presented a distributed consensus algorithm based on fuzzy numbers and subsequently applied it to a case study related to crisis management. The algorithm provides consensus on the overall criticality of a situation based on the information provided by human operators regarding the state of critical infrastructures. However, the algorithm is complex and requires the generation of appropriate fuzzy membership functions to model operator opinions. Sousa et al. [START_REF] Sousa | Intrusion-tolerant self-healing devices for critical infrastructure protection[END_REF] have proposed a critical infrastructure protection methodology based on distributed algorithms and mechanisms implemented between a set of devices that provide secure gossip-based information diffusion among infrastructures. Although the methodology ensures that the data traffic satisfies security policies for mitigating cyber attacks, it lacks flexibility when dealing with physical threats or uncertain threats.

This chapter presents a data fusion methodology for interdependent critical infrastructures based on the algorithm of Ducourthial et al. [START_REF] Ducourthial | Self-stabilizing distributed data fusion, in Stabilization, Safety and Security of Distributed Systems[END_REF] to exchange information between critical infrastructures and, thus, increase situational awareness. Simulation results show that each infrastructure converges without relying on a static network topology and despite the presence of link failures (e.g., due to natural disasters or cyber attacks). With respect to distributed consensus, the methodology enables each infrastructure to converge and, thus, capture the particular behavior of an infrastructure that, due to its specific dependencies and/or internal failures, may exhibit a particular state. Moreover, the modeling of failures and threats using the Dempster-Shafer formalism takes into account the imprecision and uncertainty in detecting events without the need to specify membership functions as required by fuzzy-based approaches. The cautious operator [START_REF] Denoeux | Conjunctive and disjunctive combination of belief functions induced by nondistinct bodies of evidence[END_REF] and an evidence discounting function are used to aggregate information provided by the connected infrastructures. This operator ensures network convergence when the network topology and direct confidences are stable [START_REF] Ducourthial | Self-stabilization with path algebra[END_REF][START_REF] Ducourthial | Self-stabilizing distributed data fusion, in Stabilization, Safety and Security of Distributed Systems[END_REF]. The evidence discounting concept was introduced by Shafer [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] to account for the reliability of source information. Cherfaoui et al. [START_REF] Cherfaoui | Distributed data fusion: Application to confidence management in vehicular networks[END_REF] have applied evidence discounting to a network of agents based on the distance and age of received messages before combining them with local knowledge. The proposed methodology uses evidence discounting to decrease the information content provided by a supporting infrastructure that is loosely coupled.

Overview of the Methodology

The theoretical framework of Rinaldi et al. [START_REF] Rinaldi | Identifying, understanding and analyzing critical infrastructure interdependencies[END_REF] defines several dimensions of an infrastructure interdependency: (i) type of interdependency; (ii) infrastructure environment; (iii) coupling characteristics; (iv) type of failure; (v) infrastructure characteristics; and (vi) state of operation. As will be discussed later, the proposed methodology addresses three dimensions: (i) coupling characteristics (e.g., tight or loose according to Perrow [START_REF] Perrow | Normal Accidents: Living with High-Risk Technologies[END_REF]); (ii) type of failure (e.g., cascading or common cause or escalating failures); and (iii) state of operation (e.g., normal or stressed).

In order to effectively model and simulate the dynamic behavior of infrastructures, several researchers have engaged the network-based paradigm [START_REF] Ouyang | Review on modeling and simulation of interdependent critical infrastructure systems[END_REF], representing infrastructures as network nodes and physical connections between the infrastructures as links (edges). The nodes and edges in an infrastructure topology deliver/consume services and/or resources to/from other nodes. However, in the proposed methodology, while infrastructures are represented as nodes, the edges correspond to communications channels that allow the exchange of information about the possible cause(s) of faults. The resulting information sharing framework provides higher information content at each infrastructure layer regarding the possible evolution of the state of operation of each infrastructure. This information can be used by decision makers to take immediate countermeasures and, thereby, decrease the possibility of cascading effects.

The proposed methodology involves three steps:

Event Detection: Each infrastructure produces local information (e.g., by using sensors) called "direct confidence" regarding the credibility of possible normal and stressed operating states.

Knowledge Aggregation: The infrastructures aggregate their local information according to the gossip communications paradigm [START_REF] Boyd | Randomized gossip algorithms[END_REF] to produce more informative data called "distributed confidence" regarding the credibility of possible normal and stressed operating states.

Convergence: At a certain time, the information has been distributed to such an extent that the distributed confidence of each infrastructure does not vary (i.e., the agents representing each infrastructure reach convergence).

The Dempster-Shafer formalism [START_REF] Dempster | A generalization of Bayesian inference[END_REF][START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] is used to deal with the imprecision and uncertainty in detecting events. As explained later, each infrastructure i, when fusing its information with the information received from an infrastructure j, discounts the incoming information according to the degree of coupling between infrastructure i and infrastructure j. In other words, information coming from a loosely coupled infrastructure is considered to be less relevant than information coming from a tightly coupled infrastructure; this expresses the fact that the state of operation of the inputs from the supplying infrastructure would have small or large effects on the receiving infrastructure.

Fusing information from two infrastructures requires knowledge of the degree of coupling of the infrastructures. One approach is to use statistical analysis of historical data about the number of disruptions initiated by one infrastructure that caused cascading failures in a second infrastructure; this provides evidence whether the two infrastructures are tightly or loosely coupled. van Eeten et al. [START_REF] Van Eeten | The state and the threat of cascading failure across critical infrastructures: The implications of empirical evidence from media incident reports[END_REF] have analyzed public media articles about infrastructure disruptions that occurred in The Netherlands from 2010 to 2014. Their analysis revealed that, depending on the infrastructures where the cascading-initiating failures occurred, certain infrastructures were more frequently affected by cascading failures than other infrastructures. For example, when considering health as the affected sector, 50% of the cascading-initiating failures occurred in the energy sector, 13% in the telecommunications and water sectors, and 24% were the result of internal failures.

With regard to agent (infrastructure) interaction in this work, simulation results demonstrate that the proposed methodology is robust to communications link failures occurring in disaster scenarios. Moreover, a strategy is proposed to update the confidence of each node when a specific communications link is unavailable due to: (i) physical destruction of network infrastructure components; (ii) disruptions in supporting infrastructures; and (iii) disruptions due to congestion [START_REF] Townsend | Telecommunications Infrastructure in Disasters: Preparing Cities for Crisis Communications, Center for Catastrophe Preparedness and Response and Robert F[END_REF].

Data Fusion

The theory of evidence is a formalism that can be used to model imprecision and uncertainty. The theory, introduced by Dempster [START_REF] Dempster | A generalization of Bayesian inference[END_REF] and Shafer [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] (also known as the Dempster-Shafer theory), embraces the intuitive idea of associating a number between zero and one to model the degree of confidence of a proposition with partial (e.g., uncertain or imprecise) evidence. Let Ω = {ω 1 , ..., ω n } be the set of possible values of a variable ω where the elements ω i are assumed to be mutually exclusive. Let Γ(Ω)

2 Ω = {γ 1 , ..., γ |Γ| } be the associated power set. In this framework, the set Ω, which is referred to as the "frame of discernment," quantifies the confidence of propositions of the form: "the true value of ω is in γ" with γ ∈ 2 Ω .

Definition 1 (Basic Belief Assignment)

A function m : 2 Ω → [0, 1] is called a basic belief assignment (BBA) m if γa∈2 Ω m(γ a ) = 1 with m(∅) = 0.
Definition 2 (Commonality Function) A BBA m can be equivalently represented by its associated commonality q : 2 Ω → [0, 1] defined as:

q(γ a ) = γ b ⊇γa m(γ b ), γ a ∈ 2 Ω (1)
Thus, for γ a ∈ 2 Ω , m(γ a ) is the portion of confidence that supports exactly γ a (i.e., the fact that the true value of ω is in γ a ) but, due to the lack of further information, does not support any strict subset of γ a .

The main limitation of the Dempster-Shafer theory is the Dempster combination rule [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF], which produces counterintuitive results when strong conflict exists among the sources that are combined [START_REF] Zadeh | On the Validity of Dempster's Rule of Combination of Evidence[END_REF]. The transferable belief model of Smets [START_REF] Smets | The combination of evidence in the belief model[END_REF] also relies on the concept of BBA, but it removes the assumption m(∅) = 0. The removal of this assumption applies when the frame of reference is not exhaustive, so it is reasonable to believe that another event, not modeled in the considered frame, will occur. This allows for a refined conjunctive rule that is more robust than the Dempster combination rule in the presence of conflicting evidence [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF]. However, this rule and the Dempster combination rule rely on the distinctness assumption with regard to the sources. This limitation can be avoided using an interaction rule called the cautious rule of combination [START_REF] Denoeux | Conjunctive and disjunctive combination of belief functions induced by nondistinct bodies of evidence[END_REF], which is associative, commutative and idempotent. The use of the rule is also appropriate when all the sources are considered to be reliable and the assumption of independence is not required.

Definition 3 (Weight Function)

Let m be a generic BBA. Then, the relative weight function w : 2 Ω \ Ω → R + is defined as:

w(γ a ) = γ b ⊇γa q(γ b ) (-1) |γ b |-|γa |+1 , ∀γ a ∈ 2 Ω \ Ω (2)
Definition 4 (Cautious Rule of Combination ( )) Let m 1 and m 2 be two generic BBAs with weight functions w 1 and w 2 , respectively. Then, their aggregation using the cautious rule of combination is defined by the following weight function:

w 1 2 (γ a ) = min(w 1 (γ a ), w 2 (γ a )), ∀γ a ∈ 2 Ω \ Ω (3)
The data aggregation algorithm works with the weight function w(•), which is obtained using the commonality function q(•) derived from the initial set of BBAs. Table 1 shows the function w 1 2 (•) obtained by applying the cautious combination rule to the weight functions w 1 and w 2 . From now on, w ij (•) will denote the weight function obtained by applying the cautious combination rule to two generic weight functions w i (•) and w j (•).

m α (γ a ) = α m(γ a ) for γ a ⊂ Ω 1 -α + α m(γ a ) for γ a = Ω where α ∈ [0, 1] is called the discounting factor. Table 2. BBA m(•) and its relative discounting function m α (•) (α = 0.2). BBA ∅ a b Ω m(•) - 0 . 3 0 0 . 4 0 0 . 3 0 w(•)
1.40 0.50 0.40 m 0.2 (•) -0.06 0.08 0.86 w 0.2 (•) 1.00 0.93 0.91 Table 2 shows an example of BBA m(•) and its relative discounting function m α (•) obtained for α = 0.2. The table also presents the weight functions associated with the two BBAs.

Data Fusion Methodology

The goal is to create a model that represents the interdependencies and the communications channels between critical infrastructures as a graph structure. The model embeds the notion of degree of coupling based on the general model of Rinaldi et al. [START_REF] Rinaldi | Identifying, understanding and analyzing critical infrastructure interdependencies[END_REF] and the specific assumptions described earlier.

Motivation

In order to motivate the choice of the model, consider n = 5 dependent critical infrastructures that can be affected by failures or threats. Each infrastructure is able to produce one BBA expressed as a weight function w(•) from the physical and cyber events detected by the aggregation agents. The frame of discernment is Ω = {a, b, c} where a denotes a possible physical failure, b a possible cyber intrusion or attack and c a normal functioning level. Assume that the set of systems is geographically distributed and generically corresponds to the infrastructures of a city district. The scenario, derived from [START_REF] Formicola | Assessing the impact of cyber attacks on wireless sensor nodes that monitor interdependent physical systems[END_REF], incorporates a hydroelectric power station that feeds a power distribution station through a transmission network (not modeled for simplicity). A base transceiver station (BTS) provides telecommunications services required by the SCADA systems of the power distribution station and water pumping station. The base transceiver system receives electricity from the power distribution station. The water pumping station receives electricity from the power distribution station to operate automation devices and water pumps. Failures occurring in the considered infrastructures may produce disruptions at a hospital that receives water from the water pumping station and electricity from the power distribution station. In addition, the hospital may suffer a disruption during a malfunction of the base transceiver system, which provides mobile communications.

Figure 1 shows the dependency layer of the scenario. Assume that the infrastructures can exchange information regarding possible failures or threats. Communications employ virtual private network links between the infrastructures that exhibit non-negligible dependencies.

The model introduced in the following section is able to capture the various couplings between the infrastructures and implement information sharing to enhance situational awareness in the infrastructures.

Weighted Digraphs

Formally, the model is represented as a weighted digraph G = (V, E(t), Q) where V = {v 1 , ..., v n } with n > 1 is the vertex set, E(t) = {e ij } is the edge set and Q = {q ij } with q ij ∈ P = {l, m, h} is the set of weight indices associated with each edge e ij in G. It is assumed that G has no loops. Note that:

An element v i of V represents an agent denoting infrastructure i.

An element e ij of E(t) represents the degree of coupling between agents v i and v j .

An element q ij of Q represents the weight index corresponding to the degree of coupling of agent v j on agent v i .

The graph G represents the dependency layer, where each infrastructure or agent v j , by combining its direct confidence with the confidences of all the dependent agents v i , obtains a distributed confidence that expresses the operative level of agent v j . For the sake of simplicity, technical aspects regarding how communications are realized are abstracted away. More precisely, it is assumed that the graph G that encodes the network dependence is supported by the communications layer. In other words, communications can always be established between a pair of nodes v i and v j with coupling w ij if and only if a non-negligible dependence e ij ∈ E(t) exists.

Four assumptions are made regarding the network of agents: (i) graph G has at least a rooted spanning tree; (ii) every node v ∈ V produces a local BBA expressed as a weight function w(•) called the direct confidence; (iii) node communications are asynchronous (i.e., at any time t k , only a pair of agents (v i , v j ) interacts); and (iv) each agent can store the current direct confidence, the direct confidences of its ancestors and the distributed confidence that is computed via node aggregation.

Agent Interactions

In the proposed framework, agent actions are modeled using a gossip algorithm [START_REF] Boyd | Randomized gossip algorithms[END_REF], which is defined in terms of the triplet {S, R, e} where: S = {s 1 , ..., s n } is the set containing the local states s i ∈ R q of each agent v i in the network such that s i (t) = (w i (t, γ 1 ), .., w i (t, γ q )) at time t with q = |2 Ω \ Ω|. R is the interaction rule based on the cautious operator and the discounting function r(•) where any two agents v i , v j ∈ V with e ij ∈ E(t) yield R : R q × R q → R q such that:

s j (t) = (w j (t, γ 1 ) r(w i (t, γ 1 )), ..., w j (t, γ q ) r(w i (t, γ q ))) (4) r(w i (t, γ a )) = ⎧ ⎪ ⎨ ⎪ ⎩ r l (w i (t, γ a )) = min(1, w i (t, γ a ) + 0.4) if q ij = l r m (w i (t, γ a )) = min(1, w i (t, γ a ) + 0.25) if q ij = m r h (w i (t, γ a )) = w i , (t, γ a ) i f q ij = h Table 3. BBA m f i (0) applied to node vi in case of link failure of eij. BBA ∅ a b c ab ac bc Ω m f i (0) -0.10 0.10 -0.40 - - 0.40
e is the edge selection process that specifies the edges e ij selected at time t.

When updating the generic agent v j with an incoming agent v i , a discounting function r(•) is applied to the weight function w i (•) according to the degree of coupling of v j on v i . Note that the choice of the discounting function is generally application-dependent. The function given above is an effective choice for the case study. When the degree of coupling is high (q ij = h), the discounting function leaves w i (•) unchanged. However, when the coupling is medium or low (q ij = m or q ij = l, respectively), the discounting function applies a decreasing constant factor to w i (•). This way, the refined r(w i (•)) approaches the neutral element w ⊥ (unit vector consisting only of one values) with respect to the cautious operator to handle low couplings. In order to render the algorithm robust to communications link failures, when the edge selection process e extracts one or more links e ij that are unavailable at a certain time t, the algorithm associates the BBA m f i (•) to nodes v i that cannot communicate with node v j that performs the update. The BBA m f i (•) reported in Table 3 implements the worst-case policy that increases the credibility of failures a and b when no information is available about the state of operation of agent v i .

The proposed methodology is formalized as Algorithm 1, which extends the approach proposed by Ducourthial et al. [START_REF] Ducourthial | Self-stabilizing distributed data fusion, in Stabilization, Safety and Security of Distributed Systems[END_REF].

Graph Construction

Based on the model and the example scenario, a graph G with n = 5 agents was constructed where each agent modeled a specific infrastructure and each link modeled the dependency existing between the corresponding infrastructures. The assignment of weights considered the incident data collected by van Eeten et al. [START_REF] Van Eeten | The state and the threat of cascading failure across critical infrastructures: The implications of empirical evidence from media incident reports[END_REF] and the application of the method based on the occurrence of historical cascading faults described earlier. For each infrastructure i, let R j = Nj Ni be the number of historical faults N j initiated in infrastructure j that produced a fault in infrastructure i calculated over the total number of cascading failures N i affecting infrastructure i. For each dependency between infrastructures i and j, four cases exist: (i) q ij = h when R j ≥ 80%; (ii) q ij = m when 80% > R j ≥ 20%; (iii) q ij = l when 20% > R j ≥ 5%; and (iv) a negligible dependency (not modeled as an edge) when R j < 5%. Because there was no mention of cascading failures occurring among the different infrastructures of the energy sector, it was decided to associate a high dependency on Algorithm 1 : Gossip algorithm.

1: procedure GossipAlgorithm(s j (0) ∀ j ∈ 1, ..., N)

2:

while stop condition do 3:

for each edge e ij ∈ E(t) according to e do Update the state of agent j according to R:

4:
if q ij = l then 5:

s j (t + 1) = s j (t) r l (s i (t))

6: if q ij = m then 8:

s j (t + 1) = s j (t) r m (s i (t)) Return s j (t stop ) ∀ i ∈ 1, ..., N 17: end procedure the power distribution station of the hydroelectric station and to consider it as an autonomous system. Figure 2 shows the dependency layer graph G for the example scenario where each edge is labeled with the service provided and the relative degree of coupling. Note that the l, m and h denote low, medium and high degrees of coupling, respectively. The resulting system can be modeled as a multi-agent platform for distributed data aggregation, where each agent produces a BBA expressing the possible critical event(s) and interacts with other agents via a communications channel.

Simulation Results

This section presents the simulation results obtained for two situations in the example scenario: (i) the network topology G is stable (i.e., the set of agents V and the set of edges E are both static); and (ii) the network topology G is dynamic (i.e., the set of agents V is static and the set of edges E is dynamic (time-varying)). For each of the two situations, two cases were considered: (i) the direct confidence produced by each agent is static; and (ii) the direct confidence produced by each agent is dynamic (i.e., time-varying). In the situation where the network topology is dynamic, it is assumed that, at each time step, the graph G is connected and corresponds to a rooted spanning tree. For all four cases, the pignistic transformation [START_REF] Smets | The transferable belief model[END_REF] was used to transform the convergent normalized BBA m(•) to a probability measure P m = Bet(m) as follows:

m (γ a ) = ∅̸ =γ b ⊆Ω m(γ b ) |γ a ∩ γ b | |γ b | , γ a ∈ 2 Ω ( 5
)
This measure is useful to decision makers because it quantifies the probability of occurrence of the operational states of an infrastructure.

Static Network Topology

This section presents the simulation results obtained for the two cases of static and dynamic direct confidence of agents given a static network topology.

Static (Time-Invariant) Confidence. This case considers a stable network topology G where the set of agents V and the set of edges E are both static and the direct confidence of the agents is time-invariant. Table 4 shows the simulation results in terms of the convergent BBAs obtained at time t = 5 and based on a specific set of BBAs for the system of five agents at time t = 0. The results show that agent v 4 , which monitors the hospital, starts with a probability of normal functioning P m4 (t = 0) = 0.55 and reaches a lower probability of normal functioning P m4 (t = 5) = 0.38. This can be explained by the fact that the water pumping station and the power distribution grid maintain stable normal functioning levels over time.

Dynamic (Time-Varying) Confidence. This case considers a stable network topology G where the set of agents V and the set of edges E are both static and the direct confidence of the agents varies over time. Table 5 shows the simulation results in terms of the convergent BBAs obtained at time t = 43 and based on a specific set of BBAs for the system of five agents through dynamic observations of agents v 2 and v 3 at time t = 40. The results show that agent v 4 , starts with a probability of normal functioning P m4 (t = 0) = 0.55 and reaches

Dynamic Network Topology

This section presents the simulation results obtained for the two cases of static and dynamic direct confidence of agents given a dynamic network topology.

Static (Time-Invariant) Confidence. This case considers a dynamic network topology G where the set of agents V is static, the set of edges E varies over time and the direct confidence of the agents is time-invariant. In the dynamic topology, it is assumed that, at each time step, the set of edges E(t) may or may not contain some of the edges, e 23 , e 24 , e 25 , e 34 and e 54 , so that the graph G is always connected and exhibits at least a rooted spanning tree. For each link, the probability of failure is assumed to be P f = 0.5.

Table 6 shows the simulation results in terms of the convergent BBAs obtained at time t = 31. The results show that agent v 4 starts with a probability of normal functioning P m4 (t = 0) = 0.55 and reaches a lower probability of normal functioning P m4 (t = 31) = 0.29. This can be explained by the occurrence of several link failures that are managed by considering m f i (•) as a BBA for a node v i that cannot communicate with node v j .

Dynamic (Time-Varying) Confidence. This case considers a dynamic network topology G where the set of agents V is static, the set of edges E varies over time and the direct confidence of the agents varies over time. In the dynamic topology, it is assumed that, at each time step, the set of edges E(t) may or may not contain some of the edges, e 23 , e 24 , e 25 , e 34 and e 54 , so that the graph G is always connected and exhibits at least a rooted spanning tree. Table 7 shows the simulation results in terms of the convergent BBAs obtained at time t = 50 and based on a specific set of BBAs for the system of five agents through dynamic observations of agents v 2 and v 3 at time t = 40. The

2 Definition 5 (

 25 Discounting Function) Let m be a generic BBA. Then, the relative discounting function m α (γ a ) is defined as follows:

Figure 1 .

 1 Figure 1. Resources exchanged by the infrastructures.

Figure 2 .

 2 Figure 2. Dependency layer graph G for the example scenario.

P

Table 1 .

 1 Application of the cautious combination rule.

Table

  Simulation results (dynamic network topology; static agent confidence). ) 0.17 0.02 0.19 0.15 0.09 0.06 0.06 0.26 m4(t) 0.16 0.03 0.13 0.20 0.07 0.10 0.10 0.21 m5(t) 0.13 0.01 0.19 0.16 0.03 0.08 0.08 0.32

	BBA	∅	a	b	c	ab	ac	bc	Ω
	m1(0)	-	-	-	0.70	-	-	-	0.30
	m2(0)	-	-	-	0.50	-	-	-	0.50
	m3(0)	-	-	0.20 0.20	-	0.10 0.10 0.40
	m4(0)	-	-	0.10 0.30	-	0.15 0.15 0.30
	m5(0)	-	-	0.20 0.20	-	0.10 0.10 0.40
	m1(t)	-	-	-	0.70	-	-	-	0.30
	m2(t) 0.02	-	0.02 0.48	-	-	-	0.48
	m3(t

CRITICAL INFRASTRUCTURE PROTECTION IX

a lower probability of normal functioning P m4 (t = 43) = 0.29. This can be explained by the fact that the normal functioning of the power distribution grid has decreased credibility. Additionally, it was discovered that, if the direct confidences change at time t ′ with t ′ > t where t is the convergence time before the dynamic observations occur, then the edge selection policy does not influence the convergent BBAs. On the other hand, if the direct confidences change at time t ′ < t, then the edge selection policy causes the network to reach a different equilibrium point for the convergent BBAs. simultaneous changes of links and direct confidences of the agents over time causes the network to reach a different equilibrium point.

Conclusions

The data fusion methodology described in this chapter enables interdependent critical infrastructures to exchange information about possible threats and failures in order to increase situational awareness. The effectiveness of the methodology was demonstrated using a realistic scenario of critical infrastructures with different degrees of coupling that produce early warnings of possible physical and cyber events. Simulation results reveal that the methodology is robust to communications link failures and converges after the last dynamic observations of the infrastructures. Future work will focus on mathematical proofs of convergence for the static and dynamic network configurations.


Chiara Foglietta

Cosimo Palazzo

Riccardo Santini

Stefano Panzieri

Assessing Cyber Risk Using the CISIApro Simulator

Keywords: Critical infrastructure, simulation, cyber attacks, risk

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Critical infrastructures are vital to modern society. Airports, rail transport, network communications, electric grids, oil refineries and water systems are examples of critical infrastructure assets. Industrial operations adhere to the so-called N -1 standard, which refers to the ability to operate without the loss of service after the failure of one key component. Industrial plants also have the ability to operate despite the loss of two key components (N -2 standard). However, the N -2 standard is inadequate for critical infrastructures because major service outages, coordinated cyber attacks and faults often initiate in other interconnected infrastructures and propagate to the infrastructure of interest. Conditions within the infrastructure of interest as well as the existing infrastructure interdependencies must be considered and evaluated in order to restore services as soon as possible.

For more than fifteen years, researchers have grappled with the problems of modeling interdependencies and predicting the effects of infrastructure failures. The 2003 North American blackout was the first example of cascading effects after a power outage. The blackout, which was due to a software bug in an electric grid control room, impacted water supply, transportation, communications systems and several industries [START_REF] Andersson | Causes of the 2003 major grid blackouts in North America and Europe and recommended means to improve system dynamic performance[END_REF]. Another example is Hurricane Katrina, which interrupted oil production, transportation, refining, ocean shipping and exports as well as electric utilities [START_REF] Kwasinski | Hurricane Katrina Damage Assessment of Power Infrastructure for Distribution, Telecommunications and Back-Up[END_REF].

Critical infrastructures adhere to the N -1 standard and they are protected from failures that initiate in their own sectors. In the event of a failure in the power grid, operators can reconfigure the grid to isolate the fault and restore power to customers (some users might still not have power, but the blackout is not complete). The reconfiguration procedure can be automated or executed manually and it depends on the specific topology (the sequence of opening and closing circuit breakers is related to the topology) as well as on other infrastructures, especially the telecommunications network, which is used to send commands to circuit breakers. This procedure is called fault isolation and system restoration (FISR) or power load shedding.

If a cyber event or a failure occurs in the telecommunications network, the procedure for restoring power may fail without any alerts being sent to power grid operators. In this situation, a routine failure can evolve to become a large-scale blackout that lasts for an extended period of time. One of the most famous cyber attacks on a SCADA network was perpetrated by Stuxnet [START_REF] Falliere | Stuxnet Dossier, Version 1.4[END_REF]. This chapter focuses on the modeling and assessment of the impacts of cyber events on interconnected critical infrastructures.

The vast reach of telecommunications networks leads to poorly understood situations that can have uncontrolled effects on physical equipment in critical infrastructure assets. However, the problem of detecting cyber anomalies is outside the scope of this research because the approach presented here is independent of anomaly detection techniques. Indeed, the assumption here is that intrusion detection systems and malware protection software are in place to collect data about potential anomalies.

This chapter demonstrates the application of CISIApro to evaluate the effects of cyber attacks on physical equipment and infrastructure services. A complex environment involving three interconnected infrastructures is considered: a medium voltage power grid managed by a control center over a SCADA network that is interconnected with a general-purpose telecommunications network. The functionality of the simulator is illustrated by subjecting the interconnected infrastructures to an ARP spoofing attack to compromise a secure communications channel, which is then used to launch a worm infection. The simulation demonstrates the utility of CISIApro in supporting decision making by electric operators, specifically helping choose between alternative fault isolation and system restoration procedures.

Related Work

This section conducts a brief analysis of techniques and tools for modeling and simulating interdependent critical infrastructures, with a focus on evaluating the consequences of cyber attacks.

Infrastructure Modeling and Simulation

Satumitra and Duenas-Osorio [START_REF] Satumitra | Synthesis of modeling and simulation methods in critical infrastructure interdependencies research[END_REF] have published an exhaustive survey of the principal methods for critical infrastructure modeling and simulation. Their survey reveals that most of the approaches for dealing with infrastructure interdependencies, cascading system failures and risk mitigation are complementary rather than competing. The modeling approaches include techniques based on game theory, graph theory, risk-based models, Petri nets and Bayesian networks. However, many of the interdependency models are primarily conceptual in nature or are limited to simple or high-level scenarios.

Rahman et al. [START_REF] Rahman | I2Sim: A matrixpartition based framework for critical infrastructure interdependencies simulation[END_REF] have developed the Infrastructure Interdependency Simulator (I2Sim) based on the well-known cell-channel model. In this model, infrastructures and their interconnections are represented using cells and channels. A cell is an entity that performs a function. For example, a hospital is a cell that uses input tokens such as electricity, water and medicines, and produces output tokens such as the number of patients served. A channel is a means through which tokens flow from one cell to another. The interdependencies between infrastructures are non-linear relationships that are summarized in the form of human-readable tables. I2Sim helps decision makers optimize resources and prioritize system restoration actions after critical events. I2Sim is the core element of DR-NEP (Disaster Response Network Enabled Platform), an advanced disaster management tool that is based on a web services infrastructure and incorporates domain simulators. The modeling technique has been validated by several case studies, including one involving the Vancouver 2010 Winter Olympics. However, the case studies mainly focus on natural disasters and do not consider the impacts of cyber attacks.

A survey of the research literature reveals that the majority of simulators employ the agent-based paradigm, in which a population of autonomous interacting agents coordinate their decisions to reach a higher-level global objective. Each infrastructure is modeled as an agent. Interdependencies are modeled as edges between agents. This enables agents to exchange information: each agent receives inputs from other agents and sends its outputs to other agents (see Nieuwenhuijs et al. [START_REF] Nieuwenhuijs | Modeling dependencies in critical infrastructures[END_REF] for further details). The CISIApro (Critical Infrastructure Simulation by Interdependent Agents) simulator [START_REF] Hilty | CISIApro: Interdependency Modeling and Simulation Made Easy for Critical Infrastructures[END_REF] used in this research employs the agent-based paradigm, where each agent has a high-level description of the internal dynamics of an infrastructure. The main goal of CISIApro is to study the propagation of faults/attacks and the resulting degradation in performance [START_REF] De Porcellinis | Simulation of heterogeneous and interdependent critical infrastructures[END_REF]. Of course, a disadvantage of the approach is the difficulty in acquiring detailed information about the internal dynamics of infrastructures in order to create the agents.

Another recent trend is the use of co-simulation frameworks, where several domain-specific simulators are connected using a well-defined and generic interface (API) for simulation interoperability [START_REF] Schutte | Mosaik: A framework for modular simulation of active components in smart grids[END_REF]. The main goal of a co-simulation framework is to reuse existing models in a common context to simulate complex scenarios. The Mosaik ecosystem [START_REF] Schutte | Mosaik: A framework for modular simulation of active components in smart grids[END_REF] has been applied to analyze a smart grid scenario in which telecommunications network and power grid simulators are integrated. This work integrated various simulators for the electrical side, including models of electric vehicles in Python, photovoltaic cells in MAT-LAB/Simulink, residential loads as CSV time series data and two power distribution grids in Python. Mosaik is still at an early stage of development, but it can cope with different temporal resolutions (e.g., continuous, every minute or every fifteen minutes).

Cyber Attack Impact Assessment

Motivated by Stuxnet, researchers have focused on understanding how cyber attacks can affect physical critical infrastructure assets by leveraging SCADA telecommunications networks. This problem is complex because it requires deep knowledge from different domains -telecommunications and the specific physical infrastructure. Smart grids and power grids, in general, are perfect environments for evaluating the effects of cyber threats. Power grids have detailed analytic models at almost every level of abstraction and they also have well-documented control algorithms.

Lemay et al. [START_REF] Lemay | Modeling physical impact of cyber attacks[END_REF] have used an industrial control system sandbox for the cyber portion of a cyber-physical system and optimal power flow algorithms for an electrical simulator to replicate the physical portion of an electrical power grid. The ability to model the physical damage caused by cyber attacks enables defenders to accurately evaluate the risk using metrics such as the delivered power and generation costs.

Sgouras et al. [START_REF] Sgouras | Cyber attack impact on critical smart grid infrastructures[END_REF] have analyzed the impact of denial-of-service and distributed denial-of-service attacks on a smart meter infrastructure. They demonstrated that an attack on a single meter causes a temporary isolation or malfunction, but does not impact the power grid. However, the partial nonavailability of the demand-response mechanisms in a large number of smart meters due to a distributed denial-of-service attack could impact load shedding when the grid reaches an unsafe zone close to its maximum capacity. For these reasons, an attacker would prefer to conduct a distributed denial-of-service attack during a peak-use period in order to achieve greater impact. Dondossola et al. [START_REF] Dondossola | Cyber risk assessment of power control systems -A metrics weighed by attack experiments[END_REF] have assessed the impact of malware using a cyberphysical risk index that incorporates a probabilistic interpretation of vulnerability existence, threat occurrence and intrusion success. The basic idea underlying the cyber assessment methodology is to adopt a frequency interpretation of probability; specifically, the probabilities comprising the risk index are translated to their corresponding frequencies.

Another approach is to fuse information from the cyber and physical domains. To accomplish this, Santini et al. [START_REF] Santini | Evidence theory for cyber-physical systems[END_REF] have developed a data fusion framework using evidence theory. The data fusion framework was used to identify the cause of a cyber-physical attack (i.e., a denial-of-service attack that caused a breaker in a smart grid to malfunction).

Critical infrastructure operators are especially interested in the quality of the the services provided to their customers. Therefore, it is vital to understand the effects of cyber attacks on physical systems and their services. The CISIApro simulator used in this research is specifically designed to help determine the consequences of cyber attacks on physical equipment and the services they provide.

CISIApro Simulator

This section describes the main features of the CISIApro simulator, including its reliance on the mixed holistic reductionist (MHR) approach.

Mixed Holistic Reductionist Approach

The mixed holistic reductionist approach [START_REF] De Porcellinis | Modeling critical infrastructure via a mixed holistic reductionistic approach[END_REF] was created to exploit the advantages of holistic and reductionist methods. In holistic modeling, infrastructures are seen as singular entities with defined boundaries and functional properties. On the other hand, reductionist modeling emphasizes the need to fully understand the roles and behaviors of individual components to comprehend the infrastructure as a whole. Different types of analyses require one or both points of view and their boundaries are lost when complex case studies are considered. In the mixed holistic reductionist approach, the relationships between infrastructures can be viewed at different levels via a top-down or bottom-up approach. Critical infrastructures have specific requirements in terms of the quality of the services delivered to customers. This requires the addition of another layer -the service layer -that describes the functional relationships between components and the infrastructure at different levels of granularity. In the mixed holistic reductionist approach, services provided to customers and to other interconnected infrastructures are explicitly considered as a middle layer between the holistic and reductionist layers.

Simulator Description

CISIA is an agent-based simulator in which all agents have the same structure (Figure 1). An agent receives resources and failures from other agents. A resource is a good, service or data produced and/or consumed by an agent that is represented in CISIA as an entity. The ability to produce resources is summarized by the concept of an operative level, which depends on the availability of received resources, propagation of faults and functionality of the entity itself. An entity also receives failures via its upstream interconnections and spreads the failures to downstream entities. The failures propagate different types of faults in different ways. The output of an agent depends on the actual value of the operative level. The classes of interdependencies considered are physical, logical, geographical and cyber. Interested readers are referred to [START_REF] De Porcellinis | Simulation of heterogeneous and interdependent critical infrastructures[END_REF] for a detailed description of the CISIA simulator.

Risk is defined as the product of the impact, threat and vulnerability:

Risk = Impact × T hreat × V ulnerability (1)
Risk is usually computed as a numeric value from the impact severity, the likelihood of occurrence of the threat and the vulnerability measure. In CISIA applications, the likelihood of occurrence is replaced with the trust of the information. For each entity, a user can also add a vulnerability variable; however, in the case study discussed in this work, it is assumed that the vulnerability depends only on the distance from the source and on the persistence of the attack. The operative level of each agent is associated with a risk level. The risk, which is defined as the amount of harm due to a specific event (e.g., failure), is evaluated as:

Risk = 1 -Operative Level (2)
where 1 represents the maximum value of the operative level. A high operative level corresponds to a low risk.

In 2014, the CISIApro simulator was developed to overcome certain implementation problems associated with CISIA. The main problem was the possibil- ity of an infinite loop when resources are instantly exchanged between entities. CISIA's main cycle buffers all the information exchanged between entities at each time step. If the exchanges form a cycle, then the simulation time step never ends, which results in an infinite loop. The CISIApro simulator ensures that the information flow is well defined using a maximum execution threshold for a time step; this eliminates infinite loops.

Another disadvantage of CISIA was the extended period of time required to set up and debug the system. In CISIApro, a graphical user interface is provided to create and connect entities and to add the exchanged resources in an efficient manner (Figure 2).

After creating the entities and their interconnections (i.e., interdependencies) and adding the exchanged resources, it is necessary to implement the behavior of each entity. Each entity is composed of four modules that are executed: (i) RECEIVED, which evaluates the received resources and faults; (ii) DYNAMIC COMPUTED, which implements dynamic evolution; (iii) IN-STANT COMPUTED, which implements instantaneous evolution; and (iv) SENT, which evaluates the resources that are sent to the downstream entities.

CISIApro uses a database to capture all the information needed to represent multiple critical infrastructures and their interconnections. Figure 3 shows the database structure. Each entity is an instance of an entity type whose status is expressed using variables. Each entity has ports for exchanging resources and creating the mixed holistic reductionist model layers. Each layer embodies various interdependencies. The CISIApro output is stored in a separate database (Figure 4). This database stores timestamped data for use by operators.

Adjacency matrices that represent interdependencies existing between entities are generated during the design phase. During the simulation, the matrices are represented as queue data structures to speed up computations.

The ability of CISIApro to support operator decision making has been validated by two European Union projects, FACIES [START_REF]FACIES: Online Identification of Failures and Attacks on Interdependent Critical Infrastructures[END_REF] and CockpitCI [START_REF]CockpitCI, Selex Systems Integration[END_REF]. Figure 5 shows the information flow from input acquisition to operator display. The physical system data is gathered from the SCADA control center and the cyber threat data is obtained from cyber detection systems such as intrusion

Case Study

The case study considers three interconnected infrastructures: a medium voltage power grid controlled by a SCADA network and connected to a generalpurpose telecommunications network. Interested readers are referred to [START_REF] Ciancamerla | Discrete event simulation of QoS of a SCADA system interconnecting a power grid and a telco network[END_REF] for details about the interconnected infrastructures.

Figure 6 shows a portion of the medium voltage power grid. It consists of two lines fed by two substations that transform current from the high voltage grid. During normal conditions, the two lines are usually disconnected by two circuit breakers that are normally open (Breakers #7 and #8 in Figure 6). Also, Breakers #3 and #5 are open in order to maintain a radial topology.

All the circuit breakers, except for the two located at the substations (not numbered in Figure 6), are controlled from the SCADA control center via a telecommunications network. This proprietary network, which belongs to the power grid owner, uses a protocol compatible with TCP/IP. A remote terminal unit (RTU) is directly connected to each circuit breaker, except for the two breakers located at the substations. The SCADA control center in Figure 7 Figure 8 shows the general-purpose telecommunications network (i.e., Internet) that is connected to the SCADA system. The network essentially has a ring topology. In the event of a link failure, network packets are transmitted back to the sending node in order to change the routing protocol.

In the case of a permanent failure in the power grid, the operator executes a fault isolation and system restoration procedure to open or close circuit breakers. This procedure determines where the fault occurred and how to restore power to customers after the damage is repaired. If a cyber fault occurs in the telecommunications network, then the fault isolation and system restoration procedure fails with unpredictable consequences.

The attack scenario considered in this work involves a cyber attacker who attempts to modify the behavior of the power grid using a computer worm to infect the remote terminal units, as in the case of Stuxnet [START_REF] Falliere | Stuxnet Dossier, Version 1.4[END_REF]. The attack begins with an ARP spoofing attack that exploits ARP vulnerabilities. The goal is to map the attacker's MAC address to the IP address of a trusted node in the network so that traffic directed at the trusted node is sent to the attacker. The attacker is assumed to be connected to the telecommunications network and uses the connectivity to send the worm to the remote terminal units and their associated circuit breakers.

Simulation Results

The simulation, which lasted 40 seconds, is divided into two parts. The first part, lasting from 1 to 10 seconds, involves the attacker performing a man-inthe-middle attack on Node #6 in the telecommunications network (Figure 8). The second part, lasting from 11 to 40 seconds, involves an infection being spread from Node #6 to the remote terminal units and their associated circuit breakers via the SCADA network (Figure 7). The man-in-the-middle attack has a static aspect -no changes occur during the first 10 seconds of the simulation for the involved entities. The spreading of the cyber attack depends on the distance from the infected node: the greater the number of hops needed to reach a node, the lower is the effect of the cyber attack and the lower is the risk of the node malfunctioning. Figure 9 shows the simulation results for Telecommunications Node #6 (Figure 8) whose operative level was 0.4 during the man-in-the-middle attack. The operative level of the downstream SCADA node (Node #6 in Figure 7) was 0.85 as shown in Figure 10. The operative levels of the remote terminal units connected to SCADA Node #6 (in particular, RTUs #3, #4, #6 and #9 on Figure 7) were also 0.92 as shown in Figure 12.

Figure 9 shows that, after the infection is detected at 11 seconds, the telecommunications node (Node #6 in Figure 8) is greatly affected and with high confidence. Note that the SCADA network has two paths for sending information to the remote terminal units; the bottom path in Figure 7 is via the telecommunications network. The CISIApro simulation did not consider the real path over the telecommunications network, but instead, it considered the global evaluation of the service level of the network, which is referred to as the telecommunications network service (TNS) and whose operative level is shown in Figure 11.

As seen in Figure 10, the downstream node of the SCADA network (SCADA Node #6 in Figure 7) is affected by the infection after 12 seconds. Nodes that are further away from the source of the infection are affected after nodes closer to the source node. Therefore, SCADA Node #6 needs more time to become completely unavailable with respect to Telecommunications Node #6. The remote terminal units (RTUs #3, #4, #6 and #9) that are linked to SCADA Node #6 exhibit similar trends, with delays of one time step (Figure 12).

The CISIApro simulator is designed to enhance operator decision making. The reconfiguration of a power grid is a task that requires the consideration of the interconnected infrastructures. Assume that the fault in the power grid shown in Figure 6 is the result of an explosion. Then, two alternative fault isolation and system restoration (FISR) procedures may be considered: Figure 13 shows the trends for the two fault isolation and system restoration procedures. The graphs show that the two procedures yield different results because of the manner in which the infection spreads. Note that the first procedure is less risky than the second procedure.

Conclusions

The CISIApro simulator advances the earlier CISIA simulator by providing a convenient graphical interface for modeling infrastructure entities and their interconnections and interdependencies. The simulator helps evaluate the impacts of cyber attacks on interdependent infrastructures; the attacks include ARP spoofing, SYN flooding and worm infections. CISIApro has been validated using complex case studies involving approximately 70 entities that exchange around twelve distinct resources. The case study described in this chapter involves three interconnected infrastructures: a medium voltage power grid managed by a control center over a SCADA network that is interconnected with a general-purpose telecommunications network. The real-time simulation involving an ARP spoofing attack and worm infection demonstrates the utility of the CISIApro for supporting decision making by electric grid operators, in partic- ular, helping choose between alternative fault isolation and system restoration procedures to reduce the attack impact and enhance system recovery.

Future research will evaluate the impacts of cyber attacks on other critical infrastructures such as water distribution networks and gas pipelines; the goal is to enhance the CISIApro library of cyber attacks and the understanding of their outcomes. Additionally, research will focus on the detailed modeling and simulation of telecommunications networks to better understand attack propagation and to devise approaches for measuring and reducing the impacts of failures within the telecommunications infrastructure as well as failures that propagate from other interdependent infrastructures.

Figure 1 .

 1 Figure 1. CISIA entity diagram.

Figure 2 .

 2 Figure 2. CISIA graphical user interface.

Figure 3 .

 3 Figure 3. CISIApro database representation.

Figure 4 .

 4 Figure 4. CISIApro output database representation.

Figure 5 .

 5 Figure 5. Information flow.

Figure 6 .

 6 Figure 6. Power grid.

Figure 7 .

 7 Figure 7. SCADA control center.

Figure 8 .

 8 Figure 8. Telecommunications network.

Figure 9 .

 9 Figure 9. Telecommunications Node #6 simulation results.

Figure 10 .

 10 Figure 10. SCADA Node #6 simulation results.

Figure 11 .

 11 Figure 11. Telecommunications network service simulation results.

Figure 12 .

 12 Figure 12. Simulation results for RTUs #3, #4, #6 and #9.

FISR # 01 :

 01 Open Breakers #4 and #6. Close Breaker #8. Breakers #5 and #7 are already open due to the initial configuration. Only Customer #4 is disconnected. Load #3 is fed by Substation #2. FISR #02: Open Breakers #4 and #6. Customers #3 and #4 are isolated.

Figure 13 .

 13 Figure 13. Simulation trends for different FISR procedures.

Acknowledgement

This research was partially supported by the DG Home Affairs under the Prevention, Preparedness and Consequence Management of Terrorism and Other Security Related Risks CIPS Grant Action 2013 (HOME/2013/CIPS/AG 2013) (URANIUM -Unified Risk Assessment Negotiation via Interoperability Using Multi-Sensor Data (uranium.theorematica.it)).


Eric Luiijf

Marieke Klaver

ON THE SHARING OF CYBER SECURITY INFORMATION

Keywords: Information sharing, cyber security, resilience, incident management

The sharing of cyber security information between organizations, both public and private, and across sectors and borders is required to increase situational awareness, reduce vulnerabilities, manage risk and enhance cyber resilience. However, the notion of information sharing often is a broad and multi-faceted concept. This chapter describes an analytic framework for sharing cyber security information. A decomposition of the information sharing needs with regard to information exchange elements is mapped to a grid whose vertical dimension spans the strategic/policy, tactical and operational/technical levels and whose horizontal dimension spans the incident response cycle. The framework facilitates organizational and legal discussions about the types of cyber security information that can be shared with other entities along with the terms and conditions of information sharing. Moreover, the framework helps identify important aspects that are missing in existing information exchange standards.

Introduction

Modern society and citizenry rely on the continuous and undisturbed functioning of critical infrastructure assets that provide vital goods and services [4]. The failure of a critical infrastructure can seriously impact the health and wellbeing of citizens, the economy and the environment, and the functioning of governments. Examples of critical infrastructures are power grids, transportation systems, drinking water treatment and distribution systems, financial services and government administration. These infrastructures increasingly depend on information and communications -or so-called "cyber" -technologies. Cyber security and resilience are, therefore, critical topics for modern society [START_REF] Bruce | International Policy Framework for Protecting Critical Information Infrastructure: A Discussion Paper Outlining Key Policy Issues[END_REF]. The timely sharing of cyber security information between organizations -in a critical sector, across sectors, nationally or internationally -is widely recog-nized as an effective means to address the cyber security challenges faced by organizations, especially those that are part of a critical infrastructure. For example, the sharing of information across organizations at the boardroom level is stimulated by the World Economic Forum [START_REF]World Economic Forum, Risk and Responsibility in a Hyperconnected World: Pathways to Global Cyber Resilience[END_REF][START_REF]World Economic Forum, Risk and Responsibility in a Hyperconnected World (WEF Principles)[END_REF]. Another example is the European Network Information Security (NIS) Platform, which promotes collaboration and information exchange between stakeholders from the private and public sectors [START_REF] Grudzien | WG2 Outcome Draft, European Union Agency for Network and Information Security[END_REF].

The notion of "sharing" cyber security information is often misunderstood. As a result, it may create internal organizational and legal barriers to sharing information with other organizations. To address the problem, this chapter presents an analytic framework for information sharing. A decomposition of the information sharing needs with regard to information exchange elements is mapped to a grid whose vertical dimension spans the strategic/policy, tactical and operational/technical levels and whose horizontal dimension spans the incident response cycle [START_REF] Luiijf | Organizational structures and considerations[END_REF]. The mapped elements facilitate discussions about the types of information that can be shared with other organizations and the conditions under which they can be shared. The time criticality of the elements, if it exists, is a factor that may influence sharing decisions. This chapter explains how existing standards for information exchange as well as standards under development are mapped to the elements. It also shows that a number of information sharing elements are not supported or even mentioned by standards or standardization efforts.

Definitions

A critical infrastructure (CI) consists of assets and parts thereof that are essential to the maintenance of critical societal functions, including the supply chain, health, safety, security, economy or social well-being of people [4]. Similar national definitions and sets of national critical infrastructure sectors can be found in [START_REF] Cipedia | CIPedia Main Page[END_REF].

Cyber resilience is the ability of systems and organizations to withstand cyber events. It is measured in terms of the mean time to failure and the mean time to recovery [START_REF]World Economic Forum, Risk and Responsibility in a Hyperconnected World (WEF Principles)[END_REF].

Cyber security constitutes the safeguards and actions that can protect the cyber domain, both in the civilian and military realms, from threats that are associated with or that may harm the interdependent network and information infrastructures in the cyber domain [START_REF]Joint Communication to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions -Cybersecurity Strategy of the European Union: An Open, Safe and Secure Cyberspace, JOIN[END_REF].

Previous Work

The increased focus on cyber security has demonstrated that information sharing is a very important good practice for improving cyber security across collaborating organizations. Although information sharing has proved its value in practice, little work has been done on the theoretical and practical aspects. This section discusses some of the earlier studies that provide the foundation of the research described in this chapter. MITRE has developed a set of technical/operational-level standards for uniquely classifying and identifying threats, vulnerabilities and assets, and for exchanging intrusion detection data (e.g., [START_REF]Common Platform Enumeration (CPE) Dictionary, National Vulnerability Database, Gaithersburg[END_REF]14]) in order to speed up the prevent-detect-respond cycle. However, the wider incident management cycle and the tactical and strategic levels are not (yet) fully covered by these efforts.

From 2008 through 2012, a NATO Research and Technology Organization (RTO) Research Task Group focused on developing a common operating picture of coalition network defense [START_REF] Beaudoin | Coalition network defense common operational picture[END_REF]. To ease the effort, the task group emphasized the need to identify possible information exchange elements. Information exchange classes and elements within the types, specifically aimed at the defense of coalition networks, were outlined during a brainstorming session. The final report of the task group is yet to be published; only a draft final report exists that contains an initial set of ten information exchange classes and thirty-nine elements.

Research by the authors of this chapter has extended the initial set of information exchange classes and elements to the exchange of cyber security information between military entities and/or non-military coalition partners, as well as to information exchange in civilian settings. One information exchange class (actor information) and twelve new elements were added to the original set. Some of the new elements were identified after mapping the set of elements to the analysis framework, which is outlined in its final form in Section 4. This chapter uses the expanded incident management cycle as one axis of the grid to map the information exchange elements. The cycle, which is described in the National Cyber Security Framework Manual (NCSFM) [START_REF] Luiijf | Organizational structures and considerations[END_REF], comprises several phases: proaction, prevention, preparation, incident response, recovery and aftercare/legal follow up.

Analytic Framework for Information Sharing

This section describes the analytic framework for information sharing.

Information Exchange Classes and Elements

Detailed descriptions of the cyber security information exchange classes and elements are provided in the Appendix. The information exchange classes range from technical data on incidents (Class I) and detection data (Class D) to background and context information (Class B) and good practices (Class G). Each class comprises a set of information sharing elements. Note that the classes and elements differ by the type of stakeholders that they aim to reach, ranging from cyber security operations specialists to policy makers. The stakeholder aims form the basis of the vertical dimension of the analysis framework.

Framework Levels

Based on the NCSFM governance model [START_REF] Luiijf | Organizational structures and considerations[END_REF], the sharing of cyber security information takes place at three levels: (i) combined strategic and policy making levels; (ii) tactical steering level; and (iii) operational/technical levels. The level at which cyber security information is shared largely depends on the job positions and responsibilities in an organization. Information sharing usually takes place horizontally within the same decision making level when the information exchange is cross-organizational or cross-sectoral. Horizontal information exchange may involve the sharing of data at the original level of detail, although, in general, some form of anonymization or aggregation is employed. Shared information can also propel vertically, but then the information is usually (and preferably [START_REF] Luiijf | Sharing Cyber Security Information: Good Practices Stemming from the Dutch Public-Private-Partnership Approach[END_REF]) exchanged internal to an organization. Vertical information exchange generally involves a form of analysis in which more detailed data is aggregated and/or assessed in support of decision making at the higher levels.

Incident Management Cycle

Information sharing is a cross-mandate that spans various public and private mandates as outlined in the NCSFM [START_REF] Luiijf | Organizational structures and considerations[END_REF]. Based on the incident management cycle outlined in the NCSFM, it is clear that an information sharing activity may span one or more phases of the cycle. The cycle comprises several phases: proaction, prevention, preparation, incident response, recovery and aftercare/legal follow up. For example, an organization may decide to concentrate on sharing information about proaction and prevention activities given the mandates of the participants. Other sharing communities (e.g., CERT) focus on sharing incident response and recovery information. Finally, law enforcement may concentrate on collecting shared intelligence to disrupt and prevent incidents from occurring, or on deriving incident-specific evidence and situational information for criminal investigations and eventual prosecution.

Mapping the Elements to the Grid

The combination of the incident management cycle described in Section 4.3 and the three decision making and activity levels described in Section 4.2 results in a grid that constitutes the background of Figure 1. The 41 information sharing elements of nine information exchange classes are mapped to the grid. Note that the R* and S* military information exchange classes and the I6* elements are not described in this chapter.

Each information sharing element has different properties in terms of dynamics, time frame, amount of information, complexity of information, factual or weak indication, etc. Figure 2 shows the outcome of the analysis of the time criticality of the information sharing elements. Note that the most time critical information concerns the detection/incident response part of the incident management cycle. The sharing of detection data is most valuable when shared promptly, preferably as enriched actionable data, in order for other organizations to be able to act on the information [START_REF] Luiijf | Sharing Cyber Security Information: Good Practices Stemming from the Dutch Public-Private-Partnership Approach[END_REF].

Standards and Standardization Efforts

Certain information elements can be exchanged during face-to-face meetings or via voice communications. The decision partly depends on the time criticality of the information that is to be shared [START_REF] Luiijf | Sharing Cyber Security Information: Good Practices Stemming from the Dutch Public-Private-Partnership Approach[END_REF]. Other information sharing elements can or must be exchanged via electronic means (e.g., because of time criticality or the amount of information to be shared). Simple information can be exchanged in free format (e.g., via unstructured emails). The exchange of more complex information requires structured exchange mechanisms, in other words, using standardized methods. As part of this research, mappings were performed for each element to existing standards (if any) as well as to de facto standards and to other efforts that may partially satisfy the needs of an identified information exchange element. Table 1 in the Appendix provides details of the mappings. Figure 3 shows the mappings to the analysis framework grid.

The analysis shows that:

Most information exchange standards target the detection and incident response phases, and the technical/operational levels. This agrees with the statement on time criticality, which also shows that the sharing of de-tection and incident response data is most valuable when shared promptly. Prompt information sharing requires a uniform and efficient approach as well as clear definitions of the data to be exchanged as reflected by the development of standards.

Some standards target the sharing of strategic threat information.

For a large number of information sharing elements, no standards or active standardization efforts exist.

Not many information exchange elements bridge the strategic/policy and tactical levels or the tactical and operational/technical levels.

Currently, there is a lack of interoperability of standards that would allow the forwarding of information to other stakeholders in a subsequent phase of the incident management cycle. For instance, there is a gap in moving and reusing (technical) detection information to law enforcement.

Conclusions

Information sharing of cyber security information is a complex organizational topic as outlined by the good practice document on sharing cyber security information [START_REF] Luiijf | Sharing Cyber Security Information: Good Practices Stemming from the Dutch Public-Private-Partnership Approach[END_REF]. This chapter has discussed the decomposition of the information sharing domain into a set of information sharing classes and elements using a grid based on the incident management cycle and decision making levels. The mapping shows where information exchange elements fit, the level of decision making they support and the phases of the incident management cycle in which they are involved

The grid of mapped elements facilitates discussions in organizations about the types of information that can be shared with other organizations and the conditions under which the information may be shared. Some information elements can be shared easily while other elements require a base level of trust and a secure means of transfer, processing and storage. For example, the sharp distinction between information exchange elements of strategic importance to organizations and technical intrusion detection data may eliminate internal organizational barriers to information sharing with other public and private organizations.

An organization may decide that the risk of an information security breach is too high to allow the electronic exchange of the information. The information exchange elements help split (i.e., conduct a "triage" of) cyber security information into classes and elements that can be shared without restrictions, that can never be shared, and that can be shared on a case-by-case basis. The grid can also be used to identify the time criticality of elements. The understanding of time criticality of information exchange elements may encourage organizations to fine-tune the triage process before an incident occurs, thereby enhancing organizational preparation for cyber resilience and incident response.

The grid also reveals the lack of standards or standardization efforts for some cyber security information exchange elements. The identified gaps may be used to develop a roadmap for developing future interoperable standards, especially related to Class A (actors) and Class M (metrics). Moreover, some standardization efforts have overlooked certain needs -these come to the fore in the mappings shown in Figures 123and Table 1. In some cases, only minor changes are required to create a de facto standard that provides the required functionality (e.g., merely extending the standard with additional information exchange fields).

Appendix: Information Sharing Classes and Elements

This appendix contains detailed information about the information sharing classes and elements. It characterizes the classes and elements. Note that the class name abbreviation is derived from the information exchange type. An element with an asterisk is a military cyber security information exchange element that is not described in this chapter. Table 1 outlines the standards and standardization efforts related to specific information exchange elements. In particular, it shows the existing standards (if any) as well as de facto standards and other efforts that may partially satisfy the needs of an information exchange element.

Class M: Sharing Cyber Situational Awareness Metrics Instead of exchanging large amounts of detailed cyber anomaly information to improve collaborative situational awareness, a number of metrics or (aggregation) indicators may be shared to provide a high-level collaborative situational overview.

M1 -Cyber alert level: A single value defines the overall alert level of another organization, denoting whether a significant threat is currently active or whether the other organization is under attack. Examples are the Multi-State Information Sharing and Analysis Center [START_REF]Multi-State Information Sharing and Analysis Center, Cyber Alert Level Indicator[END_REF] and the SANS Internet Storm Center [17].

M2 -Incident summary metrics and statistics:

The number of open incidents that another organization is currently handling and the number of incidents that occurred in the past, including quarterly or yearly aggregates.

M3 -Vulnerability assessment metrics:

The number of open vulnerabilities that another organization has identified in total and per type of system (or network) presented in the context of the total number of scanned systems in order to obtain comparable metrics (e.g., average number of open vulnerabilities per host).

M4 -Cyber security sensor alert metrics:

The number of intrusion detection system alerts that another organization has received in the form of trend indicators or a top-ten list of intrusion alerts. An absolute number is of less value because it depends on the numbers, types and configurations of sensors and the types of monitored networks.

M5 -Risk and impact metrics: Indicators of the (potential) impact to the mission or business continuity of an organization such as the percentage of automated teller machines affected at a financial institution.

Class I: Sharing Incident Information

Active sharing of cyber incident information enables one collaborating organization to inform the other collaborating organizations about incident observations, detection methodologies and mitigation techniques so that the other organizations may better detect and respond to similar incidents in their infrastructures.

I1 -Sharing information about own incident(s):

An organization shares incident information that it has been attacked and that its cyber operational capabilities may be impacted.

I2 -Warning a partner organization that it is targeted: An organization that monitors network traffic may encounter signs of a cyber attack targeting a partner organization. Sharing such information benefits the potentially affected organization and increases collaborative situational awareness.

I3 -Warning a partner organization that it is a cyber attack source:

Warning an organization that it is a source of cyber attacks on other organizations may quickly initiate mitigation actions that are beneficial to all the collaborating organizations.

I4 -Sharing cyber actions: Sharing information about on-going incident response actions and other cyber actions that may impact collaborative business services (missions). Situational reports include on-going actions, mitigation planning, assets affected, estimated time of completion, etc. Hot phase information is highly sensitive and should not be released to the public.

I5 -Querying another organization for similar incidents: An organization queries other organizations for incidents similar to the incident of interest. Useful (sensitive) information may be shared in order to improve the speed and the quality of the (collaborative) incident response.

I6* -Tasking order to manage a cyber incident or to take a mitigation action.

I7 -Requesting help to manage a cyber incident: Another organization with unique capabilities (e.g., knowledge and resources) may be asked to help with the incident response.

I8 -Requesting the management of a cyber incident: Another organization may be asked to manage the cyber incident response.

Class T: Sharing Threat Information

A threat is the potential for compromise, loss or theft of information or supporting cyber services and resources. A threat may be defined by its source, motivation or result; it may be deliberate or accidental, violent or surreptitious, external or internal. Sharing threat information is crucial to achieve and maintain the right cyber defensive posture in collaborating organizations.

T1 -Sharing intelligence about threat agents, vectors and consequences: Sharing intelligence about adversarial cyber threats (source, intent, capability, tactics, techniques, procedures, recent activity, etc.) in order to maximize collaborative cyber defenses (e.g., [START_REF] Mandiant | OpenIOC: An Open Framework for Sharing Threat Intelligence[END_REF]).

T2 -Sharing information on malware analysis: Malware analysis requires advanced technical capabilities as well as resources that may be available at other organizations. The shared information could include captured malware, signatures, indicators of compromise, analysis techniques, tools and analysis results.

T3 -Sharing information on exploit analysis: Information that allows better detection of a specific threat, effective protection against exploits and information about exploit code availability and its efficiency against various system and network configurations.

T4 -Sharing strategic threat information: This could involve regular strategic level threat analysis and trend prediction [11] or a current situational picture [START_REF] Veris | VERIS Community Database[END_REF].

Class V: Sharing General Vulnerability Information

Vulnerability information is critical to assess an organization's defense posture and to guide the mitigation measures needed to protect against the hostile exploitation of a vulnerability. Inadequate knowledge about a vulnerability exposes networks and systems to hostile exploitation.

V1 -Sharing non-public (closed) information about a specific vulnerability: This involves sharing information within a trusted community.

V2 -Sharing public information about a specific vulnerability: This is accomplished by direct access (e.g., NVD [14]) or by the selective relaying of information by a Computer Emergency Response Team (CERT) or Information Sharing and Analysis Center (ISAC).

V3 -Sharing alert and advisory information: This involves sharing alerts, general advice and background information on a specific vulnerability.

Class D: Sharing Detection and Mitigation Information

Collaborative organizations can mitigate adversary tactics, techniques and procedures by sharing malware and intrusion signatures, patch information, defensive strategies, attack correlation patterns and domain blacklists.

D1 -Sharing intrusion signatures:

Sharing intrusion signatures with other collaborating organizations enables all the organizations to enhance their detection capabilities with minimal additional investments. Feedback on the efficiency of signatures could lead to signature refinement.

D2 -Sharing patch information:

This involves sharing test procedures, patch efficiency, deployment experiences and information about side effects. D3 -Sharing vulnerability assessment signatures: Vulnerability scanners allow users to add their custom signatures. Sharing these signatures with other organizations enhances the collaborative resources and may reduce the impact on collaborative services. D4 -Sharing blacklists and whitelists: Blacklists are lists of suspicious or malicious IP addresses, website URLs and email addresses that can be used to block traffic and detect cyber attacks. Sharing provides collaborating organizations with access to more extensive and up-to-date blacklists. Whitelists provide the reverse filtering capabilities of blacklists.

D5 -Sharing malware/exploit file signatures: Collaborating organizations may share signature patterns of malware or other suspicious files, including file names, patterns, locations, sizes and identifying byte sequences.

D6 -Sharing indicator patterns:

An indicator pattern is used to verify that a system or network has been affected by a cyber attack. If the attack cannot be verified, deeper analysis may be required to determine whether a compromise took place.

Class R*: Sharing Dynamic Risk Assessment and Operational Dependencies Within a military coalition environment, coalition partners may critically rely on shared cyber assets for the successful completion of a mission. Sharing operation dependencies and information about the utilization of certain assets are, therefore, important. Three elements have been identified: (i) R1 -Sharing assets and operational dependencies; (ii) R2 -Sharing dynamic risk assessment information; and (iii) R3 -Sharing information about cyber events that increase coalition risk.

Class S*: Sharing Information about Coalition-Shared Assets If coalition partners share (security) health information of shared assets, other coalition partners can make better use of shared assets and react to changes in the health of an asset. Six elements have been identified: (i) S1 -Identifying shared cyber assets; (ii) S2 -Sharing the security status of shared cyber assets; (iii) S3 -Sharing the changes in the criticality of shared cyber assets; (iv) S4 -Sharing the security status of coalition cyber assets; (v) S5 -Sharing security events concerning coalition cyber assets; and (vi) S6 -Sharing risk assessments of coalition mission objectives and cyber assets.

Class C: Sharing Compliance Policies and Status

If an organization knows the compliance requirements and the status of other organizations with which it collaborates to provide an end-to-end service, the cyber defensive posture can be tuned.

C1 -Sharing compliance policies: Strong compliance may correlate with a lower risk of incidents; detection and reaction to certain threats may be faster. Collaboration with a weaker organization requires more security controls at the interface. Sharing compliance information may help organizations fine-tune their security efforts.

C2 -Sharing compliance status: Even if an organization has a strong compliance policy, all its assets may not comply with the security policy. Knowledge of the actual compliance status enables collaborating organizations to tune their security measures. One example is whether or not an organization can be reached 24/7 in order to report a security incident.

Class B: Sharing Background and Reference Information

This category concerns background information that is not directly cyber security information (e.g., contact details and reference information).

B1 -Sharing contact information: This information may include the contact details of the CERT team and the chief information security officer.

B2 -Sharing software and hardware product identifiers and characteristics: This information may include Common Platform Enumeration (CPE) Dictionary data [START_REF]Common Platform Enumeration (CPE) Dictionary, National Vulnerability Database, Gaithersburg[END_REF].

B3 -Sharing network topology information: Understanding the network structure of another organization may increase the joint cyber situational awareness. Understanding the types of threats and vulnerabilities and the attack paths existing in other organization also improves the joint cyber situational awareness.

B4* -Sharing physical locations of sites and mobile platforms: This helps understand the geolocation-dependent risk of an organization.

B5 -Sharing time zone information: This helps interpret logging and other information pertaining to synchronized attacks against multiple organizations.

Class G: Sharing Good Practices Similar to sharing threat and incident information, the sharing of product, architecture and configuration information between collaborating organizations can help reduce costs and improve the joint security posture.

G1 -Sharing good practice information: This includes good practice guides, white papers and security architectures.

G2 -Sharing security settings: This includes system configuration information such as the steps required to harden a system. G3 -Sharing recovery procedures and good practices: This may increase the resilience of cyber services.

G4 -Sharing lessons identified: Sharing information about what was good

and what went wrong may help other organizations avoid pitfalls during incident response. This information also increases the level of trust in partner organizations.

Class A: Sharing Actor Information Multiple organizations, including law enforcement, may need to exchange information about cyber criminal or cyber espionage activities and the actors to be apprehended and potentially prosecuted.

A1 -Sharing attribution information: This includes detailed technical, analytical and sensitive intelligence about attack attribution.

A2 -Sharing actor information:

This includes information about the suspected actors.

A3 -Sharing lawful interception information: This involves (electronic) requests to tap certain information flows and to deliver the collected information to law enforcement. A4 -Requesting legal assistance or cooperation: This involves an (international) request for legal assistance/cooperation to arrest actors, collect and safeguard evidence, and handle notice-and-takedown requests.

A5 -Sharing evidence and prosecution information:

This involves sharing information in criminal investigations and for possible prosecution.

Figure 1 .

 1 Figure1. Analytic framework (grid from[START_REF] Luiijf | Organizational structures and considerations[END_REF]).

Figure 2 .

 2 Figure 2. Time criticality of the information exchange elements.

Figure 3 .

 3 Figure 3. Standards and standardization efforts mapped to exchange elements.

Table 1 :

 1 Information exchange classes and elements.

	Class	Standards	De facto standards
		(see [16])	and other efforts
	Class M: Sharing Cyber
	Situational Awareness
	M1: Cyber alert level		MS-ISAC cyber alert
			level; InfoCon
	M2: Incident summary		Incident statistics [11];
	metrics and statistics		VERIS [18]
			Continued on next page

Table 1 .

 1 Information exchange classes and elements (continued).

	Class	Standards	De facto standards
		(see [16])	and other efforts
	M3: Vulnerability assessment		CWSS; CVSS/CCSS
	metrics
	M4: Cyber security sensor		No efforts identified
	alert metrics
	M5: Risk and impact metrics		CWRAF (and CWSS);
			EBIOS method; Risk
			management language
	Class I: Sharing Incident
	Information
	I1: Sharing information about	IODEF over RID	IDMEF;
	own incident(s)		VERIS (Commercial)
	I2: Warning a partner organi-		IODEF (Partial)
	zation that it is targeted
	I3: Warning a partner organi-	ARF	IODEF
	zation that it is a cyber attack		(Purpose is mitigation)
	source
	I4: Sharing cyber actions	IODEF over RID
		(Report)
	I5: Querying another organi-	IODEF over RID	VERIS (Commercial)
	zation about similar incidents	(Query)
	I6: Tasking order (Military*)		*Military
	I7: Requesting help to manage	IODEF over RID
	a cyber incident	(Trace request, In-
		vestigation request)
	I8: Requesting the manage-		No efforts identified
	ment of a cyber incident
	Class T: Sharing Threat
	Information
	T1: Sharing intelligence about	STIX over	OpenIOC; CybOX;
	threat agents, vectors and con-	TAXII [16]	CAPEC; NASL
	sequences
	T2: Sharing information on	MAEC	OpenIOC; CybOX
	malware analysis
	T3: Sharing information on		OpenIOC
	exploit analysis
			Continued on next page

Table 1 .

 1 Information exchange classes and elements (continued).

	Class	Standards	De facto standards
		(see [16])	and other efforts
	T4: Sharing strategic threat	SCAP/CAPEC	STIX over TAXII
	information
	Class V: Sharing General
	Vulnerability Information
	V1: Sharing non-public infor-	OVAL, CVRF on	CWSS; CVSS;
	mation about a vulnerability	top of CVE, CWE,	CWRAF; DAF
		ITU-T X.1206;	Relates to ISO/IEC
		IODEF-SCI/	29147:2014 and
		RFC7203	ISO/IEC 30111:2013
	V2: Sharing public informa-	CVRF, NVD on top	CWSS; CVSS;
	tion about a vulnerability	of CVE, CWE,	CWRAF
		ITU-T X.1206	Relates to ISO/IEC
			29147:2014 and
			ISO/IEC 30111:2013
	V3: Sharing alert and advisory		CAP; CVRF; CAIF
	information		(Simple factsheets)
	Class D: Sharing Detec-
	tion and Mitigation Infor-
	mation
	D1: Sharing intrusion signa-	OpenIOC	OVAL; XCCDF
	tures
	D2: Sharing patch information OVAL;	ISA-TR 62443-2-3
		ITU-T X.1206	(Draft)
	D3: Sharing vulnerability	OVAL; XCCDF	NASL
	assessment signatures
	D4: Sharing blacklists and		Blacklists and
	whitelists		whitelists (ASCII)
	D5: Sharing malware/exploit		OpenIOC
	file signatures
	D6: Sharing indicator patterns CybOX; MEAC	OpenIOC; NASL
	Class B: Sharing Back-
	ground and Reference In-
	formation
	B1: Sharing contact informa-	SCAP	AI
	tion
			Continued on next page

Table 1 .

 1 Information exchange classes and elements (continued).

	Class	Standards	De facto standards
		(see [16])	and other efforts
	A4: Requesting legal assis-	No efforts identified
	tance or cooperation
	A5: Sharing evidence and	STIX over TAXII
	prosecution information	(Incomplete)
	Class S*: Sharing Infor-
	mation about Shared
	Cyber Assets
	S1*: Identifying shared cyber	*Military
	assets
	S2*: Sharing the security sta-	*Military
	tus of shared cyber assets
	S3*: Sharing changes in the	*Military
	criticality of shared cyber as-
	sets
	S4*: Sharing the security sta-	*Military
	tus of coalition cyber assets
	S5*: Sharing security events	*Military
	concerning coalition cyber as-
	sets
	S6*: Sharing risk assessments	*Military
	of coalition mission objectives
	and cyber assets
	Class R*:	Sharing Dy-
	namic Risk Assessment
	and Operational Depen-
	dencies
	R1*: Sharing assets and oper-	*Military
	ational dependencies
	R2*: Sharing dynamic risk as-	*Military
	sessment information
	R3*: Sharing information	*Military
	about cyber events that
	increase coalition risk

Acknowledgement

This research is partly based on the collaborative work of the NATO RTO Research Task Group on Coalition Network Defense Common Operating Picture and on funding from the Dutch Ministry of Security and Justice for research in cross-sector information sharing.

Table 1. Information exchange classes and elements (continued).

Class

Standards De facto standards (see [START_REF] Pawlinski | Standards and Tools for Exchange and Processing of Actionable Information[END_REF]) and other efforts