Ana M Soto
email: ana.soto@tufts.edu

Giuseppe Longo
email: longo@ens.fr

Paul-Antoine Miquel
email: pamiquel@univ-tlse2.fr

Maël Montévil
email: mael.montevil@gmail.com

Matteo Mossio
email: matteo.mossio@univ-paris1.fr

Nicole Perret

Arnaud Pocheville
email: arnaud.pocheville@sydney.edu.au

Carlos Sonnenschein
email: carlos.sonnenschein@tufts.edu

C Bernard

Toward a theory of organisms: Three founding principles in search of a useful integration

Keywords: Default state, biological organization, organizational closure, variation, individuation All evolutionary biologists know

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The first decade of the new millennium was dubbed as the beginning of "the post-genomic era." Its arrival was greeted by the biological sciences establishment and the pharmaceutical industry with the exceedingly optimistic view that new technology and the usual reductionist approaches that characterized the last half of the 20 th century will (again) cure cancer, bring about personalized and precision medicine, and more. Indeed, the rhetoric and promises have not changed from the time President Nixon declared the War on Cancer, in spite of the meager returns of this extremely expensive undertaking. The latest "moon-shot" aimed at curing cancer "once and for all" proposed by President Obama has generated a significant wave of public criticism regarding the costs of the project, its likely minimal impact on prevention and public health policy, the inequalities of access it would engender due to high cost of the "personalized' therapies and, finally and most important, the dubious probability of success [START_REF] Interlandi | The paradox of precision medicine[END_REF][START_REF] Breivik | We won't cure cancer[END_REF][START_REF] Bayer | Public health in the precisionmedicine era[END_REF][START_REF] Joyner | What happens when underperforming big ideas in research become entrenched[END_REF]. However, critiques of the philosophical stance at the coreof the biological research fueling this program have yet to propose a cogent theoretical alternative to the one that has dominated biomedical research for the last 70 years. Although the genesis of this special issue is mostly unrelated to this type of gigantic projects, we believe that this issue's content provides a critical analysis and addresses the limitations posed by the hegemonic, reductionist, dominant world view which is metaphor rich and theory poor. This issue's content also analyses the role of scientific theories not only in their ability to provide intelligibility but also as the most practical tools for framing research and for constructing objectivity. Most importantly, the articles in this issue of PBMB put forward some basic principles that help in constructing a comprehensive theory of organisms.

Since Aristotle the idea of goal-directedness, i.e., teleology, provided a useful framework for understanding a main characteristic of organisms, namely, the "goal" of keeping themselves alive. A salient example of this phenomenon is provided by a goat studied by Slijper (Slijper 1942a;Slijper 1942b). This animal was born with paralysis of its front legs and soon learned to move around by hopping on its hind legs. This behavioral accommodation resulted in dramatic morphological changes in the bones of the hind legs and the pelvis, as well as changes in the morphology of the pelvic muscles [START_REF] West-Eberhard | Phenotypic accommodation: adaptive innovation due to developmental plasticity[END_REF].Two millennia later another great philosopher, Immanuel Kant, worked on the distinctions between the ways of acquiring knowledge regarding the living and the inert. Regarding teleological thinking, he stressed the interrelatedness of the organism and its parts and the circular causality implied by this relationship. Teleological judgement was described as an epistemic organizing principle which allows for the explanation of the biological object through its unity (this object being the cause and effect of itself), before giving a discrete description of its parts. Following Kant's ideas teleology was adopted as a heuristic by the teleomechanists (Lenoir 1982); for Blumenbach, Bildungstrieb (vital force) was a teleological agent the cause of which, like Newton's gravity, was beyond the power of reason. However, the consequences of this organizing principle, like of those of gravity, were still amenable to scientific inquiry [START_REF] Lenoir | Kant, Blumenbach and vital materialism in german biology[END_REF]. Thus, teleology was an extremely useful concept for the development of several biological disciplines in the late 18th and the 19 th centuries.

Several historians, philosophers and biologists addressed the overall changes in the practice and conceptualization of biological phenomena that took place in the 20th century [START_REF] Mayr | This Is Biology[END_REF][START_REF] Gilbert | Embracing complexity: Organicism for the 21st century[END_REF]. One of them, Lenny Moss, described a turning point, "the phylogenetic turn"; which changed the perception of the organism. In Moss' own words, "the theater of adaptation changed from that of individual life histories, that is, ontogenies, to that of populations over multiple generations, that is, phylogenies." Moss' phylogenetic turn imposes a choice ". . . between a theory of life which locates the agency for the acquisition of adapted form in ontogeny-that is, in some theory of epigenesis versus a view that expels all manner of adaptive agency from within the organism and relocates it in an external force-or as Daniel Dennett [START_REF] Dennett | Darwin's Dangerous Idea[END_REF] prefers to say, an algorithm called 'natural selection'" [START_REF] Moss | What Genes Can't Do[END_REF]. Because of this change, agency, normativity and individuation, hitherto considered the main characteristics of the living, almost disappeared from bio-logical language. Since then, cells and organisms became passive recipients of a program. As a consequence, it is not surprising that biology has a theory of evolution but not a theory of organisms.

In spite of the strong impact of the teleomechanists, their perspective was not universally accepted; in fact, two competing currents emerged regarding biological thinking. Their main difference was whether or not there were singularities of the living that required a different outlook than that used in mechanics. The 200 year old dispute between these two stances continued well into the 20 th century as a polarization between reductionists and organicists, although the latter moved from the mechanical worldview to one inspired by the mathematical theories of information [START_REF] Longo | Is information a proper observable for biological organization?[END_REF]. Indeed, the introduction of the notion of "program" [see Perret et al, this issue, and (Longo et al. 2012)] was greeted as a sound theoretical way to get rid of the concept of "teleology" [START_REF] Mayr | This Is Biology[END_REF]. However, the adoption of the metaphors and the powerful tools conceived and used by the reductionists blurred the distance between the two currents (see Perret et al, this issue, and Longo et al. 2012). The current state of affairs is that even those that consider themselves organicists are for the most part using the pervasive language of molecular biology, a language that forces causative power to molecules, and in particular, to genes. Nowadays, the main difference between reductionists and organicists is that the latter are keenly aware that, when they practice analytical reductionism, they may be destroying the very phenomena that they are trying to understand.

In addition to the conceptual problems generated by the phylogenetic turn and the molecular biology revolution, the availability of immensely large databases has been greeted by the declaration that the scientific method is obsolete [START_REF] Anderson | The end of theory: The data deluge makes the scientific method obsolete[END_REF]). To the contrary, the perspective proposed throughout this issue buttresses rather than opposes the scientific method. Thus, the objective of this issue is to propose theoretical principles for the construction of a theory of organisms which could overcome both the hindrances arising from the reductionist and informational stances of the 20 th century, and circumvent the choice imposed by the new synthesis between phylogenesis and an organismal approach.

Based on the organicist tradition, three principles are proposed to postulate a theory of organisms, namely: 1) the default state of proliferation with variation and motility, which is rooted in the cell theory, 2) the principle of organization, and 3) the principle of variation which applies to morphogenesis and inheritance. Additionally, examples are given of how these principles can guide biological research on morphogenesis and cancer (see Montévil, Speroni Sonnenschein and Soto, Sonnenschein and Soto, this issue). The aim of this concluding article is to articulate the ideas that have been expounded in the preceding articles of this issue into a coherent body.

Philosophical stances

In contrast to evolutionary biology, organismal biology still lacks a widely accepted global theory. For this reason it would be very helpful if practitioners would make explicit which are the principles, the postulates, and the concepts that frame their research; in short, their philosophical stances. From the organicist perspective developed in this issue, biological systems are characterized by the simultaneous co-existence of opposites as exemplified by change and stability, the incomplete separation between internal and external (topology), and before and after (time) the notions of extended present, memory and anticipation [See Miquel and Hwang, this issue, and (Longo and Montévil 2011b)]. Organisms are open systems that handle flows of matter and energy by means of and for the maintenance of their metabolism. The internal constraints defining such a system are always disturbed by external ones; thus, in order to understand what is happening in the system, we must simultaneously access the multiple levels on which this system is integrated [START_REF] Stengers | Cosmopolitiques[END_REF].

For instance, the cell as a whole is integrated into a more complex system, the tissue, the organism, in which it will not act similarly as to when it is placed in a conventional in vitro culture. For example, in a cardiomyocyte the proteins that channel the ions, (calcium, potassium) carry currents that change the cell voltage. In turn the cell voltage changes the ion channels [START_REF] Noble | The Music of Life: Biology beyond the Genome[END_REF]. Thus the components alter the behavior of the heart and the heart alters the behavior of the components, yet both components and the heart are integrated into a higher multicellular structure, the organism. This means that the working of such a system is never defined by initial constraints. Additionally, the system is historical and in relentless change from fertilization to death, being built and remodeled throughout life.

In sum, the historical way by which a system of natural events operates is not a consequence of its initial description. Instead, it acts and it produces novelty (novel qualities and novel structures) in the real world. Thus, emergence, understood here as the appearance of new observables through time, is not a simple epistemic property. It has ontological and theoretical meaning [START_REF] Soto | On physicalism and Downward Causation in Developmental and Cancer Biology[END_REF].

From the inert to the alive

Physical theories are grounded on stable mathematical structures, based on regularities such as theoretical symmetries. The physical object is both defined and understood by its mathematical transformations. These operations permit a stable description of space; this space is objectivized as the space providing theoretical determination and specifying the trajectory of the object (usually done by optimization principles). In sum, physical objects are generic and their trajectories are specific (see Longo & Soto, and Montévil et al, this issue).

In biology, we posit instead the instability of theoretical symmetries, which are likely to change when the object is transformed along the flow of time, such as when a zygote develops into an adult animal. Biological objects, i.e., organisms, are specific and hence they are not interchangeable. Their trajectories are generic; they are not specified by the phase space (Longo and Montévil 2014). These biological objects are the result of a history that represents a cascade of changes of their regularities, they exhibit variability and show contextuality; unlike inert objects they are agents. Moreover, organisms not only are able to create their own rules, they also have the capacity to change them [see Miquel and Hwang, this issue, and (Canguilhem 1991)].

4. The cell theory: a starting point towards a theory of organisms.

Canguilhem traces the history of the cell theory back to the 18 th century, and finds two main components, each addressing a fundamental question, namely, i) the composition of organisms, this is the cell as the element "bearing all the characteristics of life" and ii) the genesis of organisms. Canguilhem attributes to Virchow the priority of putting these two components together (Canguilhem 2008). The second element of the theory, that is, the genesis of organisms applies, of course, to both unicellular and multicellular organisms. Moreover, from the inception of the cell theory, it was stated that the egg from which sexed organisms are born is a cell whose development can be explained by the division of said cell into daughter cells by cell proliferation. In this regard, the cell was in the view of Claude Bernard "a vital atom". Bernard stated "In all indepth analysis of a physiological phenomenon, one always arrives at the same point, the same elementary irreducible agent, the organized element, the cell" (Claude Bernard Revue Scientifique, Sept 26, 1874-cited by (Canguilhem 2008)). From this dominant position at the end of the 19 th century, the theory endured and survived criticism about whether anatomical or functional syncytia negated the cellular structure of multicellular organisms. Another problem that has been debated since Virchow's time is whether or not the cells are individuals. In the case of unicellular organisms there is no problem in stating that cell and organism are the same and that they are individuals. However, attributing individuality to both the cells in multicellular organisms as well as to the organism that contains them posed problems that led some to reject the cell theory. From our perspective, it is the concept of the level entanglement that provides a useful perspective of the relationship between organism and cells: the zygote is both a cell and an organism, and with each cell division, these two levels of individuation become more obvious. In other words, we may adopt Simondon's philosophy and look at individuation as a process rather than a thing (see Miquel and Hwang, this issue).

Back then and today, the cell theory plays a unifying role between evolutionary and organismal biology; it provided a link between the individual and its progeny in which the cell itself is a vehicle of inheritance. Within this theoretical perspective, the cell is the irreducible locus of agency.

5. The founding principles: from entanglement to integration?

5.1. Genealogy of the three proposed principles: the default state, the principle of organization and the principle of variation.

Each of these principles has its own history prior to the inception of the ORGANISM group. The default state was initially proposed by Soto and Sonnenschein [START_REF] Soto | Regulation of cell proliferation: the negative control perspective[END_REF]; it was based on experimental work done starting in the early 1970s while studying the role of estrogens on the proliferation of their target cells and is rooted in the cell theory and in the strict materiality of life. The default state is further anchored on the notion that the cell is an organism and is the origin of all organisms. The joint work of Longo, Montévil, Sonnenschein and Soto resulted in the integration of variation into the default state of proliferation and motility: at each cell division variation is generated. In addition to the default state, a supracellular source of variation was identified. This is the "framing principle of non-identical iterations of morphogenetic processes in organogenesis," which accounts for the generation of globally regular patterns of non-identical structures, typically observed in organogenesis (Longo et al. 2015b). The work of Miquel, Soto and Sonnenschein also addressed the generation of new observables while examining the concepts of emergence, downward causation and level entanglement [START_REF] Soto | On physicalism and Downward Causation in Developmental and Cancer Biology[END_REF]. The principle of variation can be traced to Bailly and Longo's analysis of the differences between physical objects and biological objects, the concept of extended criticality [ (Longo and Montévil 2011a) and Longo and Soto, this issue], and of course, the Darwinian idea of descent with modification. 1 The relentless change addressed by the principle of variation points to the major difference between the theories of the inert and those of the living. The other side of the coin, namely, stability, needed to be addressed as a main component of biological organization.

1 The concept of extended criticality is based on the physics of phase transitions, which deals with the emergence of a new object, as exemplified by the transition between water vapor and snow crystals. Phase transitions occur at a point, the "critical temperature". This point marks the passage from one symmetry to another, and from one macroscopic object or structure to another. Extended critical transitions, instead, span a non-trivial interval such as an organism's lifetime. In this context, an organism continually undergoes critical transitions, whereby both the objects and the symmetries change. The organism and its components are permanently reconstructed with variations.

The history of the principle of organization can be traced back to the concept of autopoiesis [START_REF] Varela | Autopoiesis: The organization of living systems, its characterization and a model[END_REF], closure [START_REF] Rosen | Life Itself: A Comprehensive Inquiry into the Nature, Origin, and Fabrication of Life[END_REF]) and work-constraints cycles [START_REF] Kauffman | Investigations[END_REF], which has been further elaborated by Montévil and Mossio (Montévil and Mossio 2015 and Mossio et al this issue).The principle of organization is the fundamental source of biological stability. The notion of closure of constraints as the means to achieve and maintain stability was traditionally applied to intracellular processes. Mossio et al explored the concept of constraints being conserved at the time-scale of the process being constrained (see Mossio et al, this issue); this concept opens a point of entry for the mathematization of biology. We exploited this notion by modeling mammary gland morphogenesis using the default state and its constraints (Montévil et al, this issue).

How to organize these principles into a coherent set?

Our theoretical work addresses both unicellular and multicellular organisms. Following Darwin's strategy regarding phylogenesis, it seems prudent not to delve into the transition from the prebiotic to the biotic world, but to anchor our principles in the biotic world. By this we mean that we are agnostic about whether or not the principles that we propose for to study organisms are relevant to the abiotic world, since even a hypothetical biochemical structure able to instantiate closure is not an organism, and a self-replicating molecule is not an organism undergoing multiplication.

The three principles we propose are irreducible to one another and none of them could be construed as the "condition of possibility" for the other two, at least in this our first analysis about how they are related.

The role of the default state

The biological default state (proliferation with variation and motility), expresses agency and modifies the causal structure with respect to the theories of the inert. Our proposal on the default state has straight-forward consequences on what requires an explanation in the sense of a theoretical cause. The default state does not require such a cause. To the contrary, what would require an explanation is a departure from the default state (quiescence, restrained variation, lack of motility). This theoretical cause should be distinguished from the notion of differential cause, whereby a difference introduced in the system, like a carcinogen, leads to a difference in the system's behavior. In order to conceptually move from a differential cause to a theoretical cause, it is necessary to understand how the differential cause alters the constraints on the system (Longo and Soto, this issue). In addition to physical constraints, there are also chemical constraints that affect morphogenesis. For example, those imposed by collagen, phospholipids or DNA. The ability of an organism to generate new constraints at each new iteration produces diversity given that iterations are not identical.

The role of constraints

Biological constraints and their actions are key objects for biological investigations in the framework of a theory of organisms. All the principles proposed in this issue relate closely to the notion of constraint, which is shaped by the proposed founding principles.

The default state is rooted in the cell theory and the notion of the cell as an agent. Constraints are objects which are much simpler than cells, and the action of constraints on cells require a specific principle: constraints act by forcing cells out of the default state. The positing of a default state for cells leads us to discuss the action of constraints on cells that reduce, hinder or canalize their ability to proliferate and to move. This approach overcomes the metaphoric and anthropocentric use of the notion of signal, since it acknowledges the agency of cells. Cells are no longer passive things like rocks that have to be acted upon to make them do something (proliferate or move).

The principle of organization leads to the inclusion of specific constraints in an organism, and thus to assess whether a given constraint is functional, that is, it participates in closure. Constraints of an organism are constraints that are both maintained by other constraints and in turn they maintain other constraints. Given the interdependence of the organism and its parts, it is never sufficient to analyze a given constraint or a given set of constraints in isolation. However, as discussed in this issue (Montévil et al), an analysis of constraints on the default state resulted in an insightful explanation of glandular morphogenesis in a 3D model of the breast. As mentioned in that article, additional constraints at the tissue level and organismal regulation via hormones are obvious incremental additions needed for a biological analysis. In sum, additional constraints will need to be taken into consideration to understand the global biological organization in which the phenomenon studied, mammary gland morphogenesis in our case, is rooted.

The principle of variation manifests itself in the default state, since each cell division generates two similar but slightly different cells, and by virtue of this default state, into the Darwinian notion of descent with modification. The principle of variation also applies at supra-cellular levels as in the framing principle of non-identical iterations of morphogenic processes (Longo et al. 2015a). The principle of variation establishes that constraints should not be considered as phylogenetic invariants. Instead, constraints are subject to variation. For instance, a morphogenetic process which is described as a set of constraints is not necessarily conserved in a lineage. Instead, it will be typically altered both for some individuals and at the level of groups of individuals, for example in a particular species. Changes of constraints are thus intrinsic to the notion of biological constraints.

Conclusions

Scientific theories provide organizing principles and construct objectivity by framing models, observations and experiments. Numerous mathematical concepts and structures originated from the analysis of physical phenomena; these mathematical innovations, in turn, helped to organize physical concepts in a novel way. A classic example is Newton's invention of infinitesimal calculus which was motivated by an analysis of velocity and acceleration. Calculus made these concepts mathematically intelligible, and thus, the movements of planets became intelligible. In the 19 th century, Riemann's geometry was invented as an attempt to understand Newton's gravitation in relation to the curvature of space, and it was later used by Einstein in the physics and mathematics of Relativity. In the 20 th century, Dirac's delta, Feynman's integral and other brand new theories, such as Gauge Theory, were entirely motivated by investigations in quantum physics. As in the earlier examples, these mathematical inventions shed new light on the physical phenomena. These are just a few examples of a creative synergy between these disciplines. Why has this not been so in biology?

Symmetries and conservation laws are strictly linked and are fundamental both in mathematics and physics. In biology on the contrary, variation is at the core of both the theory of evolution and the theory of organisms that we have sketched and intend to develop. The existence of a principle of variation explains why biology has not yet inspired mathematicians to create structures that would open the possibility of formalizing biological concepts. However, pointing out to the differences between inert and live objects opens the way to better understand what would it take to arrive at this distant objective: the development of a "mathematical biology" that will play the same role that mathematics has played in physics, and which is very different from the applied mathematics transplanted directly from physics that is routinely used to model biological phenomena [START_REF] Longo | How Future Depends on Past and on Rare Events in Systems of Life, in: Italian original in Paradigmi[END_REF].

Biological objects are agents capable of creating their own norms; they are continuously harmonizing their ability to create novelty and stability. Positing the three principles enunciated herein has also opened the way to explain morphogenesis and carcinogenesis (Montévil et al, Sonnenschein and Soto, this issue). These principles profoundly change both biological observables and their determination with respect to the theoretical frames of physical theories. This radical change opens up the possibility of anchoring mathematical modeling on properly biological principles. Turing showed that there is an epistemological gap between modelization and imitation [START_REF] Turing | Computing machinery and intelligence[END_REF]Turing 1952). While the former is based on a theory about the object being modeled, the latter is not. Thus, biological principles are needed to move beyond imitation. For example, the model of ductal morphogenesis presented in this issue is based on the default state and the intrinsic constraints generated by the epithelial cells. By identifying constraints to the default state, multilevel biomechanical explanations become as legitimate as the molecular ones. Finally, analysis of the differences between the physics of inanimate and living matter led us to propose three principles that provide a reliable perspective for the construction of a much needed theory of organisms. In addition to this theoretical purpose, these founding principles have been useful for framing experiments and mathematical modeling.


Gustavo Gonzalez

Granadillo Joaquin

Garcia-Alfaro Hervé Debar

Alexander Motzek
email: motzek@ifis.uni-luebeck.de

Selection of Mitigation Actions Based on Financial and Operational Impact Assessments

Finding adequate responses to ongoing attacks on ICT systems is a pertinacious problem and requires assessments from different perpendicular viewpoints. However, current research focuses on reducing the impact of an attack irregardless of side-effects caused by responses. In order to achieve a comprehensive yet accurate response to possible and ongoing attacks on a managed ICT system, we propose an approach that relies on a response system that continuously quantifies risks, and decides how to respond to cyber-threats that target a monitored ICT system. Our Dynamic Risk Management Response (DRMR) model is composed of two main modules: a Response Financial Impact Assessor (RFIA), which provides an assessment concerning the potential financial impact that responses may cause to an organization; and a Response Operational Impact Assessor (ROIA), which assesses potential impacts that efficient mitigation actions may cause on the organization in an operational perspective. As a result, the DRMR model proposes response plans to mitigate identified risks, enable choice of the most suitable response possibilities to reduce identified risks below an admissible level while minimizing potential negative side effects of deliberately taken actions.

I. INTRODUCTION

The impact of an event is defined as the magnitude of harm that is expected to be perceived by an organization as a result of the consequences from unauthorized disclosure, modification, destruction, unavailability, or loss of information [START_REF] Kissel | Glossary of key information security terms[END_REF]. It may be expressed relative to the nature of its consequences. A way of expressing such nature is to bind the consequences on security dimensions. Commonly admitted natures for impacts on Information Systems are: Confidentiality, Integrity and Availability (CIA).

Current research focus on considering the impact of attacks [START_REF] Dini | On simulative analysis of attack impact in Wireless Sensor Networks[END_REF]- [START_REF] Sgouras | Cyber Attack Impact on Critical Smart Grid Infrastructures, Innovative Smart Grid Technologies Conference (ISGT)[END_REF], by evaluating their severity and consequences, leaving aside the impact of security actions in mitigating the effects of such attacks. However, the analysis of current cyber events should also consider the impact of potential mitigation actions as well as time, geographic space and affected elements [START_REF] Roberts | The Macroeconomic Impacts of the 9/11 Attack: Evidence from Real-Time Forecasting[END_REF].

We adopt a quantitative risk-aware approach that considers the likelihood of success of the detected attacks, their induced impact, and the cost and consequences of response plans onto a higher goal, e.g., a company or mission. The research presented in this paper represents a work in progress towards the development of a comprehensive and practical dynamic risk management response system.

Our model considers two approaches: A Financial Impact Assessment (FIA) and an Operational Impact Assessment (OIA). A response FIA (RFIA) relies on a Return On Response Investment (RORI) index and a geometrical model (named attack volume) to estimate the impact of security incidents (e.g. intrusions, attacks, errors) in a financial perspective, and to deploy mitigation actions accordingly. A response OIA (ROIA) considers that mitigation actions, while highly effective, could lead to operational negative side-effects inside the network and therefore onto a mission. ROIA evaluates proposed response plans based on validatable local impactand dependency-assessments of dependencies inside an organization's business-and IT-infrastructure. This is beneficial for applications, where highly critical missions and resources must be protected, without sacrificing missions in favor of security.

The rest of the paper is structured as follows: Sections II and III discuss preliminaries and theory of a financialand operational-impact assessment. Section IV describes a proposed dynamic risk management response model based on financial-and operational impact-assessments. A real world application of the proposed system is presented in Section V showing the applicability of the proposed model. Section VI discusses related work and we conclude in Section VII.

II. FINANCIAL IMPACT ASSESSMENT

Cost sensitive metrics have been proposed as a viable approach to find an optimal balance between intrusion damages and response costs, and to guarantee the choice of the most appropriate response without sacrificing the system functionalities. Measurements are either absolute or relative. Absolute measurements use precise values that scale with a given unit (e.g. hundreds, thousands, millions, etc); whereas relative measurements are methods for deriving ratio scales from paired comparisons represented by absolute numbers [START_REF] Saaty | What is relative measurement? The ratio scale phantom[END_REF]. Relative measurements are useful in obtaining an overall ratio scale ranking of the alternatives. If the ratio produces repeatable and consistent results, the model can be used to compare security solutions based on relative values [START_REF] Sonnenreich | Return On Security Investment (ROSI) A Practical Quantitative Model[END_REF].

Examples of these models include the Return On Investment (ROI) and all its variants [START_REF] Sonnenreich | Return On Security Investment (ROSI) A Practical Quantitative Model[END_REF]- [START_REF]A Guide for Government Agencies Calculating Return on Security Investment[END_REF].

For the scope of this article, we consider sets of individual actions performed as a response to an adversary. Sets of these actions are called response plans: Definition 1 (Response Plan). A response plan RP is a vector of mitigation actions, representing individual actions to be performed as a response to an adversary or threat opposed to an organization.

The Return On Response Investment (RORI) is a quantitative model for cost sensitive response based on a financial comparison of the response plans [START_REF] Kheir | A Service Dependency Model for Cost-Sensitive Intrusion Response[END_REF], [START_REF] Gonzalez-Granadillo | RORIbased countermeasure selection using the OrBAC formalism[END_REF]. RORI is an adaptation of the Return On Security Investment (ROSI) index, that provides a qualitative comparison of response plans. The RORI index considers not only the intrusion impact but also the effect of response plans, as shown in Equation 1.

RORI = (ALE • RM ) -ARC ARC + AIV • 100 (1)
All parameters are defined as follows:

Definition 2 (Annual Loss Expectancy, ALE). ALE corresponds to the attack impact loss that an organization is exposed to in the absence of mitigation actions. ALE is expressed in monetary values (e.g., $/year) and depends directly on the attack's severity and likelihood. ALE includes the loss of assets (L a ), the loss of data (L d ), the loss of reputation (L r ), the legal procedures (LP ), the loss of revenues from clients or customers (L rc ), as well as other losses (L o ), contracted insurances (Ins), to be multiplied by the annual rate of occurrence of the attack (ARO), i.e.,

ALE = (L a + L d + L r + LP + L rc + L o -Ins) • ARO .
Definition 3 (Annual Infrastructure Value, AIV). AIV represents the fixed costs that are expected to be perceived by an organization regardless of the implemented mitigation action. AIV is strictly positive and is expressed in monetary values (e.g., $/year). It includes the following costs: equipment costs (C e ), personnel costs (C p ), service costs (C s ) and other costs (C o ), as well as the resell value (V r ), i.e.,

AIV = C e + C p + C s + C o + V r .
Definition 4 (Risk Mitigation, RM). RM refers to the risk mitigation associated with a given mitigation action. RM takes values between zero and one hundred percent (i.e. 0% ≤ RM ≤ 100%). In the absence of mitigation actions, RM equals 0%. RM is computed as the product of the Mitigation Coverage (MC, which is the percentage of the attack covered by the mitigation action) by the Effectiveness Factor (EF, which is the percentage of reduction of the total incident cost given the enforcement of the mitigation action), i.e.,

RM = M C • EF .
Definition 5 (Annual Response Cost, ARC). ARC refers to the costs associated to a given mitigation action. ARC is always positive and expressed in monetary values (e.g., $/year). It includes direct costs such as the cost of implementation (C impl ), the cost of maintenance (C maint ), as well as other direct costs (C od ) and indirect costs (C i ) that may originate from the adoption of a particular mitigation action, i.e.,

ARC = C impl + C maint + C od + C i .
Considering a RORI index alone, the best candidate response set is represented by a maximal positive RORI index.

III. OPERATIONAL IMPACT ASSESSMENT

An operational impact assessment is used to address potential impacts onto a higher goal, from widespread events which impact local operational capabilities. For example, a local impact caused by an event on a distant node, might lead to a causal chain of operational failures, leading to an impact on a company. Understanding these impacts is a pertinacious problem and current work uses adhoc solutions based on handcrafted algorithms. While such approaches deliver early results, their assessments need to be verified and validated by large amounts of data-which is not always available.

Motzek et al. introduce an approach towards OIA based on a probabilistic graphical model in [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF], which defines a well-understood problem on which an OIA can be reduced. By resorting to a probabilistic model, the use of conditional probability distributions allows for local views on assessments, without a need to understand a specific use case nor any algorithmic properties. It is this local view, which allows for a validation of defined data. This means, assessments from experts can be used directly without global normalization factors and experts are not forced into expertise which they can not understand.

The following sections introduce a view on OIA from three different perspectives, each defining one dependency model as a probabilistic graphical model of random variables and respective dependencies.

Remark 1 (Impact). An abstract term of "impact" is used in this work in the sense of "not operating as fully intended". The underlying meaning of "intended operation" lies in an use case of the model.

A. Mission Dependency Model (Business View)

Motzek et al. [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] extend a model by Jakobson [START_REF] Jakobson | Mission Cyber Security Situation Assessment using Impact Dependency Graphs[END_REF] and model mission dependencies as shown in Figure 1 as a graph of mission nodes (MN). A company is dependent on its business processes. A business process is dependent on one or more business functions, which are provided by Business resources. Figure 1 shows a dependency graph of business relevant objects for a small company consisting of two business processes, requiring a total of four functions provided by four resources.

Dependencies are represented by local conditional probability distributions (CPDs) modeling probabilities of failure, given dependances fail. For example, the probability of business-function BF 1 (see Figure 1), say, "provide access to customer data", failing, given required business-resource A, e.g., "customer-data-frontend", fails is 90%. [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] argues that the meaning of local conditional probabilities are understandable using common-sense (e.g., "in 9 out of 10 cases, customer data were not accessible for employees during frontend-server maintenance") and that the (numerical) assessment can be directly validated by either an expert or through ground-truth. Definition 6 (Probabilistic Preliminaries). A node of a probabilistic dependency model is a random variable, denoted as capital X. Every random variable is assignable to one of its possible values x ∈ dom(X). Let P (X = x) denote the probability of random variable X having x as a value. For the case dom(X) = {true, f alse} we write +x for the event X = true and ¬x for X = f alse.

The event +x represents the case that node X is operationally impacted and ¬x that is operating as fully intended, i.e., no impact is present.

Definition 7 (From dependencies to distributions). Single dependencies of a random variable Y on X are modeled as individual conditional probability p(x|y) and p(x|¬y). Such individual conditional probabilities are fragments of a complete CPD and are therefore denoted in lowercase. To acquire the local CPD P (X| Y ) of node X from all its fragments p(X|Y ) of all dependent nodes Y ∈ Y , [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] employs a non-leaky noisy-or combination function as described in [START_REF] Pearl | Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference[END_REF], [START_REF] Henrion | Practical Issues in Constructing a Bayes' Belief Network[END_REF].

With Definition 7, a mission dependency model is a Bayesian network, whose semantics is defined by the joint probability distribution over all mission nodes, i.e., random variables, as the product of all local defined CPDs.

Business resources are part of an infrastructure perspective and-from an operational view-might be irrelevant, but are identified to be business critical by a business expert. Notwithstanding, such an assessment might be inaccurate, which is why transitive impacts must be considered. For example, a web-service might be identified as a business critical resource; it can not be expected that an underlying distributed computing cluster is identified to actually provide this web-service. The following resource dependency model covers these dependencies.

B. Resource Dependency Model (Operation View)

Critical resources identified in a mission dependency model are dependent on further resources. Likewise, if a dependent resource is threatened, the identified critical resource might be threatened transitively as well. An operation expert, unlike a business expert, has an expertise to understand such dependencies, which we cover in an resource dependency model. The resource dependency model models dependencies between individual resources, which can be, e.g., individual ICT servers, ICS devices, software components or, in other use cases, manufacturing robots, suppliers, soldiers or vehicles. A "Bayesian" approach is followed as before, meaning that every dependency between two resources represents a local conditional probability of impact, if the dependence is impacted, as shown in Figure 2.

[26] argues that assessing resource dependencies is not manageable by hand. Complex operation structures render a manual dependency analysis infeasible and error prone. Further, dynamically adjusting infrastructures (e.g., as found in IT cloud use cases) make it even unknown to an expert to identify exact dependencies. However, [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] argues that an expert is able to validate a presented infrastructure dependency model for plausibility. Therefore, a solution based on heuristics from exchanged information amounts are proposed to obtain a resource dependency model, for which we present an example in Section IV-B.

C. Local Impacts (Security View)

Nodes of a resource dependency model might threatened directly by, so-called, external shock events. A security expert has the expertise to assess the local consequences on a node, given the presence of an shock event, e.g., the presence of a vulnerability or a direct shutdown of a node. An external shock event SE ∈ SE is a random variable and is present (+se) or not present (¬se), for which a prior random distribution P (SE) is defined. Every node X might be affected by one or more external shock events SE. Accordingly, the presence of an external shock event can be known or can be unclear and is assessed probabilistically through its prior random distribution P (SE). The set of observed external shock events (known presence) is a set of instantiations se of observed random variables SE O ⊆ SE. In the case that an external shock event is present (se), there exists a probability of it affecting a node X, expressed as a conditional probability fragment p(+x|+se). If an external shock event exists and it is not inhibited, [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] speaks of a local impact on X. In the case that the external shock event is not present, i.e., ¬se, it does not affect random variable X. Every individual conditional probability fragment contributes to a random variable's CPD in the same way as a dependance on other nodes. Definition 8 (Temporal Aspects). [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] defines a temporal aspect of an external shock event. In an abstract timeslices an effect of an external shock event changes. Every abstract timeslice represents a duplicate of the network-and mission dependencies with a different set of local conditional probabilities and prior probabilities of shock events. A time-varying probability is denoted as a sequence t 0 : p 0 , . . . , t T : p T , with T + 1 abstract timeslices. In every abstract timeslice i, varying probabilities take their respective conditional or prior probability p i defined for its timeslice t i .

Note that a security expert does neither need to have any expertise in dependency analyses nor in business process

analyses. An assessment of potential impacts is performed using a local, causal, view on resources and direct causes as external shock events.

D. Mathematical Mission Impact Assessment

To summarize, one probabilistic graphical model is defined by a mission dependency network, a resource dependency network and a set of external shock events with associated local impacts threatening nodes (or random variables) defined by the resource dependency network. As resource nodes are dependent on each other, a threatened node might again threaten another node, which leads to a global "spreading" of impacts induced by external shock events. In the end, there exists a probability that even a business process or the complete modeled company (mission) is threatened transitively by various external shock events, which is what we call the mission impact assessment. Definition 9 (Mission Impact Assessment, MIA). The probability of a mission node M N being impacted, is defined as the conditional probability of M N being impacted +mn given all observations of external shock events se ∈ se, i.e. P (+mn| se), where the effects of local impacts due to se are mapped globally based on mission-dependency and resource-dependency graphs. The mission impact assessment is therefore defined as the problem of obtaining P (+mn| se), for all mission nodes M N defined defined in the mission dependency model.

Probabilistic inference is generally known to be NP-hard, and an exact solution for the MIA problem is only obtainable in small toy domains. However, approximate inference techniques are a valuable alternative for probabilistic inference. To obtain an algorithm determining an approximate solutions to the MIA problem, one can see the probabilistic model as a probabilistic logic program, where every "path" w M N i ∈ w M N from an external shock event SE ∈ SE to the mission node M N is a conjunction of Boolean random variables and is a sufficient proof for satisfying {M N = true} = +mn. Due to the noisy or assumptions, w M N then represents a disjunction of conjunctions. Every proof w M N i exists with a probability P (w M N i ), where P (w M N i ) is the product of all probabilities in this proof. Let P(w M N i ) denote the probability viewed as a set. P (+mn| se) is then the probability that at least one proof holds, or rather, the probability that the disjunction of conjunctions is satisfied, i.e.

P (+mn| se) = i P(w M N i ) = P ( w M N ) = P ({ i w M N i }) ,
where not all P(w M N i ) are disjoint. Calculating i P(w M N i ) is also known as the probabilistic satisfaction problem and is also used in the Problog reasoning framework [START_REF] Raedt | ProbLog: A Probabilistic Prolog and Its Application in Link Discovery[END_REF]. To reduce computational complexity, a search for all "paths" w M N i ∈ w M N can be limited to a fixed depth, e.g., using a depthlimited depth-first search. It is reasonable to limit a depth to an average path length in a graph to at least visit every node once, i.e., to at least include every external shock event once.

A probabilistic MIA P (+mn| se) directly originates from all defined dependency-models and represents an inference problem in a probabilistic graphical model. Therefore, [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] argues that if locally defined dependency-models are validated to be correct, an obtained impact assessment P (+mn| se) is validated, too.

IV. DYNAMIC RISK MANAGEMENT RESPONSE SYSTEM

We developed a system that proposes response possibilities to mitigate identified risks, enable choice of the most suitable response possibilities to reduce the identified risks below an admissible level, and then, compute the mitigation actions to be deployed on monitored or protected ICT systems. We adopt a quantitative risk-aware approach that provides a comprehensive view of the threats, by considering, (i) the likelihood of success of the considered attacks, (ii) their induced impact, and (iii) the cost and impact of the possible responses. Our dynamic response model is composed of two main modules: the Response Financial Impact Assessor (RFIA), and the Response Operational Impact Assessor (ROIA), as shown in Figure 3.

The RFIA receives input data regarding the severity and likelihood of the potential threats, benefits and cost of mitigation actions, default security policies, and all elements that could be affected in the exploitation of the threat (e.g., users, channels, resources). The RFIA performs the evaluation of individual and combined mitigation actions and creates response plans based on the selected candidates. Such plans are sent to the ROIA for evaluation. For every proposed response plan, the ROIA provides an operational impact assessment.

Assessed response plans are propagated to a visualization module and to an policy enforcement point, which transforms mitigation actions into security policies. A response plan selection strategy proposed in this paper used to assist a security operator in selecting the most suitable response plan.

A. Response Financial Impact Assessor (RFIA)

The Response Financial Impact Assessor quantifies the level of benefit perceived per response plan on a financial basis. It provides an assessment concerning the potential financial impact that a given response plan may cause to an organization. Response plans represent proposed mitigation of the assessed risks and are assumed to be composed of one or more mitigation actions. The RFIA is composed of two main components: the Return On Response Investment (RORI), and the Attack Volume (AV), as depicted in Figure 4. The AV Engine requests the input data to particular services (e.g., LDAP, databases, ACL, servers) and retrieves the associated RCU (Resource-Channel-User) information in order to calculate its volume and plot its graphical representation. The retrieved RCU data is stored in the AV database and displayed in the AV interface.

Upon reception of all the parameters, the RORI engine stores them in the RORI database through a push command, and performs the evaluation of the authorized mitigation actions.

1) Return On Response Investment (RORI): is a relative index that indicates the level of benefit perceived if a given mitigation action is implemented. The input parameters for the RORI calculation are of two kinds: fixed parameters include the Annual Infrastructure Value (AIV), which depends on the system, and the Annual Loss Expectancy (ALE), which characterizes the intrusion or attack; variable parameters include the Risk Mitigation (RM) and Annual Response Cost (ARC) which express the costs related to a mitigation action. RORI is calculated according to Equation 1.

The RORI index is used to evaluate optimal plans, by ranking them as a trade-off between their efficiency in stopping potential attacks, and their ability to preserve, at the same time, the best service to legitimate users. Details on the estimation of each parameter composing the RORI model can be found in [START_REF] Gonzalez-Granadillo | RORIbased countermeasure selection using the OrBAC formalism[END_REF].

2) Attack Volume (AV): is a graphical tool that evaluates the impact of one or multiple attacks and/or mitigation actions over a specific target. The representation of each attack is performed in a three-dimensional coordinate system i.e., user account (Acc), channel (Ip-Port), and resource (Res). The same coordinates include also system assets and potential mitigation actions. The projection of the three axis in our coordinate system generates a parallelepiped in three dimensions. The resulting volume is computed as the product of the axes contribution to the execution of the incident, i.e.,

AV (A) = Co Acc (A) × Co Ip-P ort (A) × Co Res (A) (2)
The axis contribution is determined as the sum of the product of each set of axis category (e.g., user account type, port class, resource type, etc.) by its associated weighting factor. Each category within the axis contributes differently to the volume calculation. The weighting factor corresponds to the severity of a given category based on the CARVER1 methodology [START_REF] Norman | Risk Analysis and Security Countermeasure Selection[END_REF].

The volume calculation requires the computation of the contribution of each axis represented in the coordinate system. This contribution is determined as the sum of each set of axis entities (e.g., user account type, port class, resource type) times its associated weighting factor (that results from the implementation of the CARVER methodology), i.e.,

Co Axis (S) = n i=0
Count(E ∈ T ype Axis (S))

× W F (T ype Axis (S)) . (3)
The attack volume interface provides a 3D view of the complete attack scenario, making it possible to calculate the impact of multiple attacks that originate simultaneously in the system. In addition, we are able to compute the coverage of such attacks in the system, and the level of coverage for one or more response plans against the detected attack(s). Details on the computation of the system, attack and countermeasure volumes can be found in [START_REF] Gonzalez Granadillo | Using a 3D Geometrical Model to Improve Accuracy in the Evaluation and Selection of Countermeasures Against Complex Cyber Attacks[END_REF].

B. Response Operational Impact Assessor (ROIA)

The ROIA is divided into three components, which acquire, define and evaluate all information needed for an response operational impact assessment based on the described probabilistic model.

1) Network Dependency Analyzer: In order to obtain a resource dependency model automatically, we propose a module which consecutively captures traffic inside an organization and analyses statistics in them based on a heuristic. In our use case, a resource dependency model consists of a medium sized ICT environment, in which some ICT devices also represent gateways to an industry SCADA system. Further, it can be assumed that every device drives one purpose. This allows for a simple heuristic on exchanged information amounts to obtain a plausible resource dependency network, explained at the following simple example: A workstation X consuming different query results from multiple databases distribute gained and processed information from such queries to other devices. The percentage of received traffic T Yi,X from every database Y i towards the total received traffic gives a good guideline for the conditional dependency between them as p(x|y i ) =

T Y i ,X i T Y i ,X .
Depending on a network or company characteristics other heuristics might be appropriate, e.g. derivation from a mean received amount of data or a mapping onto a σ distribution. As long as no irrelevant information is consumed and distributed to other resources, this heuristic results in a plausible resource dependency model. As part of the ROIA, we implement this approach in an automatic module, periodically capturing traffic and analyzing obtained results, which are presented in Section V.

2) Local Impact Definition: The introduced probabilistic mission impact model is based on general external shock events. In order to obtain a response OIA, a response plan must be transformed to external shock events. Every mitigation action inside a response plan represents a potential cause for local harm. For example, a shutdown of a node X might cause other transitively dependent nodes to not work as intended, i.e., become impacted. Assessing the global effects of a local action is intuitively not possible and is the goal of an ROIA. However, local assessments are validatable and can even be grounded on common sense: Given one shuts down a node X, the probability that it will be impacted, i.e., not work as intended, is 100%: p(+x|+shutdown x ) = 1. We extended [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF]'s proposed external shock event transformation from response plans: Definition 10 (Response Plan Side Effects). We define external shock events by using three abstract temporal timeslices: t 0 representing a short-term impact, t 1 representing a mid-term impact, and t 2 representing a long-term impact. If a node is shut down (+se: the external shock event is present) it is easy to assess a probability of local impact to be 1. This means, p(+x|+se) = t 0 : 1, t 1 : 1, t 2 : 1 . Likewise, restarting a resource has the same effect as a shutdown in t 0 , and might likely lead to hardware failure during reboot in a mid-term t 1 , but will locally not cause conflicts in a long-term: p(+x|+se) = t 0 : 1, t 1 : 0.6, t 2 : 0 . Employing a patch on a node X might produce collateral damage as well. During installation of the patch, there exists a (low) probability of immediate conflict, e.g., a flat assumption of 10% or a measure published by a software vendor. In a mean time, a patch might enforce a reboot of a resource. This leads to a temporal shutdown and might lead to hardware failure. Finally, after a successful reboot, a replacement of hardware, and/or a restore of a previous backup, the network device will fully resume its operational capability. Therefore, p(+x|+se) = t 0 : 0.1, t 1 : 1.0, t 2 : 0.0 . We argue that every installation, update or change of software can be modeled from an impact perspective as a patching operation.

Like software is exchanged by a patch, hardware can be reconfigured as well. A reconfiguration is likely to enforce a reboot, if an exchanged component is not hot swappable. Therefore, we assume the same local impact as induced by a reboot.

Further examples for shock events are given by Motzek et al. in [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF].

3) Monte-Carlo Evaluator: As mentioned before, an exact calculation of i P(w M N i ) is possible by the inclusion and exclusion principle and the Sylvester-Poincar equality, but is exponentially hard due to the subtraction of all overlapping sets and is therefore not practical. We therefore approximate a solution to the MIA problem by the use of an approximate inference technique.

For every mission node M N , there exists a Boolean formula w M N as a disjunction of conjunction over Boolean random variables B. However, Boolean random variables in B take their respective truth value according to a probability distribution. To approximate i P(w M N i ), i.e., to find an approximate solution to the MIA problem, a complete instantiation of all Boolean variables B is drawn by sampling every Boolean variable according to its distribution, and w M N is checked for satisfaction. Repeating this process n times, where n + times a satisfaction was found, approximates P (+mn| se) by n + /n. Our results show that an upper three-sigma bound of expected error Ē is obtained by Ē = 0.775 • √ n -1 . A detailed description and evaluation is given in [START_REF] Motzek | Probabilistic Mission Impact Assessment based on Widespread Local Events[END_REF] and left out for brevity in this paper.

C. Selection of Response Plans

Both, RFIA and ROIA, perform impact assessments of a proposed response plan as a collection of individual mitigation actions. Due to their nature, a financial impact assessments (using a RORI index) and an operational impact assessments are performed from perpendicular perspectives: On the one hand, the less invasive a response plan is, the less it can potential cause collateral damage. On the other hand, a minimally invasive response plan, will not significantly reduce a risk. It is the novel advantage of the proposed DRMRS of being able to combine both assessments.

However, finding an optimal response plan in all dimensions defined by an OIA and a FIA is not trivial. The proposed FIA results in a linear, relative metric, i.e., assessments depend on a use-case and context and are only interpretable, evaluable and comparable during one evaluation of a set of response plans. Still, among one evaluation there exists a well-defined ordering. However, relative reference points are required for obtaining an absolute scale from one evaluation.

The proposed OIA is based on a probabilistic model resulting in a stable, absolute metric, e.g., an assessment of, say, 5% is understandable and interpretable independent of any context, use-case or evaluation. For example, an OIA of 5% for a potential impact on a company, given a set of observed external shock event, is equivalent to a 5% of winning a lottery, given one plays the lottery, or a 5% probability of tossing a 1 on a twenty-sided cube. However, an OIA consists an ndimensional vector representing a temporal diversity.

Due to a missing absolute scale in FIA and an assumed incomparability of temporal dimensions, an optimization goal by a defined cost function is not available. We therefore propose a selection of response plans based on a best compromise, i.e., a semi-optimal solution among all impact assessment dimensions, related to a Pareto optimum.

Definition 11 (Semi-optimal response plans). Let RP Finding a best compromise among an n-dimensional impact assessment is therefore defined as finding the smallest semioptimal set. Definition 12 (Smallest semi-optimum). Let d be the vector of all impact dimensions. Then, the smallest semi-optimal set of response plans RP is the set

RP = min ε      d∈ d ṘP d ε    = ∅   . (4)
As the ROIA represents an absolute metric, ŘP ROI = 1

and RP ROI = 0. For the relative RFIA metric ŘP This means, ṘP RF I ε might be too large. A selection of a response plan according to Definition 12 can efficiently be performed by using a binary search.

V. USE CASE

This section studies an application of the proposed DRMRS in an infrastructure environment of an Energy Distribution Organization. The environment consists of a distributed network of remote terminal units (RTU) in energy stations of medium voltage (MV = 20,000 Volts) and high voltage (HV = 150,000 Volts). RTUs acquire data from electrical equipments (e.g., PLC, sensors, etc.), and send data to a supervisor terminal unit (STU) of the headquarter. The RTU network utilizes Supervisory Control and Data Acquisition (SCADA) protocols and is composed of over 13,000 energy stations, 6,000 of which are controlled by the STU.

For testing purposes, we emulated the energy distribution organization (EDO) using the information shown in Table I. From Table I, we organize the information of the EDO according to their nature (dimension). We have for instance, servers, firewalls, IDs, etc as resources; IP addresses and port numbers as channels, and operators as user accounts.

Depending on the type of element and their importance to the mission of the organization, we assign a weighting factor. A basic operator is assigned a WF=1, whereas an advanced operator has a WF=4, and a supervisor has a WF=5. For those cases where the category regroups elements of different types (e.g., SCADA Servers, Web servers, NTP Server, etc are regroup as Servers), we assign a weighting factor for each type of element, going from one to five.

The annual infrastructure value for the EDO is equivalent to 11,379,800.00 , which represents the cost of operation, license, maintenance and services incurred in a yearly basis for the regular operations of the organization. It considers the annual cost of all the policy enforcement points (PEPs) of the organization.

A. Threat Scenario

Security experts from the use case partner identified a threat, called "AS02", which corresponds to a compromise of a specific target through vulnerability exploitation. More precisely, the threat will cause data corruption or leakage of a database in the ICT domain, e.g., from a file server.

There exists an attack vector via the ICT Network from, e.g., a vulnerable router "VR-08", targeting first a Web server "Web-SRV", second, a workstation "User-PC", and third, a file server "File-SRV".

B. Financial Impact Assessment

Threat AS02 has a severity defined as "serious", which corresponds to 1,000,000 e, and a likelihood defined as "high", which corresponds to a value of 12. The ALE is computed as 12,000,000 e/year. This threat has been associated to a set of mitigation actions. Combinations of associated mitigation actions form response plans that shall improve the security status of the monitored system (e.g., patch deployment, shutdown, restart, or other system reconfiguration). They are selected and executed by operators resulting in automated deployment of mitigation actions where possible (e.g., firewall reconfigurations) or otherwise issuing instructions to senior operators for follow-up deployment of actions (e.g., patch deployment). The detailed information of all authorized mitigation actions is shown in Table II. Table II summarizes the information about mitigation actions that are authorized as a response to the specified threat AS02. ARC and EF of each security mitigation action were estimated based on expert knowledge and historical data. The RM value is calculated as the product of the EF and coverage (COV). A coverage is obtained using geometrical operations from the attack volume model. The RORI index is calculated using Equation 1.

From the list of proposed mitigation actions, MA1 (Reconfiguration of V-R08) provides the highest RORI index. By taking this action, the risk is expected to be reduced to 60% (RM), resulting in a RORI index of 63. [START_REF] Bastian | Gephi: An open source software for exploring and manipulating networks[END_REF]

M A 1 , M A 2 , M A 3 , M A 4 , M A 5 , M A 6 , M A 7 , M A 8 , M A 9 .
The worst is represented by { M A 7 , M A 9 M A 8 , M A 9 } with ŘP RF I = 0.21. The graphical representation of the best response plan vs. the evaluated threat is depicted in Figure 5, where hashed lines represent threat AS02 and colored lines represent the mitigation actions.

C. Operational Impact Assessment

To perform a response operational impact assessment, a resource dependency model is needed. As described in Section III a manual assessment is said to be infeasible and a solution based on a heuristic of exchanged traffic information was proposed in Section IV-B. An evaluation of one week of traffic recordings inside the EDO resulted in a resource dependency model as shown in Figure 6 consisting of 35 nodes and 66 edges (dependencies); 470 other nodes resembled insignificant dependencies and were removed for visualization and anonymization purposes. The average path length between two nodes resulted to be 2.5, s.t., a maximum search depth of 7 is likely to cover all paths.

Based on the resource dependency model and a mission dependency model defined by business experts from the use case partner, ROI assessments for all proposed response plans are evaluated. The mission dependency model for the EDO consists of four business processes and 26 identified critical resources, from which not all are yet simulated and not needed for the scope of this paper. For anonymization purposes and non-disclosure agreements, the mission dependency model can not be displayed here. A comparison between a RORI index and operational impact assessments in three temporal dimensions are given in Table III. Note how both lowest and highest probabilities of operational impact lead to extremely low RORI indices. In fact, Pearson's product-moment correlation coefficient between RORI and OI 0 and OI 1 for all evaluated response plan is ≈ 0.14 and between RORI and OI 2 even ≈ 0.01, showing that RORI and OI are almost uncorrelated. Fig. 6. Resource dependency model extracted from the use case partner. Thicker and darker edges represent higher dependency degrees. Visualized using Gephi [START_REF] Bastian | Gephi: An open source software for exploring and manipulating networks[END_REF].

= M A 1 , M A 2 , M A 3 , M A 4 , M A 5 , M A 6 , M A 7 , M A 8 , M A 9
with a RORI index of 97.1435, however, is assessed to bear almost the highest probability of operational impact with t 0 : 0.408 t 1 : 0.402 t 2 : 0.0 . Note that an OI assessment of a response plan is not a linear combination of individual mitigation actions, as a "double count" of probabilities is not allowed and would lead to spurious results. In terms of lowest short-term (t 0 ) OI probability, M A 4 and M A 6 alone show to be dominant, and in mid-term (t 1 ) M A 1 alone is dominant. In a long-term perspective (t 2 ) a large set of response plans is dominant with a 0 probability of impact. Thus RP R , M A 4 and M A 6 represent a Pareto optimal set. As proposed in Section IV-C we search for the best compromise: From Definition 12 one obtains the best semi-optimal response plan set RP = { M A 1 , M A 2 , M A 4 , M A 6 , M A 7 , M A 9 } using ε = 0.1475, consisting of one response plan with an operational impact assessment of t 0 : 0.108 t 1 : 0.09 t 2 : 0.0 and a RORI index of 82.8514. This means, with a compromise of 14.75% of the theoretical optimum in every dimension from the evaluated optimum, a semi-optimal response plan is found.

Notwithstanding, one could normalize all impact dimensions to a range between [0, 1], where 1 represents the best (i.e., 0 for operational impact and the best evaluated RORI index for financial impact) and 0 the worst assessment and then define an equally weighted cost function f used for selection of an optimal response plan. Following such approach, one selects: RP f = M A 1 , M A 2 , M A 4 , M A 6 , M A 9 with t 0 : 0.102 t 1 : 0.09 t 2 : 0.0 rori = 82.7732 , which is different from RP . The following example clarifies the difference: Say, there exists another response plan RP * with an assessment t 0 : 0.191 t 1 : 0.0 t 2 : 0.0 rori = 82.7732 , i.e., an assessment similar to the one of RP f , but where an impact of dimension t 1 is moved to t 0 with a small difference. RP * would be assigned an even better cost than RP f by f , but the t 0 assessments differs by ε = 18.5% of the theoretical optimum from the evaluated optimum in dimension t 0 instead of 14.75% as RP does.

VI. RELATED WORK

Current researches focus on considering the impact of attacks by evaluating their severity and consequences, leaving aside the impact of security actions in mitigating the effects of such attacks. Dini and Tiloca [START_REF] Dini | On simulative analysis of attack impact in Wireless Sensor Networks[END_REF], for instance, propose a simulation framework that evaluates the impact of cyberphysical attacks, discusses the attack ranking process, and analyzes different mitigation actions. However, these latter are not considered in the calculation of the attacks' impact nor they are ranked according to their effectiveness in stopping or mitigating the attacks.

Kundur et al. [START_REF] Kundur | Towards a Framework for Cyber Attack Impact Analysis of the Electric Smart Grid[END_REF], propose a paradigm for cyber attack impact analysis that employs a graph-theoretic structure and a dynamical systems framework to model the complex interactions amongst the various system components. The approach involves quantifying the effects of given classes of cyber attack, providing information on the degree of disruption that such class of attacks enable, and identifying sophisticated dependencies between the cyber and physical systems, but leaves aside the impact of mitigation actions in the attack's impact calculation.

Squoras et al. [START_REF] Sgouras | Cyber Attack Impact on Critical Smart Grid Infrastructures, Innovative Smart Grid Technologies Conference (ISGT)[END_REF] present a qualitative assessment of the cyber attack impact on critical Smart Grid infrastructures. Authors evaluate the impact of DoS/DDoS attacks on data availability without considering mitigation actions in the assessment of the overall impact calculation.

In terms of operational impact assessment, probabilistic models have been researched as an adequate assessment of impacts or risks posed due to attacks or found vulnerabilities [START_REF] Wang | An attack graphbased probabilistic security metric[END_REF]- [START_REF] Xie | Using Bayesian networks for cyber security analysis[END_REF]. However, often imperfect knowledge is not considered [START_REF] Wang | An attack graphbased probabilistic security metric[END_REF] or dependency cycles pose a problem [START_REF] Xie | Using Bayesian networks for cyber security analysis[END_REF]. Other impact propagation approaches, able to handle such details, are not probabilistic based and degrade to a handcrafted propagation algorithm with arbitrary scores [START_REF] Kheir | Viinikka Cost evaluation for intrusion response using dependency graphs[END_REF], [START_REF] Marko | Graph based metrics for intrusion response measures in computer networks[END_REF].

Barreto et al. [START_REF] Barreto | A Semantic Approach to Evaluate the Impact of Cyber Actions to the Physical Domain[END_REF], [START_REF] Barreto | Using a Semantic Approach to Cyber Impact Assessment[END_REF] only consider direct impacts as approaches to mission modeling, leaving aside transitive impacts and/or defining a manual description of all dependencies between individual devices inside one organization, which is, in most of the cases an unfeasible process.

Our approach proposes the evaluation and selection of mitigation actions based on the financial-and operationalassessment of security events (e.g., attacks and mitigation actions). The ultimate goal of our approach is to select the set of mitigation actions that provides the maximal positive financial gain and the minimal operational negative side-effect.

VII. CONCLUSION

In this paper we have proposed an automatic response system, reacting to threats opposed on a company based on a multi-dimensional impact assessments. Two different impact assessment approaches have been incorporated, which seem to be conflicting at first sight: Every action taken in order to reduce a potential attack vector, bears a potential negative side effect that needs to be reduced.

Based on a multi-dimensional minimization proposal, we propose the choice of semi-optimal response plans that on the one hand bear the highest financial attractiveness on return on investment, and, on the other hand, bear the lowest probability of conflicting with a company's missions. This is beneficial for applications, where highly critical missions and resources must be protected, without sacrificing missions in favor of security.

Fig. 1 .

 1 Fig. 1. Mission Dependency Model. Values along edges denote individual conditional probability fragments.

Fig. 2 .

 2 Fig. 2. A minimalistic resource dependency model. Conditional probability fragments are marked along the edges. Grey nodes represent external shock events leading to local impacts on resources. Connections to the mission dependency model are sketched in dashed gray.

Fig. 3 .

 3 Fig. 3. Internal block diagram for the DRMRS components

Fig. 4 .

 4 Fig. 4. Internal block diagram for the RFIA componentFrom Figure4, the RORI interface requests the RORI Engine to perform the evaluation of mitigation actions (e.g., individual and combined) for a given threat scenario. The RORI Engine requests the input parameters (i.e., ALE, AIV, ARC, RM) to the RORI database through a get command. If the ALE or the RM are missing for that particular security incident, the RORI engine will request the AV Engine to

.

  of proposed response plans, associated with a linearly scaled impact assessment of dimension d. Let ṘP d ⊆ RP d denote the set of optimal proposed response plans in terms of dimension d. Let RP d denote the assessment of the theoretical optimal response plan and let ŘP d denote the assessment of the theoretical worst response plan in terms of dimension d. Then, let ṘP d ε ⊆ RP d represent the set of semi-optimal response plans in terms of dimension d and easing factor ε ∈ [0, 1] representing the allowed deviation ε of the theoretical response plan range | RP d -ŘP d | from the evaluated optimal response plan ṘP d

  on RP RF I . If not all possibly allowed response plans are evaluated by the RFIA for performance criteria, ŘP RF I and RP RF I are not uniquely identifiable and must be estimated by ŘP RF I = -1 and RP RF I = ṘP RF I .

Fig. 5 .

 5 Fig. 5. Graphical representation of the threat and the best response plan.

  . Response plans for this threat are formed by combinations of all possible mitigation actions, considering those actions that are mutually exclusive (e.g.,M A 10 can not be simultaneously implemented with M A 2 , M A 4 , and M A 7 ). All potential combinations, i.e., 797 response plans are evaluated and the best response plan results in a RORI index of RP

					RF I	= 97.1435
	with	a	combination	of	mitigation	actions	as

A multi-criteria methodology that considers Criticality, Accessibility, Recuperability, Vulnerability, Effect, and Recognizability in the evaluation

ACKNOWLEDGMENT

The research in this paper has received funding from the PANOPTESEC project, as part of the Seventh Framework Programme (FP7) of the European Commission (GA 610416).