Asset Criticality and Risk Prediction for an Effective Cyber Security Risk Management of Cyber Physical System

Article

Kure, H. I., Islam, S., Ghazanfar, M., Raza, A. and Pasha, M. 2021. Asset Criticality and Risk Prediction for an Effective Cyber Security Risk Management of Cyber Physical System. Neural Computing and Applications. 34, p. 493–514. https://doi.org/10.1007/s00521-021-06400-0
AuthorsKure, H. I., Islam, S., Ghazanfar, M., Raza, A. and Pasha, M.
Abstract

Risk management plays a vital role in tackling cyber threats within the cyber-physical system (CPS). It enables identifying critical assets, vulnerabilities and threats and determining suitable proactive control measures for the risk mitigation. However, due to the increased complexity of the CPS, cyber-attacks nowadays are more sophisticated and less predictable, which makes risk management task more challenging. This paper aims for an effective cybersecurity risk management (CSRM) practice using assets criticality, predication of risk types and evaluating the effectiveness of existing controls. We follow a number of techniques for the proposed unified approach including fuzzy set theory for the asset criticality, machine learning classifiers for the risk predication and comprehensive assessment model (CAM) for evaluating the effectiveness of the existing controls. The proposed approach considers relevant CSRM concepts such as asset, threat actor, attack pattern, tactic, technique and procedure (TTP), and controls and maps these concepts with the VERIS community dataset (VCDB) features for the risk predication. The experimental results reveal that using the fuzzy set theory in assessing assets criticality supports stakeholder for an effective risk management practice. Furthermore, the results have demonstrated the machine learning classifiers exemplary performance to predict different risk types including denial of service, cyber espionage and crimeware. An accurate prediction of risk can help organisations to determine the suitable controls in proactive manner to manage the risk.

KeywordsCyber Security Risk Management; Risk Prediction; Machine Learning; Fuzzy theory; Feature Extraction; Control; Cyber Physical System
JournalNeural Computing and Applications
Journal citation34, p. 493–514
ISSN1433-3058
Year2021
PublisherSpringer
Accepted author manuscript
License
File Access Level
Anyone
Digital Object Identifier (DOI)https://doi.org/10.1007/s00521-021-06400-0
Publication dates
Online11 Aug 2021
PrintJan 2022
Publication process dates
Accepted29 Jul 2021
Deposited25 Nov 2021
Copyright holder© 2021 The Author(s)
Additional information

This version of the article has been accepted for publication, after peer review (when applicable) and is subject to Springer Nature’s AM terms of use, but is not the Version of Record and does not reflect post-acceptance improvements, or any corrections. The Version of Record is available online at: http://dx.doi.org/10.1007/s00521-021-06400-0

Permalink -

https://repository.uel.ac.uk/item/89zvw

Log in to edit

Download files

Accepted author manuscript
ML Version Final_Submission.pdf
License: Springer Nature terms of use for archived author accepted manuscripts (AAMs) of subscription articles, books and chapters
File access level: Anyone

  • 393
    total views
  • 509
    total downloads
  • 11
    views this month
  • 19
    downloads this month

Export as

Related outputs

A reinforcement learning recommender system using bi-clustering and Markov Decision Process
Iftikhar, A., Ghazanfar, M. A., Ayub, M., Alahmari, S. A., Qazi, N. and Wall, J. 2024. A reinforcement learning recommender system using bi-clustering and Markov Decision Process. Expert Systems with Applications. 237 (Art.), p. 121541. https://doi.org/10.1016/j.eswa.2023.121541
Shifting the Weight: Applications of AI in Olympic Weightlifting
Bolarinwa, D., Qazi, N. and Ghazanfar, M. 2023. Shifting the Weight: Applications of AI in Olympic Weightlifting. PRDC 2023: 28th IEEE Pacific Rim International Symposium on Dependable Computing. Singapore 24 - 27 Oct 2023 IEEE. https://doi.org/10.1109/PRDC59308.2023.00051
Sentiment-Driven Cryptocurrency Price Prediction: A Machine Learning Approach Utilizing Historical Data and Social Media Sentiment Analysis
Bhatt, S., Ghazanfar, M. and Amirhosseini, M. 2023. Sentiment-Driven Cryptocurrency Price Prediction: A Machine Learning Approach Utilizing Historical Data and Social Media Sentiment Analysis. Machine Learning and Applications: An International Journal (MLAIJ). 10 (2/3), pp. 1-15. https://doi.org/10.5121/mlaij.2023.10301
Machine Learning based Cryptocurrency Price Prediction using historical data and Social Media Sentiment
Bhatt, S., Ghazanfar, M. and Amirhosseini, M. 2023. Machine Learning based Cryptocurrency Price Prediction using historical data and Social Media Sentiment . 5th International Conference on Machine Learning & Applications (CMLA 2023). Sydney, Australia 17 - 18 Jun 2023 AIRCC Publishing Corporation.
Large-Scale Music Genre Analysis and Classification Using Machine Learning with Apache Spark
Chaudhury, M., Karami, A. and Ghazanfar, M. A. 2022. Large-Scale Music Genre Analysis and Classification Using Machine Learning with Apache Spark. Electronics. 11 (16), p. 2567. https://doi.org/10.3390/electronics11162567
A novel DeepMaskNet model for face mask detection and masked facial recognition
Ullah, N., Javed, A., Ghazanfar, M., Alsufyani, A. and Bourouis, S. 2022. A novel DeepMaskNet model for face mask detection and masked facial recognition. Journal of King Saud University - Computer and Information Sciences. 30 (10-B), pp. 9905-9914. https://doi.org/10.1016/j.jksuci.2021.12.017
An Integrated Cybersecurity Risk Management (I-CSRM) Framework for Critical Infrastructure Protection
Kure, H. 2021. An Integrated Cybersecurity Risk Management (I-CSRM) Framework for Critical Infrastructure Protection. PhD Thesis University of East London School of Architecture, Computing and Engineering https://doi.org/10.15123/uel.89ww3
Cyber Threat Predictive Analytics for Improving Cyber Supply Chain Security
Yeboah-Ofori, A., Islam, S., Lee, S. W., Shamszaman, Z. U., Muhammad, K., Altaf, M. and Al-Rakhami, M. S. 2021. Cyber Threat Predictive Analytics for Improving Cyber Supply Chain Security. IEEE Access. 9, pp. 94318-94337. https://doi.org/10.1109/ACCESS.2021.3087109
Novel online Recommendation algorithm for Massive Open Online Courses (NoR-MOOCs)
Khalid, A., Lundqvist, K., Yates, A. and Ghazanfar, M. 2021. Novel online Recommendation algorithm for Massive Open Online Courses (NoR-MOOCs). PLoS ONE. 16 (Art. e0245485). https://doi.org/10.1371/journal.pone.0245485
Stock market prediction using machine learning classifiers and social media, news
Khan, W., Ghazanfar, M., Azam, M. A., Karami, A., Alyoubi, K. H. and Alfakeeh, A. S. 2020. Stock market prediction using machine learning classifiers and social media, news. Journal of Ambient Intelligence and Humanized Computing. 13, pp. 3433-3456. https://doi.org/10.1007/s12652-020-01839-w
A novel centroids initialisation for K-means clustering in the presence of benign outliers
Karami, A., Ur Rehman, S. and Ghazanfar, M. 2020. A novel centroids initialisation for K-means clustering in the presence of benign outliers. International Journal of Data Analysis Techniques and Strategies. 12 (4), pp. 287-298. https://doi.org/10.1504/IJDATS.2020.111498
Identifying Users with Wearable Sensors based on Activity Patterns
Ehatisham-ul-Haq, M., Malik, M. N., Azam, M. A., Naeem, U., Khalid, A. and Ghazanfar, M. 2020. Identifying Users with Wearable Sensors based on Activity Patterns. The 11th International Conference on Emerging Ubiquitous Systems and Pervasive Networks (EUSPN 2020). Madeira, Portugal 02 - 05 Nov 2020 Elsevier. https://doi.org/10.1016/j.procs.2020.10.005
An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
Kure, H., Islam, S. and Razzaque, Mohammad 2018. An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System. Applied Sciences. 8 (6), p. Art. 898. https://doi.org/10.3390/app8060898
E-Government Maturity Model for Sustainable E-Government Services from the Perspective of Developing Countries
Joshi, P. and Islam, S. 2018. E-Government Maturity Model for Sustainable E-Government Services from the Perspective of Developing Countries. Sustainability. 10 (6), p. Art. 1882. https://doi.org/10.3390/su10061882
Modeling user rating preference behavior to improve the performance of the collaborative filtering based recommender systems
Ayub, M., Ghazanfar, M., Mehmood, Z., Saba, T., Alharbey, R., Munshi, A. M. and Alrige, M. A. 2019. Modeling user rating preference behavior to improve the performance of the collaborative filtering based recommender systems. PLoS ONE. 14 (Art. e0220129). https://doi.org/10.1371/journal.pone.0220129
Assets focus risk management framework for critical infrastructure cybersecurity risk management
Kure, H. and Islam, S. 2019. Assets focus risk management framework for critical infrastructure cybersecurity risk management. IET Cyber-Physical Systems. 4 (4), pp. 332-340. https://doi.org/10.1049/iet-cps.2018.5079
Cyber Threat Intelligence for Improving Cybersecurity and Risk Management in Critical Infrastructure
Kure, H. and Islam, S. 2019. Cyber Threat Intelligence for Improving Cybersecurity and Risk Management in Critical Infrastructure. Journal of Universal Computer Science. 25 (11), pp. 1478-1502.
A Dynamic Access Control Model Using Authorising Workflow and Task-Role-Based Access Control
Uddin, M., Islam, S. and Al-Nemrat, A. 2019. A Dynamic Access Control Model Using Authorising Workflow and Task-Role-Based Access Control. IEEE Access. 7 (Art. 166676). https://doi.org/10.1109/ACCESS.2019.2947377
Kernel Context Recommender System (KCR): A Scalable Context-Aware Recommender System Algorithm
Iqbal, Misbah, Ghazanfar, M., Sattar, Asma, Maqsood, Muazzam, Khan, Salabat, Mehmood, Irfan and Baik, Sung Wook 2019. Kernel Context Recommender System (KCR): A Scalable Context-Aware Recommender System Algorithm. IEEE Access. 7, pp. 24719-24737. https://doi.org/10.1109/ACCESS.2019.2897003
Cyber Security Threat Modeling for Supply Chain Organizational Environments
Yeboah-Ofori, A. and Islam, S. 2019. Cyber Security Threat Modeling for Supply Chain Organizational Environments. Future Internet. 11 (3), p. Art. 63. https://doi.org/10.3390/fi11030063
A Robust Regression-Based Stock Exchange Forecasting and Determination of Correlation between Stock Markets
Khan, U., Aadil, F., Ghazanfar, M., Khan, S., Metawa, N., Muhammad, K., Mehmood, I. and Nam, Y. 2018. A Robust Regression-Based Stock Exchange Forecasting and Determination of Correlation between Stock Markets. Sustainability. 10 (Art. 3702). https://doi.org/10.3390/su10103702
Managing Social Engineering Attacks- Considering Human Factors and Security Investment
Alavi, R., Islam, S., Mouratidis, Haralambos and Lee, Sin Wee 2015. Managing Social Engineering Attacks- Considering Human Factors and Security Investment. in: Clarke, Nathan and Furnell, Steven (ed.) Proceedings of the Ninth International Symposium on Human Aspects of Information Security & Assurance (HAISA 2015) Plymouth University. pp. 161-171
Agile Changes of Security Landscape: A Human Factors and Security Investment View
Alavi, R. and Islam, S. 2016. Agile Changes of Security Landscape: A Human Factors and Security Investment View. in: Clarke, Nathan and Furnell, Steven (ed.) Proceedings of the Tenth International Symposium on Human Aspects of Information Security & Assurance (HAISA 2016) Plymouth University.
A Decision Framework Model for Migration into Cloud: Business, Application, Security and Privacy Perspectives
Islam, S., Weippl, Edgar R. and Krombholz, Katharina 2014. A Decision Framework Model for Migration into Cloud: Business, Application, Security and Privacy Perspectives. in: Proceedings of the 16th International Conference on Information Integration and Web-based Applications & Services New York, NY, USA Association for Computing Machinery (ACM). pp. 185-189
Sustainability forecast for cloud migration
Rahman, Alifah Aida Lope Abdul and Islam, S. 2015. Sustainability forecast for cloud migration. in: IEEE 9th International Symposium on the Maintenance and Evolution of Service-Oriented and Cloud-Based Environments (MESOCA) IEEE. pp. 31-35
Cloud Security Audit for Migration and Continuous Monitoring
Ismail, Umar Mukhtar, Islam, S. and Mouratidis, Haralambos 2015. Cloud Security Audit for Migration and Continuous Monitoring. in: 2015 IEEE Trustcom/BigDataSE/ISPA IEEE.
Measuring sustainability for an effective Information System audit from public organization perspective
Lope Abdul Rahman, Alifah Aida, Islam, S. and Al-Nemrat, A. 2015. Measuring sustainability for an effective Information System audit from public organization perspective. in: Research Challenges in Information Science (RCIS), 2015 IEEE 9th International Conference on IEEE. pp. 42-51
Towards Cloud Security Monitoring: A Case Study
Ismail, Umar Mukhtar, Islam, S. and Islam, S. 2016. Towards Cloud Security Monitoring: A Case Study. in: 2016 Cybersecurity and Cyberforensics Conference (CCC) IEEE.
A framework to support selection of cloud providers based on security and privacy requirements
Mouratidis, Haralambos, Islam, S., Kalloniatis, Christos and Gritzalis, Stefanos 2013. A framework to support selection of cloud providers based on security and privacy requirements. Journal of Systems and Software. 86 (9), pp. 2276-2293.
Evaluating cloud deployment scenarios based on security and privacy requirements
Kalloniatis, Christos, Mouratidis, Haralambos and Islam, S. 2013. Evaluating cloud deployment scenarios based on security and privacy requirements. Requirements Engineering. 18 (4), pp. 299-319. https://doi.org/10.1007/s00766-013-0166-7
Towards the design of secure and privacy-oriented Information systems in the cloud: Identifying the major concepts
Kalloniatis, Christos, Mouratidis, Haralambos, Vassilis, Manousakis, Islam, S., Gritzalis, Stefanos and Kavakli, Evangelia 2013. Towards the design of secure and privacy-oriented Information systems in the cloud: Identifying the major concepts. Computer Standards and Interfaces. 36 (4), pp. 759-775. https://doi.org/10.1016/j.csi.2013.12.010
An information security risk-driven investment model for analysing human factors
Alavi, R., Islam, S. and Mouratidis, Haralambos 2016. An information security risk-driven investment model for analysing human factors. Information and Computer Security. 24 (2), pp. 205-227.
A Risk Management Framework for Cloud Migration Decision Support
Islam, S., Fenz, Stefan, Weippl, Edgar and Mouratidis, Haralambos 2017. A Risk Management Framework for Cloud Migration Decision Support. Journal of Risk and Financial Management. 10 (2), p. 10. https://doi.org/10.3390/jrfm10020010
A Framework for Security Transparency in Cloud Computing
Ismail, U., Islam, S., Ouedraogo, Moussa and Weippl, Edgar 2016. A Framework for Security Transparency in Cloud Computing. Future Internet. 8 (1), p. 5.
Migration goals and risk management in cloud computing: A review of state of the art and survey results on practitioners
Islam, S., Fenz, Stefan, Weippl, Edgar and Kalloniatis, Christos 2016. Migration goals and risk management in cloud computing: A review of state of the art and survey results on practitioners. International Journal of Secure Software Engineering. 7 (3), pp. 44-73. https://doi.org/10.4018/IJSSE.2016070103
Assurance of security and privacy requirements for cloud deployment models
Islam, S., Ouedraogo, M., Kalloniatis, C., Mouratidis, H. and Gritzalis, S. 2015. Assurance of security and privacy requirements for cloud deployment models. IEEE Transactions on Cloud Computing. 6, pp. 387-400. https://doi.org/10.1109/TCC.2015.2511719
An empirical study on the implementation and evaluation of a goal-driven software development risk management model
Islam, S., Mouratidis, Haralambos and Weippl, Edgar R. 2013. An empirical study on the implementation and evaluation of a goal-driven software development risk management model. Information and Software Technology. 56 (2), pp. 117-133. https://doi.org/10.1016/j.infsof.2013.06.003
Human Factors in Software Security Risk Management
Islam, S. 2008. Human Factors in Software Security Risk Management. in: Proceedings of the first international workshop on Leadership and management in software architecture Association for Computing Machinery (ACM). pp. 13-16
Software Development Risk Management Model – A Goal Driven Approach
Islam, S. 2009. Software Development Risk Management Model – A Goal Driven Approach. ESEC/FSE'09 Joint 12th European Software Engineering Conference (ESEC) and 17th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE-17). Amsterdam, The Netherlands 24 - 28 Aug 2009 Association for Computing Machinery (ACM).
Offshore-Outsourced Software Development Risk Management Model
Islam, S. 2009. Offshore-Outsourced Software Development Risk Management Model. pp. 514-519
Goal and Risk Factors in Offshore Outsourced Software Development From Vendor's Viewpoint
Islam, S. 2009. Goal and Risk Factors in Offshore Outsourced Software Development From Vendor's Viewpoint. 4th IEEE International Conference on Global Software Engineering. Limerick, Ireland 13 - 16 Jul 2009
Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec
Islam, S. 2009. Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec. Requirements Engineering Journal. 15 (1), pp. 63-93.
Towards a Framework to Elicit and Manage Security and Privacy Requirements from Laws and Regulations
Islam, S., Mouratidis, Haralambos and Wager, Stefan 2010. Towards a Framework to Elicit and Manage Security and Privacy Requirements from Laws and Regulations. in: Wieringa, Roel and Persson, Anne (ed.) Requirements Engineering: Foundation for Software Quality Springer.
A Framework to Support Alignment of Secure Software Engineering with Legal Regulations
Islam, S. and Mouratidis, Haralambos 2010. A Framework to Support Alignment of Secure Software Engineering with Legal Regulations. Software and Systems Modeling. 10 (3), pp. 369-394.
Integrating Risk Management Activities into Requirements Engineering
Islam, S. 2010. Integrating Risk Management Activities into Requirements Engineering. Fourth International Conference on Research Challenges in Information Science (RCIS), pp. 299-310
Measuring Security Requirements for Software Security
Islam, S. and Falcarin, P. 2011. Measuring Security Requirements for Software Security. IEEE 10th International Conference on Cybernetic Intelligent Systems (CIS). London 01 - 02 Sep 2011
Towards a Framework for Offshore Outsource Software Development Risk Management Model
Islam, S. 2011. Towards a Framework for Offshore Outsource Software Development Risk Management Model. Journal of Software. 6 (1), pp. 38-47.
Supporting Requirements Engineers in Recognising Security Issues
Islam, S. 2011. Supporting Requirements Engineers in Recognising Security Issues. in: Lecture Notes in Computer Science Springer.
Enhancing Security Requirements Engineering by Organisational Learning
Islam, S. 2012. Enhancing Security Requirements Engineering by Organisational Learning. Requirements Engineering Journal. 17 (1), pp. 35-36.
A CASE tool to support automated modelling and analysis of security requirements
Pavlidis, M., Islam, S. and Mouratidis, H. 2012. A CASE tool to support automated modelling and analysis of security requirements. in: Nurcan, S. (ed.) IS Olympics: Information Systems in a Diverse World Springer. pp. 95-109