Industrial control systems (ICSs) are facing more and more cybersecurity issues, leading to increasingly severe risks in critical infrastructure. To mitigate risks, developing an appropriate security strategy is of paramount importance. However, existing efforts on decision making in ICSs inherit some limitations, such as the lack of consideration of the strategy for securing both cyber and physical domains and a tradeoff between security and system requirements. To overcome these limitations, a decision-making approach is presented in this paper for intrusion response in ICSs. Aiming to determine the optimal security strategy against attacks promptly, it tries to secure the most “dangerous” attack paths and respond to functional failures. In this approach, measures that cover both cyber and physical domains are designed with in-depth analysis of attack propagation. They ensure the completeness of candidate security strategy space. A number of Pareto optimal solutions are determined from the strategy space through multiobjective optimization. The objective is to maximize the objective vector composed of security benefit, system benefit, and state benefit. Then, these solutions are prioritized by using a distance-based evaluation method, which pursues the optimal protection ability by making the objective vector of the selected strategy closest to the ideal one. The effectiveness of the proposed approach is demonstrated with a case study on a simulated process control system.

中文翻译：

---

工业控制系统中入侵响应的动态决策方法


工业控制系统（ICS）面临着越来越多的网络安全问题，导致关键基础设施的风险日益严重。为了降低风险，制定适当的安全策略至关重要。然而，现有的ICS决策工作存在一些局限性，例如缺乏考虑保护网络和物理域的策略以及安全和系统需求之间的权衡。为了克服这些限制，本文提出了一种针对 ICS 中的入侵响应的决策方法。它旨在及时确定针对攻击的最佳安全策略，尝试保护最“危险”的攻击路径并响应功能故障。在这种方法中，通过对攻击传播的深入分析来设计涵盖网络和物理领域的措施。它们确保候选安全策略空间的完整性。通过多目标优化从策略空间确定多个帕累托最优解。其目标是使安全利益、制度利益、国家利益构成的目标向量最大化。然后，使用基于距离的评估方法对这些解决方案进行优先级排序，该方法通过使所选策略的目标向量最接近理想向量来追求最优保护能力。通过模拟过程控制系统的案例研究证明了所提出方法的有效性。