A probabilistic cost-benefit analysis approach for cyberattack path evaluation

Jinghan Zhang, Enrico Zio, Chiye Ma, Kang Liu and Wei Wang

Reliability Engineering and System Safety, 2025, vol. 263, issue C

Abstract: Analyzing attacker behavior and exploring attack paths are crucial to design effective cybersecurity protection mechanisms. In this work, we propose a Monte Carlo (MC)-based probabilistic cost-benefit analysis approach to assess cyber vulnerabilities and identify attack paths most likely to be exploited in an industrial control setting. First, we draw an attack graph to represent the potential attack paths that attackers could exploit to compromise the vulnerabilities of a target Industrial Control System (ICS). A cost-benefit analysis is, then, integrated into a graph path algorithm to explore attacker’s decisions for exploiting vulnerabilities, whilst accounting for the dynamic characteristics of the system configuration. A probabilistic risk metric is introduced to measure the uncertainty that derives from the intrinsic technical exploitability of vulnerabilities and attackers’ propensities. For demonstration, we apply the proposed approach to a simplified corporate network in an ICS environment, which is vulnerable to multi-step cyberattacks. We identify the shortest attack paths with the highest probabilities and assess the risk associated to each vulnerable element.

Keywords: Cybersecurity; Attack path analysis; Attack graph; Cost-benefit analysis; Uncertainty; Monte Carlo; Industrial Control System (ICS) (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S0951832025004569
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:reensy:v:263:y:2025:i:c:s0951832025004569

DOI: 10.1016/j.ress.2025.111255

Access Statistics for this article

Reliability Engineering and System Safety is currently edited by Carlos Guedes Soares

More articles in Reliability Engineering and System Safety from Elsevier
Bibliographic data for series maintained by Catherine Liu ().