A data-driven security quantification framework for IoT-based systems
2026-06-15 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors developed a new method to assess cybersecurity risks in Internet of Things (IoT) systems using real data instead of just expert guesses. They combined system design models (SysML) with attack trees that show possible hacking paths and used a scoring system (EPSS) to assign chances of each attack step working. By turning these attack trees into Bayesian Networks, their method can calculate how likely system breaches are and which vulnerabilities are most critical. This helps prioritize fixes in complex IoT settings more accurately and reliably.
Internet of ThingsCybersecurityAttack Tree AnalysisModel-Based Systems EngineeringSysMLExploit Prediction Scoring SystemBayesian NetworkVulnerability AssessmentProbabilistic Risk Assessment
Authors
Alhassan Abdulhamid, Sohag Kabir, Ibrahim Ghafir, Ci Lei
Abstract
The Internet of Things (IoT) is integral to modern cyber-physical systems. Quantitative cybersecurity assessment in IoT environments remains challenging due to heterogeneous system architectures, evolving threat landscapes, and the limited availability of reliable probabilistic exploitability data. Although Attack Tree Analysis (ATA) provides a structured framework for modelling potential attack paths leading to system compromise, conventional ATA quantification often relies on subjective expert judgement or heuristic scoring schemes, which can introduce uncertainty and reduce analytical reproducibility. This study introduces a data-driven probabilistic security framework for IoT-based safety-critical systems by integrating Model-Based Systems Engineering (MBSE), ATA, and empirical vulnerability data. In the proposed framework, SysML models capture system architecture, from which attack trees are derived. Vulnerabilities are mapped as Basic Attack Steps and assigned exploitation probabilities using the Exploit Prediction Scoring System (EPSS). The attack tree is then represented as a Bayesian Network, enabling probabilistic reasoning, diagnostic inference, and vulnerability criticality analysis. The framework quantifies system compromise probabilities, identifies likely causes of attacks, and prioritises mitigation strategies. By combining architecture-driven modelling with real-world vulnerability intelligence, it provides a rigorous, reproducible approach for cybersecurity risk assessment in complex IoT environments.