AWARE-RG provides tailored cybersecurity explanations for physical systems
AWARE-RG: Abstraction Aware Explanation of Resiliency Graphs for Cyber Physical Systems
Cryptography and SecurityArtificial Intelligence
Summary
Cyber physical systems, like industrial control setups, combine computers and physical machines, and securing them needs understanding both parts together. Security experts often only see part of the whole system, which can lead to wrong conclusions about attack risks and defenses. The authors designed AWARE-RG, a tool that gives clear, role-specific explanations about how attacks might lead to physical harm and how to fix or block these paths. It breaks down complex security scenarios using known cyber attack steps and suggests practical strategies to improve system resilience.
What this means in practice
- •For cybersecurity analysts: Explain attack paths in critical infrastructure with role-specific detail to improve assessment of physical risks and defense planning.
- •For industrial control engineers: Identify and understand dependencies that connect cyber attacks to physical failures, aiding targeted system hardening.
Authors
Shadaab Kawnain Bashir, Rakesh Podder, Philip D. Hopkins, Sarath Sreedharan, Indrakshi Ray, Indrajit Ray
Abstract
Understanding the security posture of cyber physical systems (CPS) requires reasoning across both information technology (IT) and operational technology (OT). However, a security analyst often holds an incomplete, role-specific view of the underlying system which has most likely resulted from their knowledge limited by a need-to-know framework. Such an incomplete view can potentially lead them to incorrectly assess if a cyber attack produces an untoward physical consequence resulting in making uninformed decisions about system resilience. In this work, we present AWARE-RG (Abstraction Aware Explanation of Resiliency Graphs), a semi-automated, human-in-the-loop framework that provides an analyst with a role-bounded, need-to-know explanations of resiliency paths in a CPS. The AWARE-RG abstraction structure is derived using Formal Concept Analysis over MITRE ATT&CK for ICS tactics, ordered by the ICS Cyber Kill Chain. For valid attack-fault queries, plan repair and backward means-end analysis identify the missing dependencies, explain why the physical hazard is reachable, and suggest defensive strategies. For invalid attack-fault queries, AWARE-RG localizes the first abstraction level at which the path fails, and reports confirmed blocking conditions as hardening pointers.