Generating resilience curves in availability and integrity through cyberattack modeling using timed colored Petri nets

Improving cybersecurity in Industrial Control Systems (ICS) is a pressing issue due to the rapid increase in cyberattacks. Although risk assessment is an effective approach to identify risks in ICS, the impact of cyberattacks on complex ICS operations is challenging to evaluate. To overcome this challenge, this research proposes a modeling method using timed colored Petri nets to generate resilience curves that trace system performance from the onset of a cyberattack until recovery from both availability and integrity points of view. The proposed method particularly involves multi-layered state transitions, which can correlate the data flow of business processes to attackers' and defenders' behaviors aligned with common cybersecurity frameworks. We also build a testbed and validate the model by comparing experimental and simulation results. Finally, we describe the industrial application of the proposed method by focusing on a use case of a simulation platform, Security Digital Twin.