Threat Analysis in Systems-of-Systems

Cyber-physical Systems of Systems (SoSs) are large-scale systems made of independent and autonomous cyber-physical Constituent Systems (CSs) which may interoperate to achieve high-level goals also with the intervention of humans. Providing security in such SoSs means, among other features, forecasting and anticipating evolving SoS functionalities, ultimately identifying possible detrimental phenomena that may result from the interactions of CSs and humans. Such phenomena, usually called emergent phenomena , are often complex and difficult to capture: the first appearance of an emergent phenomenon in a cyber-physical SoS is often a surprise to the observers. Adequate support to understand emergent phenomena will assist in reducing both the likelihood of design or operational flaws, and the time needed to analyze the relations amongst the CSs, which always has a key economic significance. This article presents a threat analysis methodology and a supporting tool aimed at (i) identifying (emerging) threats in evolving SoSs, (ii) reducing the cognitive load required to understand an SoS and the relations among CSs, and (iii) facilitating SoS risk management by proposing mitigation strategies for SoS administrators. The proposed methodology, as well as the tool, is empirically validated on Smart Grid case studies by submitting questionnaires to a user base composed of 3 stakeholders and 18 BSc and MSc students.

A Novel Biobjective Risk-Based Model for Stochastic Air Traffic Network Flow Optimization Problem

Network-wide air traffic flow management (ATFM) is an effective way to alleviate demand-capacity imbalances globally and thereafter reduce airspace congestion and flight delays. The conventional ATFM models assume the capacities of airports or airspace sectors are all predetermined. However, the capacity uncertainties due to the dynamics of convective weather may make the deterministic ATFM measures impractical. This paper investigates the stochastic air traffic network flow optimization (SATNFO) problem, which is formulated as a weighted biobjective 0-1 integer programming model. In order to evaluate the effect of capacity uncertainties on ATFM, the operational risk is modeled via probabilistic risk assessment and introduced as an extra objective in SATNFO problem. Computation experiments using real-world air traffic network data associated with simulated weather data show that presented model has far less constraints compared to stochastic model with nonanticipative constraints, which means our proposed model reduces the computation complexity.

ON MONOTONIC SUFFICIENT CONDITIONS OF FUZZY INFERENCE SYSTEMS AND THEIR APPLICATIONS

An important and difficult issue in designing a Fuzzy Inference System (FIS) is the specification of fuzzy sets and fuzzy rules. In this paper, two useful qualitative properties of the FIS model, i.e., the monotonicity and sub-additivity properties, are studied. The monotonic sufficient conditions of the FIS model with Gaussian membership functions are further analyzed. The aim is to incorporate the sufficient conditions into the FIS modeling process, which serves as a simple (which can be easily understood by domain users), easy-to-use (which can be easily applied to or can be a part of the FIS model), and yet reliable (which has a sound mathematical foundation) method to preserve the monotonicity property of the FIS model. Another aim of this paper is to demonstrate how these additional qualitative information can be exploited and extended to be part of the FIS designing procedure (i.e., for fuzzy sets and fuzzy rules design) via the sufficient conditions (which act as a set of useful governing equations for designing the FIS model). The proposed approach is able to avoid the "trial and error" procedure in obtaining a monotonic FIS model. To assess the applicability of the proposed approach, two practical problems are examined. The first is an FIS-based model for water level control, while the second is an FIS-based Risk Priority Number (RPN) model in Failure Mode and Effect Analysis (FMEA). To further illustrate the importance of the sufficient conditions as the governing equations, an analysis on the consequences of violating the sufficient conditions of the FIS-based RPN model is presented.