Implemented paper

Critical Infrastructure Risk Assessment Using Markov Chain Model
Andrzej Karbowski, Krzysztof Malinowski, Sebastian Szwaczyk, and Przemysław Jaskóła Research and Academic Computer Network (NASK), Warsaw, Poland
https://doi.org/10.26636/jtit.2019.130819

Project description

Lets assume we have a digital clinic with 2 types of services: cloud networks used by the digital clinic and IT infrastructure set on a server supporting cloud services in heavier times, connected to electric network.
We are considering a matrix of interdependent probabilities related to changing states of system’s security depending on formerly occuring states (as in the paper let’s consider 2 states: normal (0), and distorted/unusable (1))

Let’s assume that local server security is not dependent upon cloud and that the cloud security has to do with increased probabilty of a breach if the server is not secure: (I am omitting parameter m(k) representing impact of exogenous factors). Let us also assume a constant time interval of one day


Considered states (i) in rows
Probable next states (j) in columns

State of one of 2 services (index r) in each of k iterations for 2 (index n) possible states is defined as S_r_n

There are four possible states of the system:

State (1): S_1_0 S_2_0
State (2): S_1_0 S_2_1
State (3): S_1_1 S_2_0
State (4): S_1_1 S_2_1


The matrix P representing static conditional probabilities of transitions between all possible pairs of states:

(rows refer to considered state, columns divide the probabilites of transitions to other states - as we can note the values from one row sum up to 1)

1 2 3 4
1 0.9 0,1 0 0
2 0.2 0.6 0.2 0
3 0 0.2 0.6 0.2
4 0 0.1 0.3 0.6


Vector of initial input probabilites: π(0) (we are assuming that the system is in state 0)

  1. 0.9
  2. 0,1
  3. 0
  4. 0


When configuring the model, the user enters the number of iterations (stages).
The transition matrix P and the vector of initial input probabilities are preassumed in the computations.
Risk index is a function defined as an expected value of the cost associated with the system being in certain state
In this case let’s assume a unit cost associated with S_1_1 (the medical service being distorted/unusable), so that the risk function in each day will amount to the expected cost of this day (unit cost multiplied by respective probabilites of experiencing unfortunate states) 

#function calculating respective probabilites of transitions and the value of risk depending on the number of states (k)
#returning a dataframe[1] and value of risk function[2]

markov_risk <- function(k) {

trans_matrix <- matrix(data = c(0.9,  0.1,   0,    0,
                                0.2,  0.6,  0.2,   0,
                                 0,   0.2,  0.6,  0.2,
                                 0,   0.1,  0.3,  0.6) , nrow=4, ncol=4)

#initial state
state_of_the_system <- c(0.9, 0.1, 0, 0)

results <- matrix(data=NA, nrow=0, ncol=4)
results <- rbind(results, state_of_the_system)

risk <- list()
risk <- append(risk, (state_of_the_system[2]+state_of_the_system[4]))

m <- k
for (i in seq(1,m-1)) {
  #recalculating probabilities for each iteration (each day)
  state_of_the_system <- state_of_the_system %*% t(trans_matrix)
  
  #appending results to data frame row by row
  results <- rbind(results, state_of_the_system)
  
  #calculating risk for each iteration and appending it to a list (assuming unit cost of state 3 and 4)
  risk <- append(risk, (state_of_the_system[3]+state_of_the_system[4]))
}

results <- as.data.frame(results)
colnames(results) <- c("P_S1","P_S2","P_S3","P_S4")
to_return <- list(results, risk)
  
return(to_return) 
}
#now let's plot the time series pf probabilities of different states of the Markov chain for 10 days and calculate
#respective risk function

data <- markov_risk(10)[[1]]
risk <- markov_risk(10)[[2]]

plot(                             
     data$P_S1,
     type = "b",
     col = 2,
     xlim =c(1, 10),
     ylim = c(0, 1),
     xlab = "Day",
     ylab = "Probability",
     main = "Probabilities of four states of the system in each iteration")
lines(data$P_S2,                              
      type = "b",
      col = 3)
lines(data$P_S3,
      type = "b",
      col = 4)
lines(data$P_S4,
      type = "b",
      col = 5)
legend("topright",                           
       c("P_S1", "P_S2", "P_S3", "P_S4"),
       lty = 1,
       col = 2:5)


As we may observe the probability of the system remaining in the normal state decreases with time, while the cost-generating states 3 and 4 become more and more probable. This is mostly due to the way the transition matrix is constructed: the probability of coming back to state one becomes lower and lower if the system is in the more insecure conditions.

#plotting risk function

plot(unlist(risk),
     type = "b",
     col = 2,
     xlim =c(1, 10),
     ylim = c(0, 1),
     xlab = "Day",
     ylab = "Risk",
     main = "Risk as a function of time")
legend("topright",                           
       c("Risk"),
       lty = 1,
       col = 2:5)


As we may further observe, the risk increases with time and so does the system insecurity, which is a direct consequence of the way transition matrix was built.