An Agent-Based Modelling approach to assess risk in Cyber-Physical Systems (CPS).

The classic approach to risk assessment in civil engineering infrastructure (incl. water systems) often takes an incomplete view of the socio-technical system and its cyber-physical extensions, thus confining the ability to properly quantify the level of risk. To tackle this limitation and enhance the water sector’s preparedness, this work proposes the use of Agent-Based Modelling (ABM) to explore and derive alternative routes to quantify risk. ABM approaches carry the capacity to describe systems of complex adaptive nature that characterize behavioural rules (e.g., selection of target), socio-technical systems (e.g., water systems including human stakeholders), and their “real-world” interaction. This work takes advantage of those capabilities, to quantify risks through a generic, case independent approach where the cyber-physical attackers are treated as independent, autonomous agents (e.g. hackers, saboteurs) that follow various behavioural rules to decide on their targets and plan their attacks, and hence interact with an external environment simulating the critical nodes of water critical infrastructure (e.g. storage tanks, pumping stations). The ABM simulations can be used to provide the data sets required to derive probabilities for the cyber-physical events that allow the quantification of the risk in accordance with the classic approach to risk in infrastructure planning and natural hazards.