Using Causal Inference to Extract Hidden Information from Dependency Modelling

Abstract: Dependency Modelling is an established Probabilistic Risk Analysis method that is frequently used to identify and quantify cyber risks in complex environments, such as Industrial Control Systems. The method is useful for examining the interrelationships between different variables, but the limited data exposure in the modelling restricts its ability to analyse multiple independent variables simultaneously or sequentially. In response to this limitation, we present a new technique that leverages the Bayesian Network method to draw inferences from unrelated events and uncovers hidden insights that Dependency Modelling may overlook. We conducted an evaluation of our proposed technique using lab-generated data that mimics Colonial pipeline operations. Our results demonstrated that the proposed technique exposes previously undetected aspects of the dependency model, providing business and asset owners with a more comprehensive understanding of their cyber risks and facilitating better decision making. Our technique represents a significant advancement and is the first to apply this inference method to Dependency Modelling.