manuscript No. (will be inserted by the editor)
A data-driven security quantification framework for IoT-based systems Alhassan Abdulhamida , Sohag Kabirb , Ibrahim Ghafirc , Ci Leid
arXiv:2606.16561v1 [cs.CR] 15 Jun 2026
1
School of Computing and Engineering, University of Bradford, Bradford, United Kingdom
Received: date / Accepted: date
Abstract The Internet of Things (IoT) is integral to modern cyber-physical systems. Quantitative cybersecurity assessment in IoT environments remains challenging due to heterogeneous system architectures, evolving threat landscapes, and the limited availability of reliable probabilistic exploitability data. Although Attack Tree Analysis (ATA) provides a structured framework for modelling potential attack paths leading to system compromise, conventional ATA quantification often relies on subjective expert judgement or heuristic scoring schemes, which can introduce uncertainty and reduce analytical reproducibility. This study introduces a datadriven probabilistic security framework for IoT-based safety-critical systems by integrating Model-Based Systems Engineering (MBSE), ATA, and empirical vulnerability data. In the proposed framework, SysML models capture system architecture, from which attack trees are derived. Vulnerabilities are mapped as Basic Attack Steps and assigned exploitation probabilities using the Exploit Prediction Scoring System (EPSS). The attack tree is then represented as a Bayesian Network, enabling probabilistic reasoning, diagnostic inference, and vulnerability criticality analysis. The framework quantifies system compromise probabilities, identifies likely causes of attacks, and prioritises mitigation strategies. By combining architecture-driven modelling with realworld vulnerability intelligence, it provides a rigorous, reproducible approach for cybersecurity risk assessment in complex IoT environments.
a
e-mail: [email protected] e-mail: [email protected] c e-mail: [email protected] d e-mail: [email protected] b
Keywords Internet of Things · Security Quantification · Attack Tree · Exploit Prediction Scoring System
1 Introduction The Internet of Things (IoT) has transformed interactions with the physical world by embedding computational capabilities into everyday objects, enabling communication and coordination over the Internet. Through the integration of computation, communication, and mechatronic technologies, IoT supports real-time monitoring and control of physical systems and processes [2, 45]. This convergence enables intelligent, interconnected systems that enhance automation, responsiveness, and operational efficiency [51, 14]. By bridging digital and physical domains, IoT facilitates sensing, analysis, and control across diverse application areas, including smart homes, industrial automation, healthcare, transportation, agriculture, and defence [54, 59, 26, 16, 43]. Despite these transformative capabilities, the increasing interconnectivity and heterogeneity of IoT systems substantially expand their attack surface. The integration of distributed sensing, wireless communication, edge intelligence, and cloud services introduces complex cyberphysical dependencies that are highly susceptible to cyber threats [67, 55, 25]. As IoT deployments continue to scale in critical infrastructures, cybersecurity becomes a fundamental determinant of system dependability. Dependability in IoT systems refers to the ability of a system to deliver its intended service reliably and securely within a specified timeframe [2]. According to [13], dependability encompasses availability, reliability, integrity, confidentiality, safety, and maintainability. From
2
a cybersecurity perspective, the confidentiality, integrity, and availability (CIA) triad forms the cornerstone of secure system operation. Availability ensures operational continuity, integrity guarantees correctness and consistency of system data, and confidentiality protects sensitive information from unauthorised access [13]. Although significant research has addressed safety and reliability modelling in IoT systems [67, 64, 15, 36, 4,7,9, 3, 57, 6], comparatively less attention has been devoted to rigorous quantitative modelling of cybersecurity attributes within unified dependability frameworks. Given the hybrid cyber-physical nature of IoT systems, cybersecurity analysis must be systematically integrated with safety and reliability considerations to achieve holistic dependability assessment. IoT systems operate through a complex combination of wireless communication, intelligent processing, and cloud computing technologies [5, 55]. While these technologies enable seamless distributed functionality, they also increase exposure to cyber attacks such as remote exploitation, malware propagation, and denial-ofservice attacks [24]. The constrained computational capabilities of many IoT devices, coupled with large-scale distributed deployment, further complicate the implementation of robust security mechanisms [55, 25, 4]. Although security is commonly treated as a nonfunctional property (NFP), incorporating quantifiable cybersecurity assessment during the conceptual design phase remains challenging due to system heterogeneity, multiple attack vectors, and limited device resources [67,44]. Traditional vulnerability assessment approaches frequently rely on qualitative judgement or ordinal scoring schemes, limiting analytical rigour and reproducibility. While proactive security verification during system development is encouraged [32, 67], the absence of objective probabilistic quantification restricts informed risk-based decision-making. Attack Tree Analysis (ATA) provides a structured framework for modelling potential attack paths leading to system compromise [12, 23]. By decomposing a top event (TE), typically representing a system breach, into logical combinations of attack goals and sub-goals, ATA enables estimation of system-level security risk [23]. However, conventional ATA quantification often depends on subjective, cost-based, or expert-derived estimates [12, 23,4], resulting in uncertainty and limited standardisation. Unlike reliability engineering, where empirical failure data are often available, cybersecurity modelling has historically lacked consistent probabilistic exploitability data, leading to variability in risk estimation. Recent advances in vulnerability intelligence have created opportunities for data-driven cybersecurity quan-
tification. Several publicly available vulnerability databases support systematic analysis across cybersecurity domains [32]. Among these, the Exploit Prediction Scoring System (EPSS) provides probabilistic estimates of real-world vulnerability exploitation [34]. EPSS predicts the likelihood that a disclosed vulnerability will be exploited in the wild, generating probabilistic scores ranging from 0% to 100%. The framework leverages Common Vulnerabilities and Exposures (CVE) data, empirical exploit evidence, and community intelligence to compute dynamic exploitability metrics [34, 11, 63, 32]. By incorporating factors such as attack complexity, exploit availability, and prevailing threat conditions [63], EPSS provides an evidence-based measure of vulnerability exploitation probability. Motivated by the need for rigorous and architectureaware cybersecurity quantification, this study proposes a data-driven probabilistic security assessment framework for IoT-based safety-critical systems. The framework integrates Model-Based Systems Engineering (MBSE), attack tree modelling, and empirical exploitability data to quantify the likelihood of system compromise. System architecture is first represented using SysML models, from which attack trees are derived to capture potential attack propagation paths. Identified vulnerabilities are mapped to system components and incorporated as Basic Attack Steps (BAS), with exploitability probabilities assigned using EPSS data. This integration enables objective estimation of the probability of a TE representing system compromise. To further enhance analytical capability, the attack tree structure is mapped to a Bayesian Network representation, enabling probabilistic reasoning beyond deterministic attack tree evaluation. This probabilistic formulation supports diagnostic inference and vulnerability criticality analysis, allowing the identification of vulnerabilities that most significantly contribute to system compromise and enabling prioritisation of mitigation strategies. The proposed framework is domain-agnostic; however, smart agriculture is employed as a representative cyber-physical IoT case study to validate the methodology. In smart agriculture, IoT-based technologies and Unmanned Aerial Vehicles (UAVs) optimise irrigation, pest detection, crop monitoring, and resource management [35]. Integrated sensor networks monitor soil moisture, temperature, humidity, and water levels [19, 28], while deep learning techniques enhance pest and disease detection [62]. UAV-enabled systems support soil analysis and crop damage assessment [47], vertical farming utilises IoT and AI for resource efficiency [37], and precision livestock farming leverages RFID, GPS, and smart geofencing [49]. The operational complexity and
3
cyber-physical interdependencies of such systems make them suitable for validating quantitative cybersecurity assessment approaches. To the best of our knowledge, limited research has combined architecture-driven modelling, empirical vulnerability exploitability data, and probabilistic reasoning within a unified framework for quantifying cybersecurity risk in IoT systems. The specific contributions of this article are as follows: – Development of a data-driven probabilistic framework for cybersecurity risk quantification in IoTbased safety-critical systems, integrating attack tree modelling with vulnerability intelligence within an MBSE context. – Integration of EPSS exploitability probabilities into attack tree structures to enable objective estimation of system-level compromise likelihood based on realworld vulnerability data. – Transformation of the attack tree representation into a Bayesian Network to support probabilistic reasoning, diagnostic inference, and vulnerability criticality analysis for prioritising cybersecurity mitigation strategies. – Demonstration of the proposed framework through a smart agriculture IoT case study, illustrating how vulnerability exploitation can propagate to systemlevel failure in safety-critical cyber-physical environments. The remainder of this paper is organised as follows. Section 2 reviews the relevant background and related work. Section 3 presents the proposed vulnerabilitycentric quantitative modelling approach, and Section 4 demonstrates its application through a smart agriculture case study. Section 5 discusses the results and compares the proposed framework with existing approaches. Finally, Section 6 concludes the paper and outlines future research directions.
2 Background and Related Works This section overviews background concepts and highlights notable studies in threat analysis across other information security domains.
2.1 Cybersecurity Assessment of IoT Systems Cybersecurity assessment of IoT and other internetconnected systems involves the systematic evaluation
of system architectures to identify potential vulnerabilities, attack vectors, and security risks [58]. Such assessment is essential for maintaining system integrity, preventing unauthorised access, and protecting sensitive data and operational functionality from cyber threats [30]. Given the increasing integration of IoT technologies into safety-critical infrastructures, effective security evaluation has become a fundamental requirement for ensuring dependable system operation. Security assessment can be conducted at multiple stages of the system lifecycle, including during conceptual design, system development, and post-deployment operation. Early-stage security analysis is particularly important because vulnerabilities introduced during the design phase may propagate throughout the system and become difficult to mitigate at later stages. Consequently, security analysis methods are increasingly applied during system design to evaluate potential risks and the effectiveness of existing security mechanisms [4, 31]. A comprehensive cybersecurity assessment typically involves identifying potential threats, analysing vulnerabilities, and evaluating the effectiveness of existing security controls. Based on this analysis, appropriate mitigation strategies can be developed, including the implementation of protective mechanisms such as encryption, authentication, access control policies, and network security measures [10]. The effectiveness of such assessments depends largely on the ability to identify and prioritise risks according to their likelihood and potential impact [58]. To support systematic risk identification and evaluation, structured modelling approaches are often employed to represent potential attack scenarios and system vulnerabilities. Among these approaches, threat modelling provides a formal mechanism for analysing how adversaries may exploit system weaknesses and how such attacks could propagate through interconnected components [10]. Consequently, threat modelling techniques have become an important foundation for conducting rigorous cybersecurity analysis of IoT systems. 2.2 Threat Modelling of IoT Systems Threat modelling is a fundamental component of cybersecurity assessment that systematically identifies, analyses, and evaluates potential threats and vulnerabilities within a system architecture [46]. In IoT environments, threat modelling is particularly important due to the distributed nature of devices, heterogeneous communication protocols, and complex interactions between physical and digital components. These characteristics significantly expand the potential attack surface and
4
vulnerabilities often arise from complex interactions beintroduce multiple pathways through which adversaries tween hardware, software, communication networks, and may compromise system functionality. control processes. Integrating security analysis techniques Threat modelling typically involves analysing the within MBSE environments allows potential threats and architecture, operational processes, communication provulnerabilities to be systematically identified and analtocols, and functional interactions of the system under ysed at the architectural level. consideration. By examining these elements, security analysts can identify potential weaknesses that attackResearchers, as reviewed in [27], have explored the ers may exploit and evaluate how such vulnerabilities use of MBSE to support safety and security co-analysis could affect system behaviour [46]. The process often in complex systems, enabling designers to evaluate poconsiders multiple attack scenarios, attacker capabilitential risks during early design stages and maintain ties, and the potential consequences of successful attraceability between system design artefacts and detacks on system integrity, availability, and confidentialpendability assessments. By linking threat modelling ity [39]. techniques with system models, MBSE facilitates structured reasoning about how vulnerabilities in individThe primary objective of threat modelling is to proual components may propagate through the system and vide a structured understanding of cybersecurity risks lead to higher-level failures. in order to support the development of effective security policies and mitigation strategies. By identifying vulWithin this context, ATA provides a suitable fornerabilities and possible attack paths early in the sysmalism for representing adversarial attack paths and tem lifecycle, proactive measures can be implemented analysing how system vulnerabilities may contribute to to reduce the likelihood and impact of cyber attacks. security breaches. When integrated with system architecture models, ATA enables systematic identification Several threat modelling frameworks have been proposed to support systematic security analysis. One widely of attack scenarios and supports quantitative evaluation of cybersecurity risks in complex IoT environments. used approach is the STRIDE model, which categorises threats into six classes: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege [39]. Such frameworks provide 2.4 Attack Tree Analysis Model structured guidance for identifying potential security threats and evaluating their potential impact. Attack Tree Analysis (ATA) is a graphical security modTo further analyse how identified threats may propelling technique originally introduced by Bruce Schneier agate through a system and lead to compromise, formal to systematically analyse potential attack scenarios against modelling techniques are often employed. Among these a system [20]. The method represents how an adversary techniques, Attack Tree Analysis provides a structured may achieve a malicious objective by decomposing the representation of attack paths and has been widely adopted attack goal into smaller sub-goals and basic attack steps for security risk modelling in complex systems. [12, 48, 61, 65]. By structuring potential attack paths in a hierarchical form, ATA enables the identification of system vulnerabilities and the analysis of possible attack strategies that could lead to system compromise 2.3 Model-Based Systems Engineering for Security [18]. Analysis In an attack tree, the root node represents the atModel-Based Systems Engineering (MBSE) has emerged tacker’s primary objective, commonly referred to as the TE. The TE typically denotes a successful system comas a systematic approach for managing the complexity promise or security-induced failure. This objective is of modern cyber-physical systems by representing sysdecomposed into intermediate events (IEs), which reptem architectures, behaviours, and interactions using resent attack goals or sub-goals, and Basic Attack Steps formal models rather than traditional document-based (BASs), which correspond to atomic adversarial actions specifications. By providing structured representations required to achieve these goals [60, 66]. BASs represent of system components and their relationships, MBSE the lowest level of the hierarchy and are often associated facilitates early-stage analysis, traceability, and verifiwith specific vulnerabilities or exploit actions within the cation throughout the system lifecycle. system. In the context of IoT and other distributed cyberLogical relationships between nodes are represented physical systems, MBSE enables comprehensive modusing gate symbols, typically AND and OR gates. An elling of heterogeneous components, communication inAND gate indicates that all child events must occur terfaces, and operational dependencies. These capabilifor the parent event to be activated, whereas an OR ties are particularly valuable for security analysis, where
5 Table 1 Description of events and gates in an attack tree model
Legend TE (Security Compromise)
TE ATG/S-ATG BAS
OR Gate
Security-induced failure of the system Attack and sub-attack goals The atomic attack steps are represented as vulnerability nodes
Attack Goal 1
AND Gate
Transfer In Transfer Out
Sub-Attack Goal 3
Sub-Attack Goal 1
Sub-Attack Goal 5
BAS1
Sub-Attack Goal 4
Sub-Attack Goal 2 BAS5
1
Description
TE IEs BASs
Attack Goal 2
AND Gate
Events/Gates
BAS2
BAS6
BAS7
BAS8
BAS4
Fig. 1 An example attack tree
gate indicates that the occurrence of any child event is sufficient to activate the parent node. These logical structures capture the dependencies among attack steps and enable systematic reasoning about how different attack paths may lead to system compromise. Figure 1 illustrates a representative attack tree structure, while Table 1 summarises the meaning of the nodes and gate symbols used in the model. Quantitative ATA enables estimation of the likelihood of system compromise by assigning attribute values to BAS nodes [17, 12, 48, 38]. These values are propagated through the tree using the logical relationships defined by the gates to compute the probability of the TE. Through this process, ATA supports the identification of critical attack paths and provides insights into the vulnerabilities that most significantly contribute to system-level security risk. Due to its intuitive representation and analytical capabilities, ATA has been widely applied in information security, industrial control systems, and critical infrastructure protection [17, 12, 48, 61, 65]. However, in many practical applications the probabilistic values assigned to BAS nodes rely heavily on expert judgement or qualitative scoring schemes, which may introduce subjectivity and uncertainty in the resulting risk assessment.
2.5 Exploit Prediction Scoring System The Exploit Prediction Scoring System (EPSS) is a data-driven framework introduced by the Forum of Incident Response and Security Teams (FIRST) to estimate the likelihood that a disclosed software vulnera-
OR Gate
All inputs must happen for a successful attack At least one input will cause a successful attack
bility will be exploited in the wild [33]. Unlike traditional vulnerability scoring approaches that primarily assess severity, EPSS focuses on predicting real-world exploitation probability, thereby supporting more informed vulnerability prioritisation and remediation decisions. EPSS employs statistical modelling and machine learning techniques to analyse historical exploitation data and vulnerability characteristics in order to estimate the probability that a specific vulnerability will be exploited within a given time horizon [33]. The framework integrates information from multiple sources, including publicly disclosed vulnerability records, exploit databases, security advisories, and threat intelligence reports [33]. By analysing patterns in past exploitation behaviour, EPSS generates probabilistic scores ranging from 0 to 1 that indicate the likelihood of real-world exploitation. Although EPSS was inspired by the Common Vulnerability Scoring System (CVSS), the two frameworks serve different purposes. CVSS primarily evaluates the technical severity of vulnerabilities, whereas EPSS estimates their probability of exploitation. Consequently, EPSS provides complementary information that can support more effective vulnerability prioritisation and risk assessment [32]. Because EPSS provides regularly updated probabilistic exploitability estimates derived from empirical data, it offers a valuable resource for quantitative cybersecurity modelling. In particular, EPSS probabilities can be integrated into security analysis frameworks to assign objective likelihood values to vulnerabilities, thereby reducing reliance on subjective expert judgement. This capability makes EPSS particularly suitable for supporting data-driven cybersecurity assessment of complex IoT-based systems. 2.6 Related Works The rapid adoption of IoT and UAV technologies has enabled significant advancements in applications such
6
as precision agriculture, environmental monitoring, and industrial automation. In smart agriculture in particular, IoT-based sensing and UAV-assisted monitoring have been widely employed to support crop management, irrigation control, and disease detection [47, 35, 19,28]. Despite these benefits, the increasing reliance on interconnected IoT infrastructures introduces significant cybersecurity and dependability challenges. Failures or malicious exploitation of sensor-based IoT devices may lead to severe operational disruptions, environmental damage, and reduced agricultural productivity. Such risks highlight the importance of incorporating robust security and dependability assessment mechanisms into IoT-based systems [2, 4]. The resource-constrained and distributed nature of IoT networks further complicates the implementation of effective security mechanisms. Limited computational capabilities, heterogeneous communication protocols, and large-scale device deployment create a broad attack surface that can be exploited by adversaries [29, 67]. Consequently, numerous studies have investigated security challenges in IoT environments and proposed mechanisms for mitigating potential risks [29, 42, 41, 50]. Several works have explored quantitative dependability and security modelling techniques for IoT infrastructures. For example, Nguyen et al. [53] proposed a hierarchical Fault Tree Analysis (FTA) framework to evaluate reliability and cybersecurity risks in Internetof-Medical Things (IoMT) infrastructures by modelling multiple failure modes, including cyber attacks on software subsystems. Similarly, Nguyen et al. [52] developed a quantitative modelling framework combining Reliability Block Diagrams (RBD), Fault Trees (FT), and Continuous-Time Markov Chains (CTMC) to analyse the availability and security of IoT infrastructures. Within the cybersecurity domain, Attack Tree Analysis has been widely adopted for modelling adversarial behaviour and analysing attack paths. Foundational studies by Asif et al. [12], Mauw et al. [48], Ten et al. [65], Saini et al. [61], and Roy et al. [60] introduced various extensions of the ATA framework, including quantitative attack trees, Attack Countermeasure Trees (ACTs), and Quantitative Attack-Defence Trees (QADT). These approaches enable structured modelling of adversarial strategies and provide mechanisms for analysing potential attack paths in cyber-physical and industrial control systems. Asif et al. [12] developed an attack tree model incorporating attacker motivation, computational resources, and attack attributes to estimate attack risk probabilities. Mauw et al. [48] established theoretical foundations for quantitative attack tree modelling and proposed methods for analysing attack attributes within
the tree structure. Ten et al. [65] applied ATA models to evaluate vulnerabilities in Supervisory Control and Data Acquisition (SCADA) systems, demonstrating their usefulness in identifying potential break-in points and security weaknesses. Saini et al. [61] proposed a versatile ATA-based threat modelling framework for analysing cyber threats and strengthening security mechanisms. Roy et al. [60] introduced ACTs to represent both attack and defence mechanisms within the modelling framework. Other works, such as Kumar et al. [40] and Foster et al. [22], utilised ATA models to evaluate attack paths and estimate the resources required for successful attacks using expert-derived parameters. More recently, Abdulhamid et al. [8] incorporated fuzzy set theory and expert judgement within ATA models to estimate attack probabilities and system failure risks. Although these approaches provide valuable insights into cyber threat modelling, many rely on subjective estimations or expert judgement when assigning probability values to attack events. Such subjective quantification can introduce uncertainty and limit reproducibility in cybersecurity risk assessment. Alternative approaches have attempted to incorporate vulnerability severity metrics into probabilistic models. For instance, Flores et al. [21] proposed a Bayesian Network model that utilises vulnerability severity scores from the CVSS to analyse the security of IoT-based smart homes. While the approach considers attack scenarios such as Denial-of-Service and man-in-the-middle attacks, reliance on severity-based metrics alone may not accurately reflect the real-world likelihood of vulnerability exploitation. Recent developments in vulnerability intelligence, particularly the EPSS, provide probabilistic estimates of real-world exploitability based on empirical evidence [32]. These exploitability scores offer an opportunity to support objective and data-driven cybersecurity modelling by assigning evidence-based probabilities to vulnerabilities. Motivated by these limitations, this study integrates EPSS exploitability probabilities within an Attack Tree Analysis framework to enable data-driven quantification of cybersecurity risks in IoT systems. In the proposed approach, identified vulnerabilities are mapped to BASs within the attack tree structure, and EPSSderived probabilities are used to quantify the likelihood of successful exploitation. This enables systematic estimation of system-level compromise probability while reducing reliance on subjective probability assignment.
7
3 Methodology: EPSS-Integrated Quantitative Attack Analysis Framework 3.1 Overview of the Framework This study proposes a structured methodology for quantitative cybersecurity risk assessment that integrates MBSE, ATA, empirical vulnerability exploitability data, and Bayesian inference within a unified analytical framework. The approach transforms an architectural system model into analysable security artefacts, enabling systematic estimation of system-level compromise probabilities. In particular, the framework derives attack tree models from system architecture representations and subsequently transforms them into a BN, supporting both deterministic evaluation and probabilistic inferencebased cybersecurity analysis. The MBSE-based attack tree generation builds upon our previous work [7], which focused on modelling system reliability under random component and communication failures. In that work, failure behaviour was represented using exponentially distributed component failure probabilities and cyber attacks were not considered. The current study extends this modelling approach by explicitly incorporating cybersecurity threats into the analysis. Unlike random hardware failures, cyber attacks cannot be realistically characterised using exponential failure distributions. Therefore, this work integrates empirically derived exploitability probabilities obtained from the EPSS, enabling data-driven quantification of vulnerability exploitation likelihood. The overall methodological pipeline, illustrated in Figure 2, consists of six main stages: (i) system behaviour modelling within an MBSE environment; (ii) transformation of behavioural models into componentlevel attack trees; (iii) synthesis of a system-level attack tree using architectural connectivity; (iv) assignment of empirical exploitability probabilities derived from EPSS; (v) quantitative propagation of probabilities through Boolean logic gates to estimate system compromise likelihood; and (vi) transformation of the attack tree into a Bayesian Network to enable probabilistic inference and vulnerability criticality analysis. The formal computational procedure corresponding to this workflow is summarised in Algorithm 1. By combining architectural modelling with empirical vulnerability intelligence, the proposed framework reduces the reliance on subjective probability assignment commonly found in traditional attack tree quantification approaches. This integration enables a more objective estimation of system-level breach probabilities and supports the identification and prioritisation of critical vulnerabilities for cybersecurity mitigation.
3.1.1 Methodological Assumptions The proposed framework relies on several modelling assumptions to enable quantitative cybersecurity analysis: – Vulnerabilities identified in the system architecture are represented as BASs in the attack tree structure. – EPSS exploitability scores are treated as probabilistic estimates of successful vulnerability exploitation and are used as likelihood values for corresponding BAS nodes. – Attack events represented in the attack tree are assumed to be conditionally independent unless explicitly linked through logical gate structures. – Successful exploitation of a vulnerability is assumed to result in the compromise or failure of the associated system component within the attack model. These assumptions enable the systematic integration of architectural modelling, vulnerability intelligence, and probabilistic reasoning within the proposed cybersecurity quantification framework. The individual stages of the framework are detailed in the following subsections. Algorithm 1 EPSS-Integrated MBSE Attack Quantification Require: SysML model M , EPSS dataset Ensure: P r(T E), vulnerability ranking 1: Extract components from BDD 2: Extract connectivity from IBD 3: Extract failure states from SMD 4: for each component Ci do 5: Generate component attack tree 6: end for 7: Integrate into system attack tree (SAT) 8: Assign EPSS probabilities to BASs 9: Compute P r(T E) via Boolean propagation 10: Transform SAT to Bayesian Network 11: Perform BN Inference and Compute Birnbaum Importance for each BAS 12: Return P r(T E) and vulnerability ranking
3.2 Behaviour Modelling of the IoT System The behaviour modelling stage uses SysML to formally represent the IoT system architecture, extending the approach of [7] by incorporating cyber threat considerations. Both structural and behavioural aspects are captured to support subsequent attack tree generation.
8
MBSE-Based System Structure and Behaviour Modelling
Component-Level Attack Tree Construction
System-Level Attack Tree Synthesis
EPSS-Based Probability Assignment to Basic Attack Steps
Attack Tree Transformation into a Bayesian Network
Boolean Logic-Based Quantitative Analysis
Bayesian Inference and Criticality Analysis
Fig. 2 Steps of the Proposed Framework
3.2.1 Static Structure Modelling
3.2.2 Internal Structure Modelling
The static configuration of the system is represented using SysML Block Definition Diagrams (BDDs), which represent the hierarchical decomposition of the system into hardware and software components. The BDD defines associations, generalisations, dependencies, aggregations, and inheritance relationships, thereby establishing a formal architectural taxonomy. While [7] focused solely on reliability-relevant components, the current framework also identifies components susceptible to cyber compromise, ensuring that potential attack surfaces are represented at the architectural level. Formally, the IoT system is represented as:
Internal structure modelling is conducted using Internal Block Diagram (IBD). The IBD specifies component instances, ports, connectors, and data flows, thereby illustrating how system elements interact and exchange information. Modelling internal interactions is critical for IoT systems, where communication pathways and interdependencies significantly influence attack propagation. The connectivity extracted from the IBD later determines the logical gate configuration when synthesising the system-level attack tree. The inclusion of potential attack paths differentiates this work from [7], providing the basis for attack tree synthesis at both component and system levels.
S = {C1 , C2 , · · · , Cn } 3.2.3 Nominal and Failure Behaviour Modelling where each component Ci may contain multiple vulnerabilityrelevant states or attack vectors as: Nominal and failure behaviours are modelled using State Machine Diagrams (SMDs). Each component’s operational logic is represented as a finite state transition Ci = {vi1 , vi2 , · · · , vim } system, where nominal states correspond to functional behaviour and failure or compromised states are dewhere vij represents exploitable vulnerabilities or rived using a lightweight extension of the SysML metaattack-relevant failure modes. model through DAM stereotypes (DaStep) that support the explicit representation of attack-induced failure beThis architectural abstraction provides the struchaviours. tural basis for modular attack tree generation.
9
These annotated failure states represent potential BASs in the generated attack tree. As this article focuses solely on the cyber attack-induced system failures, this ensures that the resulting attack tree encompasses security considerations. The transition logic encoded in the SMD determines whether exploitation paths are conjunctive or disjunctive, thereby influencing subsequent logical gate selection.
upward, and therefore OR gates are employed. In parallel or redundant configurations, AND gates represent the requirement for simultaneous compromise. By integrating attack paths, the SAT provides a holistic view of system vulnerability. Compared to [7], this stage introduces cyber threats as additional top-level contributors, enabling security risk assessment. The TE is defined as system-level cybersecurity breach. The resulting hierarchical tree captures propagation of exploitation from leaf-level BAS nodes to the TE.
3.3 Transformation of the MBSE Source Model into Attack Tree Artefacts 3.4 Quantitative Probability Assignment and The transformation process converts the annotated SysML Propagation via Boolean Logic source model into formal attack tree representations suitable for quantitative analysis. A pattern-based trans- For quantitative evaluation, cyber attack-induced component failures are treated with EPSS-based exploit formation approach is adopted to systematically map probabilities. EPSS data provides empirically grounded behavioural elements to attack tree constructs. probabilities for cyber attack success, reflecting realThis transformation is executed in two stages: first, component-level attack trees are generated; second, these world threat likelihoods rather than purely theoretical distributions. Boolean propagation is applied across are integrated into a system-level attack tree using arthe attack tree to compute system-level probabilities chitectural connectivity information. of compromise, supporting deterministic evaluation of potential breaches. 3.3.1 Component-Level Attack Tree Generation The TE probability is computed using recursive bottomup propagation. For an OR gate with input events BASi : Each component’s annotated SMD is transformed into a Component Attack Tree (CAT), following the procedure in [7] but extended to include cyber attacks. Failure or compromised states are mapped to BASs, and transitions among these states determine the logical relationships between nodes. Boolean logic gates (AND/OR) define how basic events propagate to component-level compromises. If multiple vulnerabilities independently lead to compromise, they are connected through an OR gate. If multiple conditions must be satisfied jointly, they are connected via an AND gate. This transformation ensures traceability from behavioural modelling artefacts to quantitative attack logic. While [7] assumed exponential failure probabilities for the Basic Events, in this framework, however, each BAS corresponding to a cyber attack is mapped to a Common Vulnerabilities and Exposures CVE entry, and its probability is assigned using the EPSS. Thus, P r(BASi ) = EP SS(CV Ei )
(1)
3.3.2 System-Level Attack Tree Synthesis The overall system attack tree is constructed by integrating component-level attack trees using connectivity information derived from the IBD. Architectural configurations determine gate semantics. In series configurations, compromise of any component may propagate
P rOR = 1 −
N Y
1 − P r(BASi )
(2)
i=1
For an AND gate:
P rAN D =
N Y
P r(BASi )
(3)
i=1
This deterministic gate-by-gate computation yields the system-level breach probability under the independence assumption. 3.5 Bayesian Transformation and Criticality Analysis To enhance analytical flexibility and enable probabilistic reasoning, the attack tree is transformed into a Bayesian Network. During graphical mapping, BASs are mapped to root nodes, intermediate events to intermediate nodes, and the TE to a leaf node. During numerical mapping, EPSS-based probabilities define priors for root nodes, and conditional probability tables are derived from Boolean gate semantics. The BN representation enables posterior inference, predictive risk assessment, and criticality analysis using measures such as the Birnbaum Importance Measure (BIM), identifying which components or attacks
10
contribute most significantly to system risk. The BIM is computed by evaluating the change in TE probability when a BAS is forced to failure versus non-failure. This ranking supports vulnerability prioritisation and design optimisation. This approach extends [7] by integrating data-driven cyber attack probabilities and enabling probabilistic risk reasoning alongside traditional reliability assessment.
4 Case Study: Smart Agriculture IoT System as Demonstrative Validation The smart agriculture IoT system is employed as a demonstrative case study to validate the applicability and scalability of the proposed EPSS-integrated modelbased quantitative attack analysis framework. The objective is not to provide a domain-specific security evaluation of agricultural systems, but rather to demonstrate how an IoT architecture can be systematically transformed from a SysML source model into quantitative cybersecurity analysis artefacts through a structured MBSE-to-ATA-to-BN pipeline. The case study therefore serves as a validation instance of the general framework introduced in Section 3, illustrating how architectural abstraction, behavioural modelling, vulnerability annotation, and empirical exploitability data can be integrated into a unified analytical workflow.
SIS, enabling empirical exploitability-based breach estimation. At a high level, the SIS leverages IoT technologies to enable remote supervision and control of agricultural irrigation processes. The system allows farmers to monitor environmental conditions in real time and make informed irrigation decisions, ensuring that crops receive adequate water while optimising resource utilisation. By integrating distributed sensing, wireless communication, and edge/cloud processing, the SIS aims to maximise crop yield, conserve water, and reduce operational costs associated with manual monitoring. Operationally, the system functions as illustrated in Figure 3. Environmental data are collected from the field using two primary sensors: a temperature sensor and a soil moisture sensor. These sensors continuously measure field conditions and transmit the acquired data wirelessly to an IoT gateway (controller). The gateway performs signal conditioning and converts the received analogue signals into digital representations suitable for computational processing. The processed data are then forwarded to an edge cloud server for decision support.
4.1 Case Study System Description The IoT-enabled Smart Irrigation System (SIS) is used as a running case study to demonstrate the applicability of the proposed quantitative cybersecurity modelling framework. The SIS architecture was previously introduced in our earlier studies [56, 9], where the emphasis was placed on qualitative safety assessment and architectural dependability analysis. In contrast, the present work extends that line of research by focusing explicitly on quantitative cybersecurity modelling and securityinduced system failure analysis. As outlined in Section 1, the overall dependability of the SIS encompasses safety, reliability, security, and maintainability. Existing research in the broader dependability domain has predominantly concentrated on safety and reliability modelling [67, 64, 15, 36, 4, 3, 57, 6], leaving a clear methodological gap in the rigorous quantification of cybersecurity risks, particularly for IoTbased smart irrigation infrastructures. This study addresses that gap by applying the proposed MBSE-driven attack tree and Bayesian inference framework to the
Fig. 3 IoT-based smart irrigation environment (adapted from [9])
The edge cloud server incorporates an expert-systembased decision engine that analyses incoming environmental data against predefined irrigation rules. Based on soil moisture thresholds and temperature conditions, the system determines whether irrigation is required and, if so, specifies the duration of water delivery. Once a decision is generated, the information is communicated to the farmer via wireless communication channels. The farmer retains supervisory control and can choose to activate or deactivate the irrigation pump. If activation is selected, a control signal is transmitted back
11
through the communication infrastructure to the edge server, which instructs the IoT gateway to energise the relay controlling the sprinkler system. The sprinkler system is thus actuated to irrigate the field for the specified duration. For the purpose of this analysis, the power supply subsystem is assumed to be uninterrupted, supported by both primary and backup energy sources. From a cybersecurity perspective, the SIS presents multiple potential attack surfaces, including wireless sensor communications, gateway firmware, edge cloud processing, and remote control signalling. These interconnected components make the system an appropriate and representative case study for evaluating the proposed MBSE-based attack tree synthesis and EPSSdriven quantitative breach estimation framework. 4.2 MBSE-Based Transformation for Cybersecurity Analysis The architectural representation of the SIS remains unchanged from our previous work [9], where the system was modelled for safety and reliability assessment. Since the BDD and IBD capture structural composition and inter-component data flow independent of the analysis objective, these artefacts are reused in the present study. The BDD (Figure 4) formally specifies the hierarchical decomposition of the SIS into its functional components and composite blocks, establishing composition relationships and structural dependencies. The IBD (Figure 5) captures the internal configuration of the system, representing ports, connectors, and item flows that define communication paths between sensors, gateway, edge server, control unit, and actuation mechanisms. As attack propagation is inherently dependent on architectural connectivity, the reuse of these diagrams ensures structural consistency while enabling cybersecurity-oriented modelling. Unlike [9], however, the analytical objective in this paper is not safety-induced system failure but securityinduced compromise. Therefore, while the architectural foundation is preserved, the behavioural annotation and transformation logic are extended to incorporate cyber attack scenarios. In [9], failure annotation was performed using SysML SMDs extended with the DAM profile to represent random component failures. Failure states such as “no sensor output” or “power source failure” were triggered by reliability-related events, and transitions were annotated accordingly. In the present study, this modelling approach is extended to represent cyber attack-induced failure be-
haviour. Instead of random failure triggers, state transitions now include cyber compromise events derived from identified vulnerabilities. The DAM stereotype mechanism is retained for consistency; however, failure transitions are reinterpreted to capture malicious exploit activation rather than stochastic hardware failure. To illustrate this extension, a security-annotated SMD is provided in Figure 6 for the moisture sensor component. The nominal operational state represents correct sensing and transmission of soil moisture data. Additional states are introduced to capture attack-induced deviations. Transitions to these states are triggered by exploit events associated with identified vulnerabilities of the sensor firmware or communication interface. Each exploit event is later mapped to an EPSS probability value for quantitative analysis. The same annotation procedure can be systematically applied to other components in the SIS, including the gateway, edge server, and communication links. For brevity, only one representative component is illustrated, as the transformation rules remain uniform across the system. 4.3 Attack Modelling and Vulnerability Quantification 4.3.1 Creation of the Attack Tree Model from System Architecture Following the security-oriented behavioural annotation of the SIS components, the MBSE artefacts are transformed into an Attack Tree (AT) representation. Unlike the fault tree generation in [9], where random component and communication failures were modelled, the present work considers deliberate cyber attacks as causal mechanisms leading to system compromise. The Top Event (TE) of the attack tree is defined as: “Failure of SIS due to deliberate cyber attacks.” The attack tree adopts a hierarchical structure, modelling how adversarial actions propagate through system components to realise this undesired event. The structure of the tree is derived from the architectural dependencies captured in the BDD and IBD models and from the attack-induced states introduced in the security-annotated SMDs. The resulting minimised System-Level Attack Tree (SAT), shown in Figure 7, captures attack paths from vulnerability exploitation at the component level to systemwide irrigation failure. For brevity, intermediate componentlevel attack trees are not presented; however, their construction follows the deterministic SMD-to-attack-tree transformation process described earlier. The figure therefore represents a minimised system-level abstraction suitable for quantitative evaluation.
12
IBD MODEL [SIS]
Smart Relay
P
P
Water Pump
P
P
P
P
P
P
Water Reservoir
P
P
Main power Source P
78
P
P
P
P
P
Temperature Sensor (TS)
P
Moisture Sensor (MS)
P
P
P
P
P
Power Switch
Gateway (Controller)
P
P P
P
Legend
P
P
Secondary power source
p
Port (In/Out)
P
UA
Fig. 5 IBD of the SIS as seen in [9]
Figure (3.16)
P
P
EC System
Internal Block Diagram of SIS
4.3.2 Structuring of Attack Goals
The intermediate nodes of the attack tree are organised according to the classical Confidentiality, Integrity, and Availability (CIA) security objectives. These represent sub-attack goals whose successful realisation may lead to the TE.
Data flow
P
3. DEVELOPMENT OF A MODEL-BASED FRAMEWORK FOR SAFETY AND SECURITY ANALYSIS IN IOT SYSTEMS
Fig. 4 BDD of the SIS as seen in [9]
– Confidentiality compromise includes unauthorised access, authentication bypass, and information disclosure. – Integrity compromise includes code injection, command execution, privilege escalation, and manipulation of sensor or control data. – Availability compromise includes denial-of-service (DoS) conditions and communication disruption.
3. DEVELOPMENT OF A MODEL-BASED FRAMEWORK FOR SAFETY AND SECURITY ANALYSIS IN IOT SYSTEMS 13
MoistureSensorSM DAM Profile <<DAStep>>
SMD Metamodel [Nominal State]
SMD Extended State[Compromised/Error State] <<DaStep>>
<<DaStep>> PropertyName=attack
PropertyName=attac
Capture Moisture Measurement
T1:[DoS (CVE-2014-2360)] /activity: SendDataLoss()
<<DaStep>> PropertyName=compromised
<<DaStep>>
RCE via malformed packets of MS (MSRCE)
T2:[Spoofing CVE-2014-2361] /activity: SendDataError()
Send Moisture Measurement
T3:[Replay CVE-2014-2379] /activity: SendDataError() T4:[Tampering CVE-2014-2362] /activity: SendDataError()
<<DaStep>> Replay valid readings /false readings of MS (MSRTA)
<<DaStep>> MS data compromised(CMSD)
Gateway/controller SM Model Fig. 6 Attack-induced failure behaviour annotation with an SMD
DAM Profile <<DAStep>> SMDof Extended State[Compromised/Error Failure SIS due Cyber-Security Attack State]
SMD Metamodel [Nominal State]
<<DaStep>> OR PropertyName=attack
<<DaStep>>
<<DaStep>>
PropertyName=compromise PropertyName=attack T2: Stack RCE [CVE-2020-16898] <<DaStep>> Accept Data Attack against SIS'sSendDataError() Denial/Disruption /activity: Data Integrity Attack Compromised Confidentiality of Service from firmware leading to T1:[Firmware (TS/MS) remote execution OR OR [CVE-2014-2360] AND tampering (FREC) /activity: SendDataError() <<DaStep>> Handle <<DaStep>> T3:[Privilege escalation / Compromised SG Unauthorised Exploiting of wireless Exploiting Input Memory exhaustion via Decision Privilege RCE via malformed kernel Side exploit Channel data (CSGD) Access Validation Flaws Crafted TAR Archive Data Escalation packets leading Communication DoS of (CVE-2021-22555)] CVECVECVESG (SGDoS) /activity: SendDataLoss() OR
AND
OR
T4:[DoS (CVE-2021-35517)] Send/receive /activity: SendDataLoss() Data to/from Information Creating Predicting Projection EC Man in the Disclosure OR
Authentication Bypass CVE202015506
to/from SG (SG-WC DoS) Hard Links Creation Times Middle T5:[Spoofing CVE-2014-2361] CVECVE/activity: SendDataError() Shell Injection Exploiting Battery AND 20042768
20142362
Voltage Reporting
CVESend T6:[Replay CVE-2014-2379]2014Actuation Unauthorised Replay Exploiting Wireless 2360 Access Command Transmission SendDataError() Communication /activity: CVE20188360
20190701
2014Code 2361 Injection CVECVE<<DaStep>> 2004- 2021OR DoS22555 via wireless medium 2768
CVE- CVE-2014-2362] CVE-T7:[Tampering 2014- SendDataError() 2014/activity: 2379 2361
SQL Injection
CodeExecution
CVECVE<<DaStep>> 20192019Replay valid readings 17059 9568
202135517
Remote Code Execution CVE202016898
/false readings of SG (SGRTA)
CloudEdgeSM Model
Fig. 7 Attack tree of the IoT-based smart irrigation environment SM Metamodel [Nominal State]
DAM Profile <<DAStep>> SM Extended State[Failure/Error State]
This structuring ensures that the attack tree reflects <<DaStep>> identified vulnerability to compromise the system. By <<DaStep>> PropertyName=attack not only architectural dependencies but also security setaking into account factors such as attack complexity, PropertyName=compromised mantics aligned with recognised threat modelling prinlikelihood of discovery, potential impact, and current T1:[Multi-tenant ID CVE-2018-8360)] Received <<DaStep>> /activity: SendDataLoss() Data from ciples. landscape, numerical insights of EPSS can be Leak threat credentials/config T2:[DoS (CVE-2014-2360)] SG leading to DoS on EC /activity: SendDataLoss() generated from the CVE <<DaStep>> system [34, 11, 63, 32] (LCDOS) Compromise: T3: [SQL of Edgeselected Cloud / Table 2 summarises the vulnerabilities and <<DaStep>> 4.3.3 Identification of Vulnerabilities as(CVE-2019-9568])] Basic Attack Injection Backend (CEC) Processed Manipulation of cloud /activity: SendDataLoss() their associated EPSS values obtained from the NVD Data Steps (BAS) data or crash critical processes in EC (MCCCPEC) T4:[memory exhaustion/DoS database [1]. Each CVE entry is mapped directly to a (CVE-2021-35517) /activity: SendDataLoss() BAS node in the attack tree. The impact column cateEach leaf node of the attack tree, referred to as a BAS, Send gorises vulnerabilities according to their CIA effect. Actuation T5:[Replay (CVE-2014-2379)] corresponds to a publicly disclosed vulnerability identiCommand /activity: SendDataError() Examples include: fied using the CVE system. These vulnerabilities are selected based on the architectural characteristics of – Authentication bypass and unauthorised acthe SIS components, including sensors, gateway, edge cess (CVE-2020-15506, CVE-2018-8360), enabling Figure (3.21)interfaces, Securityand Behaviour Modelling ofconfidentiality Selected Components server, communication control subsysbreaches. in the SIS Ar98 tems. chitecture – Remote Code Execution (CVE-2020-16898) and Threat identification is performed using the STRIDE Shell Injection (CVE-2019-17059), enabling integrity methodology [39], enabling systematic mapping between compromise through arbitrary command execution. attack types and component-level weaknesses. The anal– SQL Injection (CVE-2019-9568), enabling database ysis assumes that a malicious actor may exploit any manipulation.
14
– Denial-of-Service vulnerabilities (e.g., CVE-20190701, CVE-2021-35517), enabling availability disruption. – Man-in-the-Middle vulnerabilities (CVE-20142379, CVE-2014-2361), enabling communication interception and manipulation. By explicitly mapping CVEs to BAS nodes, the attack tree becomes directly grounded in real-world exploit data rather than hypothetical threat assumptions. 4.3.4 EPSS-Based Quantitative Assignment A key methodological extension over [7] lies in probability modelling. In the previous safety-oriented framework, exponentially distributed failure rates were assigned to basic events to represent stochastic hardware and communication failures. Such assumptions are inappropriate for cyber attacks, as adversarial exploitation does not follow memoryless reliability distributions. In this study, EPSS scores are assigned directly to BAS nodes, representing the empirical probability of vulnerability exploitation within a defined time horizon. EPSS values incorporate real-world exploit data, threat intelligence, and vulnerability characteristics, thereby providing a data-driven and dynamically informed estimate of attack likelihood. Formally, for each BAS BASi corresponding to vulnerability CV Ei , the probability is assigned according to equation (1). These probabilities form the quantitative foundation for subsequent gate-by-gate propagation in the SAT. 4.3.5 Gate-by-Gate Quantification of the Attack Tree This section presents the deterministic quantification of the SAT derived from the MBSE artefacts. The objective is to compute the probability of the TE, defined as the security-induced failure of the IoT-enabled SIS, by propagating empirically assigned BAS probabilities through the Boolean structure of the tree. Each BAS corresponds to a CVE-mapped vulnerability, and its prior probability is obtained directly from the EPSS values reported in Table 2. These probabilities represent empirically derived exploit likelihoods and replace the exponentially distributed failure rates used in the safety-focused framework of [7]. Quantification proceeds bottom-up, from leaf nodes (BASs) to intermediate attack and sub-attack goals, and ultimately to the TE. The SAT contains AND and OR logic gates. Under the standard conditional independence assumption, OR and AND gates probabilities are computed using equations (2) and (3), respectively.
Illustrative Sub-Attack Calculations: To demonstrate the gate-level computation, consider two representative subattack goals: Man-in-the-Middle (MiM) and Information Disclosure (ID). MiM Sub-Attack (AND Gate): The MiM goal is realised only if both BASs are successfully exploited: CVE-2014-2361 (wireless communication vulnerability) and CVE-2014-2379 (replay transmission vulnerability). As these BASs are connected via an AND gate, Equation (3) applies: P r(MiM) = P r(CVE-2014-2361) × P r(CVE-2014-2379) = 0.0008 × 0.0027 = 2.16 × 10−6 ID Sub-Attack (OR Gate): The ID goal can be achieved through either authentication bypass (CVE2020-15506) or unauthorised access (CVE-2018-8360). These BASs are connected through an OR gate; therefore, Equation (2) applies: P r(ID) = 1 − 1 − P r(CVE-2020-15506) × 1 − P r(CVE-2018-8360) = 1 − (1 − 0.007)(1 − 0.0268) ≈ 3.38 × 10−2 These examples illustrate how EPSS-based BAS probabilities are systematically propagated through the SAT according to its logical structure. Recursive Propagation to the Top Event: The TE probability is obtained by recursively applying Equations (2) and (3) at each hierarchical level of the SAT until the root event is reached. Strict adherence to the SAT structure derived from the MBSE transformation is essential, as both the selection of BAS probabilities and the type of logical gate directly influence the resulting systemlevel estimate. Importantly, vulnerability probabilities must be mapped exclusively to their corresponding BAS nodes. Substituting unrelated CVE data, even if thematically similar, would distort the quantitative interpretation of the attack path and alter the computed TE probability. Table 3 summarises the computed probabilities for all attack and sub-attack goals, including those corresponding to the Confidentiality, Integrity, and Availability (CIA) attributes. The final computed probability of the TE is: P r(TE) = 4.00 × 10−2
15 Table 2 List of Vulnerabilities with EPSS scores (C: Confidentiality, I: Integrity, A: Availability) Attack Type Authentication pass
CVE
Description
EPSS Score
Impact
By-
CVE-2020-15506
Bypass authentication mechanisms
0.007
C
Unauthorised Access
CVE-2018-8360
Unauthorised access to information
0.0268
C
Man-in-the-Middle
CVE-2014-2361
Intercepting wireless communication via sensor I/O Module
0.0008
C
Man-in-the-Middle
CVE-2014-2379
Exploit Sensys Networks for traffic alteration
0.0027
C
Side-Channel Attack
CVE-2004-2768
Creating hard links for elevated privileges
0.0004
I
Side-Channel Attack
CVE-2014-2362
Predicting project creation times
0.0021
I
Side-Channel Attack
CVE-2014-2360
Exploiting battery voltage reporting
0.0194
I
Remote Code Execution
CVE-2020-16898
Exploiting flaw
TCP/IP
stack
0.0076
I
SQL Injection
CVE-2019-9568
Executing arbitrary commands
SQL
0.002
I
Shell Code Execution
CVE-2019-17059
Executing mands
com-
0.0064
I
Privilege Escalation
CVE-2004-2768
Elevating user privileges via hard link
0.0004
I
Privilege Escalation
CVE-2021-22555
Heap memory corruption for privilege escalation
0.0026
I
Denial of Service
CVE-2014-2361
Exploitation of wireless communication
0.0008
A
Denial of Service
CVE-2019-0701
Exploiting input validation flaws
0.00004
A
Denial of Service
CVE-2021-35517
Memory exhaustion crafted TAR archive
0.0176
A
This value represents the estimated likelihood of a successful cyber-induced system failure within the EPSS reference horizon. Interpreted complementarily, the SIS exhibits an estimated security reliability of approximately 96% with respect to the modelled attack surface and associated vulnerabilities. It is important to emphasise that this value reflects cyber-induced failure only. The overall system dependability would decrease when combined with random hardware failures, communication faults, or other nonmalicious reliability contributors, as considered in [9]. 4.3.6 Bayesian Network Mapping and Analysis The System-Level Attack Tree (SAT) was transformed into a BN to enable probabilistic inference beyond deterministic Boolean propagation. The resulting directed acyclic graph, shown in Figure 8, preserves the hierarchical structure of the SAT: Basic Attack Steps (BASs) constitute root nodes, intermediate attack and sub-attack
arbitrary
via
goals form internal nodes, and the TE represents the terminal node corresponding to security-induced system failure. Conditional Probability Tables (CPTs) for intermediate nodes were derived directly from the logical semantics of the SAT gates. Specifically, AND and OR relationships were encoded using the probabilistic formulations defined in Equations (3) and (2). Prior probabilities for root nodes (BAS1 –BAS16 ) were assigned using the EPSS values reported in Table 2. Treatment of Repeated CVE Identifiers: During the mapping process, two CVE identifiers appeared in multiple attack contexts: – CVE-2014-2361: instantiated once in the Man-inthe-Middle (MiM) attack path (interception of wireless communication via the sensor I/O module), and once in the Denial/Disruption of Service (DoS) path (wireless communication exploitation).
16 Table 3 Quantitative Estimate of Attack and Sub-Attack Goals Attack
Gate
ID SC CI DCA DoS
Pr(Attack) −2
3.38 × 10 2.19 × 10−2 1.59 × 10−2 2.19 × 10−2 1.84 × 10−2
OR OR OR OR OR
Attack
Gate
Pr(Attack)
MiM PE UA DIA TE
AND OR AND AND OR
2.16 × 10−6 3.0 × 10−3 7.3 × 10−8 4.77 × 10−5 4.00 × 10−2
TE True
4%
False 96% BAS15 True DCA True
DoS
DIA
2%
True
False 98%
True
0%
2%
False 98%
2%
False 98%
False 100%
BAS14 True
UA
BAS1 True
True
1%
SC
0% True
False 100%
False 99%
CI
PE
2%
True
False 98%
BAS13
True
0%
True
2%
0%
False 100%
False 98%
False 100%
0%
False 100%
BAS12
True
True
3%
3%
False 97%
True
0%
False 100%
0%
False 100...
True
0%
False 100...
BAS7 True
BAS9
2%
True
False 98%
BAS11
0%
True
False 100%
BAS4 True
0%
False 100%
True
0%
False 100%
True
1%
False 99%
1%
False 99%
BAS8
BAS3
BAS2 True
True
0%
False 100%
False 97%
BAS6
BAS5
MIM
ID
BAS10 True
0%
False 100...
Fig. 8 BN Model of the AT of Fig. 7
– CVE-2004-2768: instantiated once in the Side-ChannelPredictive Inference Consistency: Forward (predictive) inference in the BN yields a TE probability identical to attack path (hard-link creation leading to information leakage), and once in the Privilege Escalation that obtained through deterministic gate-by-gate prop(PE) path (elevation of user privileges via hard links). agation, i.e., P r(T E) = 4.00 × 10−2 . This result confirms structural and quantitative consistency between Although the CVE identifiers are identical, each octhe SAT and its BN representation. currence represents a distinct exploitation event embedded in a different architectural and adversarial context. Accordingly, these were modelled as separate BAS nodes in the BN (e.g., BASi , BASj ), each corresponding to: “successful exploitation of CVEk within a specific attack path to realise a particular attack goal.” These BAS nodes are treated as statistically independent random variables. This assumption reflects that exploitation in one context (e.g., MiM) does not deterministically imply successful exploitation in another context (e.g., DoS), as different access vectors, privileges, or system interfaces may be involved. While correlated exploitation scenarios could be represented through additional dependency arcs, such extensions are outside the scope of the present case study.
Advanced Bayesian Analyses: Beyond predictive estimation, the BN enables analyses not supported by deterministic ATA: – Posterior Diagnostic Inference: Computation of P (BASi | T E) to identify the most probable contributing vulnerabilities given system compromise. – Evidence-Based Updating: Dynamic recalculation of P (T E | evidence) under observed attack indicators (e.g., confirmed MiM or authentication bypass events). – Sensitivity and Criticality Analysis: Evaluation of vulnerability influence on system failure probability using measures such as Birnbaum Importance to prioritise mitigation efforts.
17
These capabilities transform the static SAT into a bidirectional probabilistic reasoning framework, supporting forensic analysis, real-time risk assessment, and security investment prioritisation. 4.3.7 Posterior Diagnostic Inference Results To evaluate the diagnostic capability of the BN, posterior probabilities of all BASi were computed under the condition that the TE has occurred, i.e., P r(BASi | T E = 1). This reverse inference enables identification of the most probable causal contributors given a confirmed system compromise. Table 4 summarises the prior and posterior probabilities of each BAS. Several observations emerge. First, a subset of BAS nodes exhibits negligible change between prior and posterior probabilities. For example, BAS1 (CVE-2020-15506) and BAS2 (CVE-2018-8360) increase only marginally from 0.007 to 0.00700035 and from 0.0268 to 0.0268013, respectively. This indicates weak causal contribution to the TE within the overall attack structure. In contrast, other BAS nodes experience substantial posterior amplification. Notably, BAS7 (CVE-20142360) increases from 0.0194 to 0.48598, and BAS15 (CVE-2021-35517) rises from 0.0176 to 0.44089. Similarly, BAS6 (CVE-2014-2362) increases from 0.0021 to 0.05261. These large posterior shifts indicate strong causal alignment with attack paths leading to the TE. In probabilistic terms, the occurrence of the TE significantly increases the likelihood that these vulnerabilities were exploited. A particularly important observation concerns repeated CVE identifiers. CVE-2014-2361 appears as both BAS3 and BAS13 in different attack contexts. While BAS3 shows only marginal posterior increase (0.0008 to 0.0008017), BAS13 exhibits substantial amplification (0.0008 to 0.02004). Similarly, CVE-2004-2768 appears as BAS5 and BAS8, with posterior probabilities of 0.01002 and 0.0005527, respectively. These discrepancies confirm that vulnerability impact is strongly path-dependent. Although the CVE identifier is identical, its probabilistic influence differs significantly depending on its architectural embedding and associated attack goal. This validates the modelling decision to represent repeated CVEs as context-specific BAS nodes rather than as a single shared variable. Overall, the posterior analysis demonstrates that exploitability (as reflected by EPSS priors) does not directly translate into system-level criticality. Certain vulnerabilities with modest prior probabilities become highly probable contributors once the TE is observed. This diagnostic capability, identifying likely root causes
after compromise, cannot be achieved using deterministic gate-by-gate ATA and represents a key advantage of the BN framework. 4.3.8 Birnbaum Importance Ranking and Criticality Analysis To further identify the most influential attack steps in the model, a Birnbaum importance analysis was conducted. The Birnbaum importance measure quantifies the sensitivity of the top-level attack probability to changes in the probability of individual basic attack steps. In other words, it evaluates how strongly the likelihood of system compromise depends on the successful exploitation of a specific vulnerability. It is defined as the difference between the probability of the TE when a given BAS is assumed to be certainly exploited and the probability of the TE when that BAS is assumed not to occur: BIMi = P r(T E | BASi = 1) − P r(T E | BASi = 0). This measure indicates how strongly the exploitation of a specific vulnerability contributes to the occurrence of the system-level attack. Higher BIM values therefore identify vulnerabilities whose presence or absence has the most significant impact on the overall cybersecurity risk. Using the constructed BN, the Birnbaum importance values were computed for all BAS nodes. Table 5 presents the BIM values for all BAS nodes together with their corresponding rankings. The results reveal a clear differentiation in the relative criticality of vulnerabilities within the system. In particular, BAS7 (CVE-2014-2360) exhibits the highest importance value of 0.979, making it the most critical vulnerability in the model. This indicates that exploitation of this vulnerability substantially increases the probability of the top event and therefore represents the most influential attack pathway in the analysed system. The second most critical vulnerability is BAS15 (CVE-2021-35517) with a BIM value of 0.977, followed by BAS6 (CVE-20142362) and BAS13 (CVE-2014-2361), which also demonstrate very high importance values above 0.96. These results suggest that vulnerabilities associated with sensor behaviour, hardware manipulation, and memory exhaustion attacks play a dominant role in determining the system’s susceptibility to cyber-induced failure. Such vulnerabilities lie on critical paths of the attack tree and therefore have a disproportionately large influence on the overall system compromise probability. Consequently, mitigation efforts targeting these vulnerabilities would produce the greatest reduction in systemlevel cybersecurity risk.
18 Table 4 Prior and Posterior Probabilities of Basic Attack Steps (Posterior Diagnostic Inference) BAS
CVE
Prior Probability
Posterior Probability
BAS1 BAS2 BAS3 BAS4 BAS5 BAS6 BAS7 BAS8 BAS9 BAS10 BAS11 BAS12 BAS13 BAS14 BAS15
CVE-2020-15506 CVE-2018-8360 CVE-2014-2361 CVE-2014-2379 CVE-2004-2768 CVE-2014-2362 CVE-2014-2360 CVE-2004-2768 CVE-2021-22555 CVE-2019-9568 CVE-2019-17059 CVE-2020-16898 CVE-2014-2361 CVE-2019-0701 CVE-2021-35517
7.0 × 10−3 2.68 × 10−2 8.0 × 10−4 2.7 × 10−3 4.0 × 10−4 2.1 × 10−3 1.94 × 10−2 4.0 × 10−4 2.6 × 10−3 2.0 × 10−3 6.4 × 10−3 7.6 × 10−3 8.0 × 10−4 4.0 × 10−5 1.76 × 10−2
7.00035 × 10−3 2.68013 × 10−2 8.01745 × 10−4 2.70174 × 10−3 1.00202 × 10−2 5.26063 × 10−2 4.85982 × 10−1 5.52735 × 10−4 3.59278 × 10−3 2.14196 × 10−3 6.85428 × 10−3 8.13946 × 10−3 2.00405 × 10−2 1.00202 × 10−3 4.40891 × 10−1
Table 5 Birnbaum Importance Measure (BIM) and ranking of Basic Attack Steps. BAS
CVE
BIM
Rank
BAS1 BAS2 BAS3 BAS4 BAS5 BAS6 BAS7 BAS8 BAS9 BAS10 BAS11 BAS12 BAS13 BAS14 BAS15
CVE-2020-15506 CVE-2018-8360 CVE-2014-2361 CVE-2014-2379 CVE-2004-2768 CVE-2014-2362 CVE-2014-2360 CVE-2004-2768 CVE-2021-22555 CVE-2019-9568 CVE-2019-17059 CVE-2020-16898 CVE-2014-2361 CVE-2019-0701 CVE-2021-35517
0.0000020190 0.0000020600 0.0000871310 0.0000258160 0.9604650080 0.9621012350 0.9790748750 0.0152487860 0.0152824210 0.0028392100 0.0028517830 0.0028552310 0.9608495020 0.9601192270 0.9772809670
15 14 12 13 5 3 1 8 7 11 10 9 4 6 2
A second tier of vulnerabilities (e.g., BAS8 and BAS9) exhibit moderate importance values ( 0.015), indicating contributory but non-dominant roles. Finally, several vulnerabilities exhibit very small BIM values, indicating a negligible influence on the top event probability. For example, BAS1 (CVE-2020-15506) and BAS2 (CVE-2018-8360) have importance values on the order of 10−6 , ranking 15th and 14th, respectively. These vulnerabilities correspond to alternative attack paths that do not significantly affect the probability of system compromise when considered within the overall attack structure. Similarly, BAS4 (CVE-2014-2379) and BAS3 (CVE-2014-2361) show relatively low influence due to their position within AND-gate structures where multiple conditions must be satisfied simultaneously. Importantly, repeated CVEs again demonstrate context sensitivity. For example, CVE-2004-2768 appears as BAS5 (BIM ≈ 0.9605) and BAS8 (BIM ≈ 0.0152),
showing radically different influence depending on its attack path. Similarly, CVE-2014-2361 appears as BAS3 (BIM ≈ 8.7×10−5 ) and BAS13 (BIM ≈ 0.9608). These results confirm that vulnerability criticality is governed more by structural position within the attack model than by the CVE identifier itself. Overall, the Birnbaum importance analysis provides valuable insight into the relative criticality of vulnerabilities, enabling a prioritised approach to cybersecurity risk mitigation. From a defensive perspective, the ranking indicates that mitigation strategies should prioritise vulnerabilities BAS7, BAS15, BAS6, and BAS13, as addressing these vulnerabilities would yield the most significant reduction in the probability of system compromise. While deterministic gate-by-gate evaluation of the attack tree can estimate the probability of the top event, the Bayesian network enables additional analytical ca-
19
those by Waqar et al. [12], Mauw et al. [48], Ten et al. [65], Saini et al. [61], Roy et al. [60], Kumar et al. [40], Foster et al. [22], and Abdulhamid et al. [8], primarily rely on deterministic attack tree structures or qualitative reasoning and do not incorporate architectural modelling, real exploitability datasets, or probabilistic inference mechanisms. 5 Discussion and Comparison With Other In contrast, the proposed framework combines MBSEApproaches based architectural modelling with data-driven quantitative analysis and probabilistic reasoning. This inteThe proposed framework provides a structured methodgration enables architecture-aware security modelling, ology for quantitatively analysing cybersecurity threats objective estimation of exploitability likelihoods, and in IoT-based systems by integrating MBSE, attack tree systematic identification of critical vulnerabilities, thereby modelling, and empirical vulnerability exploitability data. providing stronger analytical support for security-aware In contrast to traditional security analyses that treat system design and cybersecurity risk assessment in IoTsystem architecture and security models independently, based environments. the approach uses SysML models to represent the architectural structure and behavioural interactions of the IoT system, from which component-level attack trees 6 Conclusion and Future Works are systematically derived. This model-driven process This article presented a quantitative framework for analysing ensures traceability between system components, assocybersecurity-induced failure behaviour in IoT-based ciated vulnerabilities, and potential attack propagation environments by integrating MBSE, attack tree modpaths, enabling security analysis to remain tightly couelling, and empirical vulnerability exploitability data. pled with the underlying system design. The approach uses SysML-based architectural models By incorporating exploitability data obtained from to derive attack trees that represent potential attack publicly available vulnerability intelligence sources such propagation paths within the system. By incorporatas the National Vulnerability Database and the EPSS, ing exploitability information from vulnerability intelthe framework enables objective estimation of attack ligence sources such as the NVD and the EPSS, the likelihoods based on observed exploitation trends. This framework enables quantitative estimation of the likecontrasts with many conventional attack tree analyses lihood of cyber attacks leading to system-level comprothat rely on expert judgement, qualitative assessments, mise. or heuristic scoring mechanisms. Consequently, the proTo enhance analytical capabilities, the attack tree posed approach provides a more realistic representation model was mapped to a Bayesian Network representaof the threat landscape affecting IoT-based systems. tion. This probabilistic formulation supports advanced The mapping of the attack tree model to a Bayesian reasoning techniques beyond deterministic attack tree Network further extends the analytical capabilities of evaluation, including posterior diagnostic inference and the framework. While deterministic attack tree evaluvulnerability criticality analysis using Birnbaum imation allows the computation of the probability of the portance measures. These capabilities allow analysts top event, the Bayesian formulation enables additional to identify vulnerabilities that contribute most signifiprobabilistic reasoning. In particular, posterior infercantly to system compromise and provide a principled ence supports diagnostic analysis when evidence of sysbasis for prioritising security mitigation strategies. tem compromise is observed, while importance meaOverall, the proposed framework demonstrates how sures such as Birnbaum importance allow vulnerabilarchitecture-driven modelling, empirical vulnerability ities to be ranked according to their contribution to intelligence, and probabilistic analysis can be combined system-level failure. These analyses provide actionable to support rigorous cybersecurity risk assessment for insights for prioritising mitigation strategies in complex IoT-based systems. By linking security analysis directly IoT environments where numerous vulnerabilities may to system architecture through MBSE, the approach facoexist. To position the proposed framework within the broader cilitates traceable and data-driven evaluation of cyber risks during system design and analysis. landscape of cybersecurity modelling approaches, TaDespite these advantages, several challenges remain. ble 6 compares representative studies employing attack Although the framework adopts an MBSE-oriented modtree or related security modelling techniques with reelling structure, the current implementation still inspect to both conceptual modelling scope and analytical volves substantial manual effort in constructing attack capabilities. As shown, existing approaches, including pabilities such as importance ranking and diagnostic reasoning. These capabilities allow security analysts to identify the most influential vulnerabilities and allocate defensive resources more effectively to reduce the likelihood of cyber-induced system failure.
20 Table 6 Comparison of Existing Cybersecurity Modelling Approaches with the Proposed Framework Studies
Waqar et al. [12] Mauw et al. [48] Ten et al. [65] Saini et al. [61] Roy et al. [60] Kumar et al. [40] Foster et al. [22] Abdulhamid et al. [8] Proposed Approach
Conceptual Capabilities Analytical Capabilities Cyber Quantitative Real IoT/ICS MBSE ATA BN Posterior Criticality Threat Analysis Data Case Study Model Evaluation Inference Reasoning Ranking Y N Y Y Y Y N Y Y
Y N Y Y Y N Y Y Y
N N N N N N N N Y
Y N Y N Y N N Y Y
N N N N N N N N Y
Y Y Y Y Y Y Y Y Y
N N N N N N N N Y
N N N N N N N N Y
N N N N N N N N Y
Y: Yes; N: No. ATA: Deterministic attack tree evaluation using logical gates. BN: Bayesian Network based probabilistic modelling. Posterior Reasoning: Diagnostic inference when attack evidence is observed. Criticality Ranking: Identification of influential vulnerabilities using importance measures (e.g., Birnbaum Importance). MBSE Model: Use of Model-Based Systems Engineering (e.g., SysML) to derive or support the security model from system architecture. Real Data refers to the use of publicly available vulnerability exploitability datasets such as EPSS and NVD.
trees, mapping vulnerabilities to system components, and configuring probabilistic models. This may limit scalability when analysing large or highly complex systems. Future research will therefore focus on developing automated tool support within MBSE environments to streamline model construction, vulnerability mapping, and probabilistic analysis. Integration with SysML-based modelling platforms would enable automated generation of attack models from architectural descriptions and support continuous security analysis throughout the system development lifecycle. Another challenge arises from the evolving nature of vulnerability intelligence sources such as the NVD and EPSS. Since exploitability scores and vulnerability information change over time as new threats emerge, cybersecurity models must be periodically updated to maintain their validity. Future work will therefore explore dynamic modelling mechanisms that enable automated retrieval of updated vulnerability data and recomputation of probabilistic risk assessments. Finally, future studies will extend the framework to larger and more complex industrial IoT environments and investigate its integration with broader dependability analysis techniques that consider both safety and security aspects of cyber-physical systems.
Abbreviations The following abbreviations are used in this manuscript: ACT Attack Countermeasure Trees ATA Attack Tree Analysis BAS Basic Attack Step CIA Confidentiality, Integrity, and Availability CPS Cyber-Physical Systems CTMC Continuous Time Markov Chain CVE Common Vulnerability Exposure CVSS Common Vulnerability Scoring System DoS Denial of Service EPSS Exploit Prediction Scoring System FT Fault Tree GPS Global Positioning System IoMT Internet-of-Medical Things IoT Internet of Things MBSE Model-Based Systems Engineering MiM Man-in-the-Middle NFP Non-Functional Properties NVD National Vulnerability Database QADT Quantitative Attack-Defence Trees RBD Reliability Block Diagram RFID Radio Frequency Identification SIS Smart Irrigation System SysML/UML System or Unified Modelling Languages TE Top Event References 1. National
Vulnerability
Database
(NVD).
21 https://nvd.nist.gov/ (2024). Accessed: [20 Dec 24] 2. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C.: Dependability of the Internet of Things: Current Status and Challenges. In: 2022 International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), pp. 1–6. IEEE (2022) 3. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C.: Adaptation of Model Transformation for Safety Analysis of IoT-based Applications. In: The UNIfied Conference of DAMAS, IncoME and TEPEN Conferences, pp. 959—-973 (2023) 4. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C.: An Overview of Safety and Security Analysis Frameworks for the Internet of Things. Electronics 12(14), 3086 (2023) 5. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C.: Developing Dependable IoT Systems: Safety Perspective. In: UNIfied Conference of DAMAS, IncoME and TEPEN Conferences, pp. 1–6. Springer (2023) 6. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C.: Reliability Assessment of IoT-enabled Systems using Fault Trees and Bayesian Networks. In: 5th International Conference on Advances in Distributed Computing and Machine Learning (ICADCML), pp. 267–277 (2024) 7. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C.: Quantitative failure analysis for IoT systems: an integrated modelbased framework. International Journal of System Assurance Engineering and Management 16, 845–867 (2025) 8. Abdulhamid, A., Kabir, S., Ghafir, I., Lei, C., El Hindi, K., Hammoudeh, M.: Quantitative Cybersecurity Analysis Framework for Cyber Physical Systems: A Conceptual Approach. IEEE Open Journal of the Computer Society (2025) 9. Abdulhamid, A., Rahman, M.M., Kabir, S., Ghafir, I.: Enhancing safety in IoT systems: A model-based assessment of a smart irrigation system using fault tree analysis. Electronics 13(6), 1156 (2024) 10. Aksu, M.U., Dilek, M.H., Tatlı, E.İ., Bicakci, K., Dirik, H.I., Demirezen, M.U., Aykır, T.: A quantitative cvssbased cyber security risk assessment methodology for it systems. In: 2017 International Carnahan Conference on Security Technology (ICCST), pp. 1–8. IEEE (2017) 11. Ali, A., Zavarsky, P., Lindskog, D., Ruhl, R.: A new cvssbased tool to mitigate the effects of software vulnerabilities. International Journal for Information Security Research (IJISR) 1(4), 178–182 (2011) 12. Asif, W., Ray, I.G., Rajarajan, M.: An attack tree based risk evaluation approach for the internet of things. In: Proceedings of the 8th International Conference on the Internet of Things, pp. 1–8 (2018) 13. Avizienis, A., Laprie, J.C., Randell, B.: Fundamental concepts of dependability. Department of Computing Science Technical Report Series (2001) 14. Ayaz, M., Ammad-Uddin, M., Sharif, Z., Mansour, A., Aggoune, E.H.M.: Internet-of-Things (IoT)-based smart agriculture: Toward making the fields talk. IEEE Access 7, 129551–129583 (2019) 15. Bilgen, M., Altin, N.: An overview on reliability analysis and evaluation methods applied to smart grids. Gazi University Journal of Science Part C: Design and Technology 9(4), 645–660 (2021) 16. Boddu, R.D., Ragam, P., Pendhota, S.P., Goni, M., Indrala, S., Badavath, U.R.: Iot-based smart agricultural monitoring system. In: Proceedings of Fourth International Conference on Computer and Communication Technologies: IC3T 2022, pp. 377–385. Springer (2023) 17. Brooke, P.J., Paige, R.F.: Fault trees for security system design and analysis. Computers & Security 22(3), 256– 264 (2003)
18. Buldas, A., Laud, P., Priisalu, J., Saarepera, M., Willemson, J.: Rational choice of security measures via multiparameter attack trees. In: International Workshop on Critical Information Infrastructures Security, pp. 235– 248. Springer (2006) 19. Dahane, A., Benameur, R., Kechar, B., Benyamina, A.: An iot based smart farming system using machine learning. In: 2020 International symposium on networks, computers and communications (ISNCC), pp. 1–6. IEEE (2020) 20. Espedalen, J.H.: Attack trees describing security in distributed internet-enabled metrology. Master’s thesis, Department of Computer Science and Media Technology, Gjøvik University College (2007) 21. Flores, M., Heredia, D., Andrade, R., Ibrahim, M.: Smart home IoT network risk assessment using bayesian networks. Entropy 24(5), 668 (2022) 22. Förster, M., Schwarz, R., Steiner, M.: Integration of modular safety and security models for the analysis of the impact of security on safety. Tech. Rep. 078.10/E, Fraunhofer IESE and University of Kaiserslautern, Kaiserslautern, Germany (2010). URL http://publica.fraunhofer.de/dokumente/N-151512.html 23. Gabbay, D.M., Horne, R., Mauw, S., van der Torre, L.: Attack-defence frameworks: Argumentation-based semantics for attack-defence trees. In: H. Eades III, O. Gadyatskaya (eds.) Graphical Models for Security, pp. 143–165. Springer International Publishing, Cham (2020) 24. Ghafir, I., Prenosil, V.: Dns traffic analysis for malicious domains detection. In: 2015 2nd International Conference on Signal Processing and Integrated Networks (SPIN), pp. 613–918. IEEE (2015) 25. Ghafir, I., Prenosil, V., Svoboda, J., Hammoudeh, M.: A survey on network security monitoring systems. In: 2016 IEEE 4th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW), pp. 77–82. IEEE (2016) 26. Gope, P., Gheraibia, Y., Kabir, S., Sikdar, B.: A secure IoT-based modern healthcare system with fault-tolerant decision making process. IEEE Journal of Biomedical and Health Informatics 25(3), 862–873 (2020) 27. Grechi, V.L., de Oliveira, A.L., Braga, R.T.V.: Model-driven safety and security co-analysis: A systematic literature review. Journal of Systems and Software 220, 112251 (2025). DOI https://doi.org/10.1016/j.jss.2024.112251 28. Gutiérrez, J., Villa-Medina, J.F., Nieto-Garibay, A., Porta-Gándara, M.Á.: Automated irrigation system using a wireless sensor network and gprs module. IEEE transactions on instrumentation and measurement 63(1), 166–176 (2013) 29. Hammoudeh, M., Ghafir, I., Bounceur, A., Rawlinson, T.: Continuous monitoring in mission-critical applications using the internet of things and blockchain. In: Proceedings of the 3rd International Conference on Future Networks and Distributed Systems, pp. 1–5 (2019) 30. Hussaini, A., Qian, C., Liao, W., Yu, W.: A taxonomy of security and defense mechanisms in digital twinsbased cyber-physical systems. In: 2022 IEEE International Conferences on Internet of Things (iThings) and IEEE Green Computing & Communications (GreenCom) and IEEE Cyber, Physical & Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics), pp. 597–604. IEEE (2022) 31. Hussaini, A., Zahran, B., Ali-Gombe, A.: Object allocation pattern as an indicator for maliciousness-an ex-
22 ploratory analysis. In: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pp. 313–315 (2021) 32. Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., Roytman, M.: Exploit prediction scoring system (epss). Digital Threats: Research and Practice 2(3), 1–17 (2021) 33. Jacobs, J., Romanosky, S., Suciu, O., Edwards, B., Sarabi, A.: Enhancing vulnerability prioritization: Datadriven exploit predictions with community-driven insights. In: 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 194–206. IEEE (2023) 34. Janiszewski, M., Rytel, M., Lewandowski, P., Romanowski, H.: Creating vulnerabilities and exploits database of iot devices. In: Proceedings of the 2022 European Interdisciplinary Cybersecurity Conference, pp. 91–92 (2022) 35. kumar Jayam, Y., Tunuguntla, V., Sreehari, J., Harinarayanan, S.: Smart plant managing system using iot. In: 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), pp. 271–277. IEEE (2020) 36. Kabir, S., Azad, T., Walker, M., Gheraibia, Y.: Reliability analysis of automated pond oxygen management system. In: 18th International Conference on Computer and Information Technology (ICCIT), pp. 144–149. IEEE (2015) 37. Kalantari, F., Tahir, O.M., Joni, R.A., Fatemi, E.: Opportunities and challenges in sustainability of vertical farming: A review. Journal of Landscape Ecology 11(1), 35–60 (2018) 38. Karim, M.R., Kabir, S., Lei, C., Lefticaru, R.: Quantifying Security Events in IoT. In: 5th International Conference on Emerging Trends and Technologies on Intelligent Systems, pp. 1–12. Springer (2025) 39. Khan, R., McLaughlin, K., Laverty, D., Sezer, S.: Stridebased threat modeling for cyber-physical systems. In: 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe), pp. 1–6. IEEE (2017) 40. Kumar, R., Ruijters, E., Stoelinga, M.: Quantitative attack tree analysis via priced timed automata. In: S. Sankaranarayanan, E. Vicario (eds.) Formal Modeling and Analysis of Timed Systems, pp. 156–171. Springer International Publishing, Cham (2015) 41. Kumar, S.A., Vealey, T., Srivastava, H.: Security in Internet of Things: Challenges, solutions and future directions. In: 2016 49th Hawaii International Conference on System Sciences (HICSS), pp. 5772–5781. IEEE (2016) 42. Lawal, M.A., Shaikh, R.A., Hassan, S.R.: Security analysis of network anomalies mitigation schemes in IoT networks. IEEE Access 8, 43355–43374 (2020) 43. Lefoane, M., Ghafir, I., Kabir, S., Awan, I.U.: Machine learning for botnet detection: An optimized feature selection approach. In: The 5th International Conference on Future Networks & Distributed Systems, pp. 195–200 (2021) 44. Lefoane, M., Ghafir, I., Kabir, S., Awan, I.U.: Unsupervised learning for feature selection: A proposed solution for botnet detection in 5g networks. IEEE Transactions on Industrial Informatics 19(1), 921–929 (2022) 45. Lefoane, M., Ghafir, I., Kabir, S., Awan, I.U.: Sequential Pattern Mining: A Proposed Approach for Intrusion Detection Systems. In: 7th International Conference on Future Networks & Distributed Systems, pp. 599–604 (2023) 46. Mahak, M., Singh, Y.: Threat modelling and risk assessment in internet of things: A review. In: Proceedings of
Second International Conference on Computing, Communications, and Cyber-Security: IC4S 2020, pp. 293–305. Springer (2021) 47. Maslekar, N., Kulkarni, K.P., Chakravarthy, A.K.: Application of unmanned aerial vehicles (uavs) for pest surveillance, monitoring and management. Innovative Pest Management Approaches for the 21st Century: Harnessing Automated Unmanned Technologies pp. 27–45 (2020) 48. Mauw, S., Oostdijk, M.: Foundations of attack trees. In: D.H. Won, S. Kim (eds.) Information Security and Cryptology - ICISC 2005, pp. 186–198. Springer Berlin Heidelberg, Berlin, Heidelberg (2006) 49. Mishra, S., Sharma, S.K.: Advanced contribution of iot in agricultural production for the development of smart livestock environments. Internet of Things 22, 100724 (2023) 50. Mosenia, A., Jha, N.K.: A comprehensive study of security of internet-of-things. IEEE Transactions on emerging topics in computing 5(4), 586–602 (2016) 51. Musa, A.A., Hussaini, A., Qian, C., Guo, Y., Yu, W.: Open radio access networks for smart IoT systems: State of art and future directions. Future Internet 15(12), 380 (2023) 52. Nguyen, T.A., Min, D., Choi, E.: A hierarchical modelling and analysis framework for availability and security quantification of IoT infrastructures. Electronics 9(1), 155 (2020) 53. Nguyen, T.A., Min, D., Choi, E., Lee, J.W.: Dependability and security quantification of an Internet of Medical Things infrastructure based on cloud-fog-edge continuum for healthcare monitoring using hierarchical models. IEEE Internet of Things Journal 8(21), 15704–15748 (2021) 54. Qureshi, A., Afaqui, M.S., Salas, J.: Iotfc: A secure and privacy preserving architecture for smart buildings. In: International Conference on Security and Privacy in New Computing Environments, pp. 102–119. Springer (2020) 55. Qureshi, A., Megı́as, D., Rifa-Pous, H.: Framework for preserving security and privacy in peer-to-peer content distribution systems. Expert Systems with Applications 42(3), 1391–1408 (2015) 56. Rahman, M.M., Abdulhamid, A., Kabir, S., , Gope, P.: Failure analysis of IoT-based smart agriculture system: towards sustainable food security. In: 5th IEEE International Conference on Sustainable Technologies for Industry 5.0 (STI), 09-10 December, Dhaka, pp. 1–6 (2023) 57. Rahman, M.M., Abdulhamid, A., Kabir, S.: Qualitative failure analysis of IoT-enabled industrial fire detection and prevention system. In: 2023 26th International Conference on Computer and Information Technology (ICCIT), pp. 1–6. IEEE (2023) 58. Ralston, P.A., Graham, J.H., Hieb, J.L.: Cyber security risk assessment for scada and dcs networks. ISA transactions 46(4), 583–594 (2007) 59. Raza, U., Lomax, J., Ghafir, I., Kharel, R., Whiteside, B.: An IoT and business processes based approach for the monitoring and control of high value-added manufacturing processes. In: Proceedings of the International Conference on Future Networks and Distributed Systems, pp. 1–8 (2017) 60. Roy, A., Kim, D.S., Trivedi, K.S.: Attack countermeasure trees (act): towards unifying the constructs of attack and defence trees. Security and communication networks 5(8), 929–943 (2012) 61. Saini, V., Duan, Q., Paruchuri, V.: Threat modelling using attack trees. Journal of Computing Sciences in Colleges 23(4), 124–131 (2008)
23 62. Saranya, T., Deisy, C., Sridevi, S., Anbananthen, K.S.M.: A comparative study of deep learning and internet of things for precision agriculture. Engineering Applications of Artificial Intelligence 122, 106034 (2023) 63. Scarfone, K., Mell, P.: An analysis of cvss version 2 vulnerability scoring. In: 2009 3rd International Symposium on Empirical Software Engineering and Measurement, pp. 516–525. IEEE (2009) 64. Steiner, M., Liggesmeyer, P.: Qualitative and quantitative analysis of cfts taking security causes into account. In: F. Koornneef, C. van Gulijk (eds.) Computer Safety, Reliability, and Security, pp. 109–120. Springer International Publishing, Cham (2015) 65. Ten, C.W., Liu, C.C., Govindarasu, M.: Vulnerability assessment of cybersecurity for SCADA systems using attack trees. In: 2007 IEEE Power Engineering Society General Meeting, pp. 1–8. IEEE (2007) 66. Wen, B., Li, P.: Risk assessment of security and stability control system against cyber attacks. In: 2021 IEEE 2nd China International Youth Conference on Electrical Engineering (CIYCEE), pp. 1–5. IEEE (2021) 67. Xing, L.: Reliability in Internet of Things: Current status and future perspectives. IEEE Internet of Things Journal 7(8), 6704–6721 (2020)