Securing critical infrastructures is a complex task. Required information is usually scarce or inexistent, and experts’ judgments may be inaccurate and biased. In this paper, two methodologies dealing with data scarcity, imprecision, and uncertainty are presented: Evidential network and Credal network. Evidential network is a graphical technique based on Dempster-Shafer Theory to explicitly model the propagation of epistemic uncertainty among variables while Credal network is an extension of Bayesian network to deal with sets of probabilities, known as Credal sets, based on experts’ judgments. Both methodologies constitute robust frameworks to account for high degree of imprecision on data, producing informative results despite the low-informative input. In the present study, the power in expressing uncertainty of these two methodologies have been showed, and their differences have been described through their application to a case study of security vulnerability assessment. Results demonstrate the substantial equivalence of the two methodologies in prognostic analysis, thus, an approximate updating procedure of Evidential network through equivalent Credal network has been proposed, to overcome the lack of possibility to compute updating in the context of Dempster-Shafer Theory.@en

The authors regret that an imprecise statement was made in this article, and wish to offer this Corrigendum as clarification. The authors would like to apologise for any inconvenience caused. Imprecise statement: Misuri et al. (2018, pp. 70) state in their work: “Differently from EN [evidential network], CN [credal network] can be used both to conduct forward analysis and to update probabilities”. This statement implies that EN cannot be used for belief updating and should be mapped into a corresponding CN for that purpose. Correction: The foregoing statement may be correct for conventional ENs that are based on Dempster's combination rule, but does not hold true for the EN developed by Simon and co-workers (2008, 2009) based on Bayesian network (BN) inference algorithms (herein, BN-based EN). Simon and Weber (2009) explicitly mention in their work that the developed EN can be used for belief updating: “The computation mechanism is based on the Bayes theorem, which is extended to the representation of uncertain information according to the framework of Dempster-Shafer theory. Specific evidence (Hard evidence) is modeled by a mass of 1 on one of the focal elements of the frame of discernment. Non-specific evidence (Soft evidence) corresponds to a mass distribution on the focal elements of the frame of discernment.” Proof: Fig. 1 displays the BN-based EN developed in Misuri et al. (2018) for security vulnerability assessment of a process plant where the belief masses have been updated given the evidence “Attack = Success”. Misuri et al. (2018) used the BN-based EN for predicting the probability of a successful attack (forward analysis), but to update the probabilities (backward analysis) they mapped the BN-based EN into an equivalent CN and calculated the updated probabilities given “Attack = Success”. They used two packages, JavaBayes and GL2U, to implement the CN, concluding that JavaBayes results in more consisting updated probabilities with regard to the evidence (the 2nd column in Table 1). In the present corrigendum, we used the BN-based EN (Fig. 1) for belief updating given “Attack = Success”. The updated beliefs were subsequently used to calculate updated probability intervals (the 3rd column in Table 1), showing a good agreement between the results of CN and BN-based EN. Conclusion: The EN developed by Simon and co-workers (2008, 2009) based on BN can be used for belief mass updating the same way BN can be used for probability updating, with no need for using CN.@en

Security management of critical infrastructures is a complex task as a great variety of technical and socio-political information is needed to realistically predict the risk of intentional malevolent acts. In the present study, a methodology based on Limited Memory Influence Diagram (LIMID) has been developed for the protection of critical infrastructures via cost-effective allocation of security measures. LIMID is an extension of Bayesian network (BN) intended for decision-making, allowing for efficient modelling of complex systems while accounting for interdependencies and interaction of system components. The probability updating feature of BN has been used to investigate the effect of vulnerabilities on adversaries’ preferences when planning attacks. Moreover, the proposed methodology has been shown to be able to identify an optimal defensive strategy given an attack through maximizing defenders’ expected utility. Despite being demonstrated via a chemical facility, the methodology can easily be tailored to a wide variety of critical infrastructures.@en

Before the tragedy of 9/11, the perception of risk in process plants was mainly focused on accidental events caused by technical failures, human errors or natural events. However, since then, the risk of deliberate actions against process facilities - also known as security risk - has also become a concern. Security risk assessment of engineering systems and infrastructures constitutes a complex task since a significant multitude of technical and socio-political information is needed to reasonably predict the risk of intentional malevolent acts. In the present study, a methodology based on Bayesian network (BN) has been applied to increase the security of critical infrastructures via cost-effective allocation of security measures. Using the probability updating feature of BN, the proposed methodology can be employed to investigate the effect of vulnerabilities on adversaries' preferences while planning security scenarios. Moreover, the proposed methodology is capable of efficiently identifying an optimal defensive strategy given a security scenario (i.e., an attack) through maximizing defenders' expected utility.@en