Hybrid Workflow and Bayesian Networks to Correlate Information in the Protection of Large Scale Critical Infrastructures

Safeguard is a system that aims to improve the dependability and survivability of large complex critical infrastructures by using distributed autonomous agents to monitor and protect them. This paper describes the embedding of a workflow management system within one of the Safeguard agents to support real-time correlation of information from anomaly detectors, intrusion detection systems and other system monitors. The workflow management system interprets workflow models, which are represented by augmented Petri Nets modelling generic forms of attack or failure. The workflow management system also triggers appropriate responses automatically according to the reasoning results of Bayesian networks linked to transitions in the workflows. A case study example from the management of electricity distribution networks will be presented.