Data-Driven IT/OT Cyber Risk Evaluation and Mitigation Prioritization Using Machine Learning

The convergence of Information Technology (IT) and Operational Technology (OT) has heightened the need for robust cyber-risk assessment, which requires the identification of potential risky breaches and effective mitigation. Identifying the most crucial attack techniques correlating with increased cybersecurity risk is a critical step in this process. Traditional frameworks for this task often rely on expert opinions and intuitions, leading to overconfidence, inaccurate risk estimates, and inefficient mitigation suggestions. This paper presents an innovative method that uses machine learning models to perform risk assessments, identify high-risk techniques, and suggest appropriate mitigation and detection strategies. To achieve this, we present a unique feature engineering in which we integrated MITRE ATT&CK techniques and mapped data features to this standard universal framework, labeling them with the Common Vulnerability Scoring System. In addition, a probabilistic risk perspective is provided for the most relevant attack techniques in financial terms based on public information. Finally, we used statistical models to find the most frequent attack chains and build a RNN model to train a sequential model that estimated the severity score for attack chains.