ICT Supply Chain Security Evaluation Model Based on Bayesian Attack Graph

With the fast development of technology, the importance of ICT (Information and Communication Technology) product supply chains in production and daily life is growing and becoming a bigger market. Given the differences that exist between traditional and ICT product supply chains, security issues relating to ICT product supply chains have been increasingly coming to the fore. This paper proposes an ICT supply chain security assessment model based on Bayesian attack graphs. The model begins by analyzing the ICT supply chain to identify potential vulnerabilities and establishing an attack graph. Once the attack graph model structure is constructed, Bayesian theory is applied for quantification. A quantitative evaluation index for ICT supply chain threats is established based on the difficulty of exploiting vulnerabilities and their impact level. The corresponding atomic attack probabilities are calculated and linked to the ICT supply chain's security attribute nodes in the form of conditional transition probabilities. This approach not only infers the risk probability of an attacker successfully reaching various attribute nodes but also dynamically updates the changes in risk status based on observed attack behaviors. This enables the assessment of the overall risk status of the target supply chain under different conditions.