Research On Avionics System Full Cycle Security Risk Assessment Method

In the aviation aircraft industry, safety has always been the most critical concern. It mainly covers the safety of aircraft materials, power, machinery, personnel, electronic and other aspects of the system. With the revolution of the information technology and development of computer science, the onboard avionics system has been increasingly sophisticated and become one of the deciding factors for aircraft safety.Most of the existing risk assessment researches for avionics system have put their major focus on the safety related features and system reliability. However, little work has been done on risk assessment methodology, and the cost to implement according to Common Criteria for Information Technology Security Evaluation is high. Moreover, the current risk assessment of avionics systems in operational phase highly rely on a variety of monitoring systems, and it can barely detect incidents like intrusion or hijacking accurately.To solve the problems in the current security risk assessment, this paper presents the full life cycle of avionics systems for the security of quantitative risk assessment methodology. In the system design phase, the author proposed a Risk Tree with repair box and time delay gate for avionics systems security risk modeling, presented the method using Dynamic Bayesian Networks to solve the logic gates and top risk event of a Risk Tree, and obtained the quantitative result of the examined methodology. In the system operational phase, Hidden Markov Model is being employed as the real-time security risk assessment method for avionics system and the quantitative result of the security risk is being obtained by evaluating the system's real-time internal state probability distribution through the system's output symbol.Using Risk Tree can quantitatively assess the risk of avionics systems in the design phase, identify the hidden risks quickly and improve the development efficiency. Also, with the Hidden Markov Model used for the security risk assessment of avionics system in the operational phase, the existing data, commands and symbols can be reused to evaluate the system's real-time security risks quantitatively.