Information Security Evaluation of Industrial Control Systems Using Probabilistic Linguistic MCDM Method

Wenshu Xu and Mingwei Lin

College of Computer and Cyber Security,Fujian Normal University,Fuzhou,350117,China

ABSTRACT Industrial control systems(ICSs)are widely used in various fields,and the information security problems of ICSs are increasingly serious.The existing evaluation methods fail to describe the uncertain evaluation information and group evaluation information of experts.Thus,this paper introduces the probabilistic linguistic term sets(PLTSs)to model the evaluation information of experts.Meanwhile,we propose a probabilistic linguistic multi-criteria decision-making(PL-MCDM)method to solve the information security assessment problem of ICSs.Firstly,we propose a novel subscript equivalence distance measure of PLTSs to improve the existing methods.Secondly,we use the Best Worst Method(BWM)method and Criteria Importance Through Inter-criteria Correlation(CRITIC)method to obtain the subjective weights and objective weights,which are used to derive the combined weights.Thirdly,we use the subscript equivalence distance measure method and the combined weight method to improve the probabilistic linguistic Visekriterijumska Optimizacija I Kompromisno Resenje(PL-VIKOR)method.Finally,we apply the proposed method to solve the information security assessment problem of ICSs.When comparing with the existing methods such as the probabilistic linguistic Tomada deDecis?o Iterativa Multicritério(PL-TODIM)method and probabilistic linguistic Technique for Order Preference by Similarity to Ideal Solution(PL-TOPSIS)method,the case example shows that the proposed method can provide more reasonable ranking results.By evaluating and ranking the information security level of different ICSs,managers can identify problems in time and guide their work better.

KEYWORDS Multi-criteria decision-making;distance measure;probabilistic linguistic term sets;industrial control system;information security assessment

1 Introduction

With the continuous promotion of the“Industrial Internet”and“Made in China 2025”,industrial control systems (ICSs) [1] have been widely employed in various industries and have become an indispensable part of national infrastructure.ICSs is a general term for several types of control systems,including supervisory control and data acquisition (SCADA) systems,distributed control systems(DCS),and some other control systems.ICSs are commonly used in industries such as power,automotive manufacturing and industrial production,oil and gas,chemical,and transportation,etc.ICSs provide a great convenience for industrial production,but they also come with many issues.As the ICSs run through the whole industrial production cycle,it is possible to lead to the crashes of the whole system and bring considerable losses to the enterprise once the problem occurs.Hence,the information security issues of ICSs must be taken seriously.According to Chinese industry information statistics,there were 2238 global industrial control security incidents involving 15 industries from 2012 to 2019[2],which shows its large number and wide scope.

The deep integration of information technology (IT) and industrialization has made ICSs and products increasingly connect to public networks in various ways.At the same time,viruses,Trojan horses,and other threats are spreading to ICSs,and then the information security problem of ICSs is becoming increasingly serious[3,4].Therefore,the information security assessment of ICSs becomes an essential part,which plays a vital role in the timely detection of information security problems and potential risks of ICSs[5,6].At present,many researchers have carried out research in the information security assessment of ICSs [7–11].A hierarchically structured model for information security risk assessment using fuzzy logic was proposed by Abdymanapov et al.[12],which considers only qualitative information without quantitative information.A security effectiveness evaluation method was put forward by Fu et al.[13] to analyze channel throughput variation and system robustness,which determines the security of the system only by analyzing the data.Nazmul et al.[14]analyzed the relevance of risk assessment in monitoring and Supervisory Control and Data Acquisition(SCADA)systems to determine the vulnerability of each component to attacks.Mi et al.[15] proposed an objective and quantitative integrated security and safety assessment scheme based on Fuzzy Analytic Hierarchy Process(FAHP).But Nazmul et al.[14]and Mi et al.[15]did not consider the subjective and objective weights of the criteria.An association analysis-based Dynamic Cyber Security Risk Assessment (CSRA) approach was proposed by Qin et al.[16] to reduce the complexity of the modeling process in the CSRA.Most of the existing studies focused on the ranking and correlation between criteria,lacking a comprehensive consideration of a single assessment criterion.Furthermore,the majority of the approaches only involved either qualitative or quantitative data,causing them inadequate for achieving comprehensive results.To address the above problems,this paper uses PLMCDM method based on the PLTSs,which effectively captures qualitative information regarding expert preferences through linguistic terms and expresses quantitative information about the degree of preferences using probabilities.In the process of assessing the information security of ICSs,it is essential to obtain expert ratings on the security status of system.The rating results,serving as raw data,also have directly impact on the result.However,due to the inherent uncertainty of linguistic expressions,precise numerical values may occasionally fall short of accurately conveying the true opinions of the experts.Fortunately,the PL-MCDM method offers decision-makers the ability to express their viewpoints using uncertain information,facilitating a more precise representation of their opinions.As a result,this method presents significant advantages in the information security assessment of ICSs.

PLTSs were proposed by Pang et al.[17] and evolved from fuzzy sets [18].Since PLTSs can express both qualitative and quantitative information [19–20],it has turned into a research hotspot in decision analysis.As the research advances,the issues of its underlying operations are gradually revealed[21,22].Taking the distance measure of PLTSs as an example,the distance measure proposed by Pang et al.[17]is capable of calculating the distance between two PLTSs in most cases.However,some counter-examples exist where the distance between two distinct PLTSs may erroneously amount to zero.After that,many researchers have proposed their own distance measures.Zhang et al.[23]put forward a new distance measure for defining the probabilistic linguistic preference relationship.Wang et al.[24] proposed a new distance measure in the extended TOPSIS-VIKOR method based on PLTSs.Lin et al.[25]first found the problems of the above distance measures and put forward a more scientific method,but it still exist some counter-examples like before.In such cases,this paper proposes a novel distance measure to solve this problem.

Multi-criteria decision-making(MCDM)methods generally involve multiple different evaluation criteria.They are widely applied in various fields,such as marketing [26,27],finance [28,29],environmental management[30–32],and supplier selection[33–35],etc.Therefore,there are many studies conducted on MCDM methods[36,37].Al-Hchaimi et al.[38]proposed a fuzzy decision opinion score method (Fermatean-FDOSM) framework for evaluating Denial-of-Service Attack countermeasure techniques (DoS A-CTs) in the context of MPSoCs-based IoT.They built the decision matrix for eighteen defense approaches based on thirteen criteria.The CRITIC method for criteria weighting was followed by the development of the Fermatean-FDOSM method for ranking.Dang et al.[39]provided an MCDM framework to select sustainable suppliers,which integrates a spherical fuzzy Analytical Hierarchical Process (SF-AHP) and grey Complex Proportional Assessment (G-COPRAS).A case study in the automotive industry in Vietnam is presented to demonstrate the effectiveness of the proposed approach.Mohapatra et al.[40]used the MCDM method to select an optimal route between the utility center and the consumer by considering multiple criteria.Garg [41] presented a decisionmaking(DM)framework using Fuzzy-euclidean-Taxicab distance-based approach(Fuzzy-ETDBA)to solve the cloud deployment model selection problem,then gave a case study involving the evaluation and selection of four cloud deployment models over three decision parameters consisting of seventeen sub-parameters.Liu et al.[42] integrated a grey DM trial and evaluation laboratory (DEMATEL)with uncertain linguistic multi-objective optimization by ratio analysis plus full multiplicative form(UL-MULTIMOORA)to propose a novel MCDM method.They used the proposed method to find the optimal location of electric vehicle charging stations (EVCSs).Gireesha et al.[43] presented an Improved Interval-Valued Intuitionistic Fuzzy Sets-Weighted Aggregate Sum and Product Assessment(IIVIFS-WASPAS)to solve the problem of cloud service provider selection.Khan et al.[44]proposed multiple distance measures based on the complex hesitant fuzzy set (CHFS) and integrated those measures with the TOPSIS method.A practical example related to the effectiveness of COVID-19 tests was presented for the practical application and validity of the proposed method.Ali et al.[45]used multiple different MCDM methods to examine the importance of three renewable energy sources.Based on experimental validation,the Complex Proportional Assessment (COPRAS) or VIKOR emerged as the most effective MCDM method for selecting renewables in the proposed framework.Besides,the MCDM method can be combined with intrusion detection [46] and privacy protection[47]for network security defense.Based on the above analysis,it can be seen that the MCDM method is very widely used.Inspired by[45],we integrate the PLTSs with the VIKOR method in this work.So we can combine the advantages of them to obtain more precise results.

In this paper,we introduce the probabilistic linguistic multi-criteria method to the information security assessment of ICSs.The main contributions of the article are as follows:

(1)After analyzing the existing distance measure methods of PLTSs,we propose a novel subscript equivalence distance measure and verify the validity of the formula.

(2)We optimize the standardization method for PLTSs based on the subscript equivalence distance measure.

(3)To obtain the weights of the criteria,we combine the BWM and CRITIC methods to obtain subjective and objective weights,then derive the combined weights of the criteria.

(4)A practical example of the information security assessment of SCADA system is given to show the decision process of the PL-VIKOR method.Finally,we present a comparative analysis to highlight the superiority of the PL-VIKOR method.

The rest of this paper is organized as follows: Section 2 reviews the concept of PLTSs and its distance measure,then proposes the subscript equivalence distance measure.Section 3 provides the combined weight method,which demonstrates the specific steps of the BWM method and CRITIC method.Section 4 gives the specific steps of the proposed method.Finally,a case study is provided in Section 5 to illustrate the usefulness of our methods,and the conclusions are included in Section 6.

2 Preliminaries

This section introduces the basic knowledge of PLTSs.Afterward,we propose a novel subscript equivalence distance measure for PLTSs and analyze the differences with other methods.

2.1 Probabilistic Linguistic Term Sets

PLTSs are based on linguistic term sets(LTSs),most commonly additive linguistic term sets,so the linguistic term sets here refer to additive LTSs,and the definition of LTSs is given first.

Definition 1[23]:The LTS is finite and ordered,and can be defined as follows:

wheresαdenotes the linguistic term,s0andsldenote the lower and upper limits of the linguistic term given by decision makers,respectively,andSsatisfies the following conditions:

(1) Ifα >β,thensα >sβ.

(2) The negation operator is defined as follows:neg(sα)=sβ,such thatα+β=l.

For example,S={s0=awful,s1=bad,s2=medium,s3=good,s4=perfect}is an LTS with five linguistic terms,s0=awful is the lower limit ofS,ands4=perfect is the upper limit ofS.Furthermore,letsα,sβ∈Sbe any two linguistic terms,the combined operational law onsαandsβis as follows:

Definition 2[17]:LetS={sα|α=0,1,....,l}be a reference LTS,then the PLTS defined onSis

wherel(k)（p(k)）denotes a probabilistic linguistic term element (PLTE),which consists of two parts:the linguistic terml(k)and the probabilityp(k).The former represents qualitative information and the latter represents quantitative information.#L(p)denotes the number of PLTEs.In the DM process,the probabilistic information may be incomplete when the decision-maker abstains,so the sum of probabilities may be less than 1,i.e.,

In the evaluation process,experts first assess each criterion based on the LTSS,assigning corresponding linguistic term evaluation valuessα.Then aggregating the evaluation values of multiple experts for the same criterion of the same alternative to derive the corresponding PLTS.PLTS is constructed as follows:

Definition 3:LetS={sα|α=0,1,...,l}denote an LTS,,2,...,m,j=1,2,...,n,g=1,2,...,t)represent the preference information from the decision-makerdg.Wheremrepresents the number of alternatives,nrepresents the number of criteria,andtrepresents the number of decisionmakers.The group preference information over each alternative concerning each criterion can be derived as

whereLij(p)represents the combined evaluation of the experts on thejth criterion of theith alternative.TakeL11(p)as an example,the evaluation of the first criterion of the first alternative given by five experts as(s2,s3,s2,s4,s3),thenL11(p)=(s2(0.4),s3(0.4),s4(0.2)).

For comparing different PLTSs,Pang et al.[17]defined the score function and deviation function.

Definition 4 [17]: LetL(p)=｛l(k)（p(k)）|l(k)∈S,p(k)≥0,k=1,2,...,#L(p)｝be a PLTS,r(k)be the subscript of the linguistic terml(k).The score function ofL(p)is defined as

For any two PLTSsL1(p)andL2(p),the comparison rules are as follows:

(1)IfE(L1(p))>E(L2(p)),thenL1(p)>L2(p);

(2)IfE(L1(p))=E(L2(p)),compareσ(L1(p))andσ(L2(p)):

·Ifσ(L1(p))>σ(L2(p)),thenL1(p)

·Ifσ(L1(p))=σ(L2(p)),thenL1(p)=L2(p).

2.2 Distance Measure of PLTSs

2.2.1 Distance Measure of Pang et al.[17]

The distance measure of Pang et al.[17] needs three steps.Firstly,we need to normalize the probabilities.Secondly,the number of PLTEs in PLTSs should be normalized.Thirdly,the linguistic terms in PTLSs should be ordered.These three steps are defined as follows.

Definition 5[17]:If the sum of probabilities less than 1,complementing the probabilities by ˙p(k)=,so that the sum of probabilities equals 1.

Definition 6 [17]: If #L1(p)/=#L2(p),that is,the number of two PLTSs is not equal,which requires the addition of the set with a smaller number.If#L1(p)>#L2(p),adding#L1(p)-#L2(p)PLTEssmin(0)toL2(p),andsminis the linguistic term with smallest subscript inL2(p).In the same way,if#L1(p) <#L2(p),adding#L2(p)-#L1(p)PLTEssmin(0)toL1(p),andsminis the linguistic term with smallest subscript inL1(p).The probabilities of all the added linguistic terms are assigned to zero.

Definition 7[17]:LetL(p)=｛l(k)（p(k)）|l(k)∈S,p(k)≥0,k=1,2,...,#L(p)｝be a PLTS,andr(k)be the subscript of the linguistic terml(k).L(p)is called an ordered PLTS,if the linguistic termsl(k)（p(k)）are arranged according to the values ofr(k)·p(k)in descending order.

The definition of the distance measure of Pang et al.[17]is given as follows:

Definition 8 [17]: There are two PLTSs,2,...,#L1(p)｝andL2(p)=,2,...,#L2(p)｝with#L1(p)=#L2(p),the distance measure formula is defined as follows:

This formula given by Pang et al.[17]requires ordering the PLTSs in the third step.However,the ordering process loses some information.There is an example as follows:

Example 1: there are two PLTS,L1(p)={s1(0.2),s3(0.3),s6(0.5)} andL2(p)={s2(0.1),s3(0.3),s5(0.6)}.After being processed according to Definitions 5,6,and 7,these two PLTSs are normalized asL1(p)={s6(0.5),s3(0.3),s1(0.2)} andL2(p)={s5(0.6),s3(0.3),s2(0.1)}.We can obtain the distance of these two PLTSs to be 0 by Eq.(6).However,L1(p)/=L2(p),thus the distance measure of Pang et al.[17]does not work in this case.

2.2.2 Subscript Equivalence Distance Measure

After analyzing the distance measure of Pang et al.[17],we propose the subscript equivalence distance measure.Firstly,the PLTSs should be standardized as follows:

Definition 9:Our normalization process has two steps(1)and(2),as follows:

(1)Probability normalization.If the sum of probabilities less than 1,complementing the probabilities by,so that the sum of probabilities equals 1.

(2) Reference missing term supplementation.When the linguistic term part ofL1(p)andL2(p)are not the same,adding the PLTEs that are available inL2(p)but absent fromL1(p)toL1(p),and the probability value of the PLTEs is assigned to 0.Then we can get#L1(p)=#L2(p).

According to the reference missing term supplementation,for a known PLTS,the standardized result is different when compared with different PLTS.For example,L1(p)={s1(0.3),s3(0.5)},L2(p)={s2(0.4),s4(0.4)},L3(p)={s1(0.4),s4(0.4)}.If we calculate the distance measure ofL1(p)andL2(p),the standardized result ofL1(p)isL1(p)={s1(0.375),s2(0),s3(0.625),s4(0)}.But if we calculate the distance measure ofL1(p)andL3(p),the standardized result ofL1(p)isL1(p)={s1(0.375),s3(0.625),s4(0)}.We can see that whenL1(p)calculating the distance measure with different PLTS,the standardized result ofL1(p)is different.This is the origin of the reference missing term supplementation.The standardized result of the current PLTS needs to refer to the PLTS that it is compared to.

The following is the definition of the subscript equivalence distance measure.Definition 10: LetS={sα|α=0,1,...,l} denote the reference LTS,and there are two PLTSs,2,...,#L2(p)｝,the distance between them is given by

wherer(k)denotes the subscript of the linguistic term inL1(p),lindicates the number of linguistic termsS.

The subscript equivalence distance measure satisfies the following properties:

(1)Boundedness:0 ≤d(L1(p),L2(p))≤1.

(2)Self-reflexivity:d(L1(p),L1(p))=0.

(3)Symmetry:d(L1(p),L2(p))=d(L2(p),L1(p)).

Proof.

To test the validity of the subscript equivalence distance measure,we calculate Example 1 using our distance measure.L1(p)andL2(p)are standardized toL1(p)={s1(0.2),s2(0),s3(0.3),s5(0),s6(0.5)},L2(p)={s1(0),s2(0.1),s3(0.3),s5(0.6),s6(0)},the subscript equivalence distance measure yieldsd(L1(p),L2(p))=0.44.It can be seen that the result is no longer 0.

2.2.3 Comparative Analysis

Several researchers have proposed improvements to the distance measure for PLTSs.We make a comparison between the subscript equivalence distance measure and the distance measures of other researchers.The reference LTS for the below comparison isS={sα|α=0,1,...,6}.The comparison results are shown in Table 1.From the results shown in Table 1,we can see that there are some counter-examples of existing methods that calculate the distance between two different PLTSs as 0.The subscript equivalence distance measure effectively solves such problems for the following reasons.

Table 1:Comparison of the calculation of several distance measure methods

There are only two cases that will lead to the result of the subscript equivalence distance measure equal to 0.The first scenario is thatp(k)1-p(k)2=0,k=1,2,......#L(p),which means the probabilities corresponding to the same subscripts of bothL1(p)andL2(p)are equal,implying thatandhold simultaneously.The second,max（r(k)）-min（r(k)）=0.i.e.,max（which means that there is only one PLTE in bothL1(p)andL2(p),and their subscript of the linguistic terms is not equal to 0.After probability normalization,the corresponding probability turns to 1,which also implieshold simultaneously.So we can getd(L1(p),L2(p))=0 ??L1(p)=L2(p).That is to say,the distance between two PLTSs will only be equal to 0 if and only if their subscripts of the linguistic terms and probabilities are equal correspondingly.

3 Combined Weight Method

There are two methods for obtaining weights: the subjective weights method and the objective weights method.The subjective weights method determines weights based on the inherent meaning of criteria,offering an advantage in terms of subjective interpretation.However,it may lack objectivity.On the other hand,the objective weights method determines weights independent of the actual meaning of criteria,but it fails to capture the importance that decision-makers assign to different criteria.Therefore,we combine the subjective weights method and objective weights method to obtain the combined weights method.In this section,we demonstrate the BWM method and CRITIC method and provide the combined weights calculation method.

3.1 BWM Method

The Analytic Hierarchy Process (AHP) method [48] is a subjective weights method,which compares the relative importance of evaluation criteria two-by-two.Thus the AHP method requiresn(n-1)times pairwise comparisons if there arencriteria.Besides,the comparative matrix lack of consistency judgment.The BWM method was proposed by Rezaei[49],which is derived from the AHP method and is also a subjective weights method.Different from the AHP method,the best criterion and the worst criterion of the BWM method are predetermined.Therefore,it only requires 2n-3 times pairwise comparisons,which significantly reduces the comparison times.To examine whether the preference information meets the consistency requirement,we can calculate the consistency ratio using the resulting values.

Assuming that there are n evaluation criteria(c1,c2,...,cn),the specific steps of the BWM method for getting the weights are given as follows:

Step 1: Compare n evaluation criteria,and choose the best criterioncB(B means Best) and the worst criterioncW(W means Worst)as the reference criteria.

Step 2: Determine the comparison vector BO (Best-to-Others) for the optimal criterion to the other criterion,and the comparison vector OW(Others-to-Worst)for the other criterion to the worst criterion.For simplified representation,BO is denoted asAB,and OW is denoted asAW.The following vectors can be derived.

A scale of 1–9 is used to represent the comparative relationship between the optimal criterion and other criteria,with 1 indicating that two criteria are of equal importance and 9 indicating that the former is extremely important relative to the latter.

Step 3:Calculate the optimal weights.

A nonlinear programming model is used to minimize the maximum absolute deviation value between the weight ratio value and its corresponding comparative preference value,to obtain the weight value that matches the expert opinion best.The model is defined as follows:

wherewBandwwdenote the weights of the best and worst criterion,respectively,andwjdenotes the weight of other criteria.To facilitate the solution,Model 1can be converted into the following format:

Model 2:

By solving the above model,the optimal weightsand the optimal target valuesξ?can be obtained.

The consistency ratio is calculated with the formula below:

where,CIindicates the consistency index,the corresponding values are shown in Table 2.The consistency ratioCRranges from[0,1],the smaller the value ofCR,the higher the degree of consistency of preference information.WhenCR=0,complete consistency is reached.

Table 2:Consistency indicators

3.2 CRITIC Method

The CRITIC method was proposed by Diakoulaki et al.[50]and it is an objective weights method.The method uses the contrast intensity of evaluation criteria and the conflicts between them to reflect the importance of each criterion.The greater the contrast intensity and conflict,the greater the amount of information contained,and the higher the weight of the criteria.The CRITIC method works well to calculate the criterion weights when there are correlations between the criteria,hence we use it to calculate the objective weights.The specific steps are listed below.

Step 1:Suppose that there is an initial matrix（with m alternatives and n evaluation criteria.

Step 2:To preserve the intensity of the contrast between the criteria without being affected,the normalization process is replaced by forward processing and inverse processing.If the value of the evaluation criterion should be as large as possible,then the forward processing is shown in Eq.(9).If the value of the evaluation criterion should be as small as possible,then the inverse processing is shown in Eq.(10).

Step 3:Calculate the criterion variabilitySj,expressed in terms of standard deviation.

Step 4:Calculate the criteria conflictRj.

whererijis the correlation coefficient between the criterioniand the criterionj.

Step 5:Calculate the amount of information for each criterionCj.

Step 6:Calculate the weights for each criterion

3.3 Solving for Combined Weights

Due to the different principles in weight determination between the BWM method and the CRITIC method,where the former obtains subjective weights and the latter obtains objective weights,we employ the multiplicative weighted assignment method to determine the combined weights.Letbe the combined weight of the criterion,w?be the subjective weight calculated by the BWM method,andw′be the objective weight calculated by the CRITIC method.The combined weights are calculated by the following formula [51].This formula allows for a compromise between the weight values obtained from the BWM method and the CRITIC method,thereby obtaining a more rationalized combined weight value.

4 Probabilistic Linguistic Multi-Criteria Decision-Making Method

The VIKOR method is an effective multi-criteria compromise ranking solution utilized for evaluating alternatives.The core concept revolves around establishing a positive ideal solution and a negative ideal solution by comparing alternative evaluation values with the ideal criterion value.The positive ideal solution represents the best value among the evaluation criteria,whereas the negative ideal solution represents the worst value.Through the optimization of group benefits and minimization of individual losses,a compromise solution of the alternatives can be obtained.

In this paper,we propose a novel MCDM method by integrating probabilistic linguistics with the VIKOR method.We accomplish this by aggregating evaluation information from multiple experts to derive a probabilistic linguistic initial decision matrix.Additionally,we utilize the comparison method and distance measure method of PLTSs during the calculation process to ultimately yield the decision results.The overall flowchart is shown in Fig.1.The content in the dashed box is where this paper differs from the traditional VIKOR method.

Figure 1:The overall flowchart of the probabilistic linguistic VIKOR method

For a certain multi-criteria decision problem withtdecision makers(D1,D2,...,Dt),malternatives(A1,A2,...,Am),andncriteria(C1,C2,...,Cn),the specific steps of the probabilistic linguistic VIKOR method are as follows:

Step 1:texperts score thencriteria.The scores of criteria are based on the reference LTSS={sα|α=0,1,...,4}.The meaning of each linguistic term is shown in Table 3.Experts provide the evaluation data for each criterion based on the given linguistic scale information to obtaintlinguistic term evaluation matrices.

Table 3:Rating scale

Step 2: Aggregatetevaluation matrices to obtain the initial decision matrixL.LetS={sα|α=0,1,...,l} denote an LTS,and(i=1,2,...,m,j=1,2,...,n,g=1,2,...,t)represent the preference information from the decision-makerdg.The group preference information over each alternative concerning each criterion can be derived by Eq.(3).All the PLTSs form a probabilistic linguistic decision matrixLas

Step 3: Compare the degree of superiority and inferiority of the PLTSs corresponding to each criterion using Eq.(4) and Eq.(5),the positive and negative ideal solutions of the criterion are determined.

Step 4: Compute the combined weight of the criteria.Calculate the subjective weights of the criteria by following the steps in Section 3.1.Calculate the objective weights of the criteria by following the steps in Section 3.2.Then,combine the subjective weights and objective weights using Eq.(16)to obtain the combined weights of the criteria.

Step 5: Calculate the group utility valueSi,the individual regret valueRi,and the compromise evaluation valueQiwith the following equations:

wheredenotes the combined weight of thejth criterion obtained from Eq.(16).d（Lj+,Lj-）denotes the distance measure ofLj+andLj-,which is calculated by Eq.(7).S+=maxi Si,S-=mini Si,R+=maxi Ri,R-=mini Ri.λis the weighting coefficient.λ >0.5 indicates that the value ofQiis more determined by the group utility andλ<0.5 indicates that the value ofQiis more determined by the individual regret.We setλ=0.5 in this paper.

Step 6: Rank the alternatives and obtain the decision solution.If we order the alternatives asA(1),A(2),...,A(I),...,A(m)based on the increasing value ofQi,thenA(1)would be considered the optimal solution if it meets the following conditions.

(1)Q（A(2)）-Q（A(1)）≥1/(m-1);

(2)The alternativeA(1)is the most stable optimal solution in the DM process if bothSiandRiof this alternative are optimally ordered.

If the above two conditions cannot hold simultaneously,a compromise solution is obtained.There are two cases:

(1)If only(2)is not satisfied,then the solutionsA(1)andA(2)are optimal decision results.

(2)If(1)is not satisfied,the compromise solution isA(1),A(2),...,A(I),whereA(I)is the maximizedIvalue determined byQ（A(I)）-Q（A(1)）<1/(m-1).

5 Example Analysis

In this section,we utilize a case study to confirm the validity of the proposed method.

5.1 Evaluation Criteria System of Information Security Assessment of ICSs

To enhance the information security of ICSs,China has implemented several countermeasures and introduced relevant regulations,including the group standards“Implementation Specification for Industrial Control System Security Protection Construction”and“Basic Requirements for Emergency Response Exercise of Industrial Control System Information Security Events”.These regulations guide enterprises on how to effectively safeguard the information security of ICSs.By analyzing the standard“Guideline for Security Control Application of Industrial Control Systems”(GB/T 32919-2016)[52],an evaluation criteria system is established.There are three key areas,which are subdivided into 12 second-level criteria,as illustrated in Fig.2.

Figure 2:The information security assessment of the ICSs guidelines system

In the following part,12 second-level criteria are described:

(1)Software Security:Design and implement secure and reliable software systems to protect them from cyber-attacks.

(2)Equipment Safety:Protect computers,phones,tablets,IoT devices,and other electronic devices from malicious attacks and unauthorized access.

(3)Data Security:Protect data from unauthorized access,use,disclosure,tampering,destruction,or loss.

(4)Environmental Safety:Protect information systems and networks from physical and environmental threats.

(5)Identification:Identify users to grant them access to information systems or network resources.

(6)Security Monitoring:Real-time monitoring and analysis of information systems and networks to detect and respond to potential security threats and attacks.

(7) Remote Access: Users can access information systems or network resources from a remote location via a network connection.

(8) Border Protection: Prevent unauthorized access and malicious traffic from entering the enterprise network by deploying security devices and measures at the network edge.

(9)Emergency Planning:A series of response measures developed by an organization or enterprise to protect information systems and network resources and reduce losses in the event of a security incident.

(10)Implementing Responsibilities:The organization or enterprise clarifies security management responsibilities and implements them for each employee and department.

(11) Supply Chain Management: Management and supervision of suppliers and partners of enterprise information systems and network resources.

(12) Configuration and Patches: Management and maintenance of software and configurations in information systems and networks.

5.2 Case Study

To comply with higher authority regulations,a power generation company intends to assess the security of its SCADA systems across its four city branches.Six information security professionals scored the 12 second-level criteria.We denote the 4 branches as(A1,A2,A3,A4),the 6 panelists as(D1,D2,D3,D4,D5,D6),and the 12 criteria as(C1,C2,...,C12).

Step 1:Firstly,The experts scored 12 criteria to assess the risk degree of the SCADA systems,and obtained 6 scoring matrices of linguistic terms with the following data:

Step 2:The initial probabilistic linguistic decision matrixLis obtained by aggregating each expert evaluation matrix.The positive ideal solution and negative ideal solution ofLare obtained by Eq.(4)and Eq.(5)asL+andL-,respectively.

Step 3: Based on the BWM method,experts engaged in a discussion to identify the optimal criterion,which was determined to be software security(c1).Meanwhile,the worst criterion was identified as supply chain management(c11).Subsequently,a comparison was made to assess the degree of importance among the 12 criteria.Then we got the result asAB=(1,3,2,4,2,2,3,2,4,5,7,3),AW=(7,3,4,2,4,4,3,4,2,2,1,3).Taking the data intoModel 2to obtain the subjective weights of the criteria calculated by Matlab.The results are shown in Table 4.Furthermore,by analyzing the logs,modification records,and other pertinent data from the past two years,the number of revisions and adjustments made by the managers was compiled.This data was then incorporated into the CRITIC method as the original data to obtain the objective weights of the criteria.The results are shown in Table 4.Next,calculate the combined weight by Eq.(16).The results are shown in Table 4.By the BWM method,we obtainξ?=0.3944 andCR=0.1,which is meeting the consistency requirements.Thus,the opinions of the experts are in agreement.

Table 4:Criteria weights

The combined weight data is used to generate a bar chart,as presented in Fig.3,which demonstrates a clear visualization of the rankings.Software security is the most significant criterion.The software of ICSs is typically customized to meet specific industrial control and management requirements,making it highly specialized and challenging to substitute.Data generation is also dependent on software,so software security becomes a critical aspect.In most cases,ransomware viruses are responsible for the majority of network attacks on ICSs.These malicious programs infiltrate computers,gain unauthorized access to files,and subsequently encrypt them.Therefore,the information security of ICSs is highly dependent on good border protection.Based on the data presented in Fig.3,it can be observed that the importance of border protection ranks second,closely following software security.The security of ICSs can be broadly classified into internal and external security.Internal security is closely tied to the regular work of members and emphasizes daily protection,while external security is prevention-oriented and aims to establish a protective network.

Figure 3:Combined weight bar chart

Step 4: Calculate the distance of each PLTS inLto get the positive ideal solution and negative ideal solution according to Eq.(7).Furthermore,calculate the group utility valueSi,individual regret valueRi,and compromise evaluation valueQiusing Eqs.(19)–(21),respectively.The results are shown in Table 5.

Table 5:Calculation results

Table 6:Ordering results when λ=0.1

Table 7:Ordering results when λ=0.3

Table 8:Ordering results when λ=0.7

Table 9:Ordering results when λ=0.9

According to Step 6 in Section 4,we orderedQiin ascending order and obtained the best branch asA1.The security order of the SCADA system of four branches is ordered asA1>A3>A2>A4.The ranking result shows that the security of the SCADA system ofA4needs to be strengthened when compared to other branches.

By assessing the system security situation of different branches,problems in lower-ranked branches can be identified and promptly adjusted to eliminate potential safety hazards.At the same time,ranking the branches can serve as a motivational tool,enhancing employee enthusiasm,boosting efficiency for both individuals and the organization,and fostering personal and corporate growth.

5.3 Comparative Analysis

5.3.1 Parameter Analysis

In Eq.(21),the value ofλadjusts the importance of group utility values and individual regret values.And we setλ=0.5 to calculate the ranking results.To test the stability of the proposed method,the values ofQiare calculated fromλ=0.1,λ=0.3,λ=0.7,andλ=0.9,respectively.The results are listed in the Tables 6–9 below.

From the above results,it can be seen that the final ranking of the alternatives is alwaysA1>A3>A2>A4whether relying on group utility values or individual regret values,which shows the stability of the DM method in this paper.

5.3.2 Comparison of the Proposed Method and Other DM Methods

To verify the effectiveness of the proposed method,we compared it with existing DM methods,namely PL-TODIM[25],PL-TOPSIS[24],PL-TODIM[53],PL-TODIM[54],and PL-TODIM[55]method.The comparison and result of each method ranking are as follows.From the results in Table 10,it can be seen that the results of this paper are different from those obtained by other methods.In Table 11,the differences between the DM methods used in this paper and other DM methods are listed.The reasons for the differences in the two tables are as follows.

Table 10:Ranking results of different DM methods

Table 11:Comparison of different DM methods

(1) All the DM methods outlined in Table 10 are based on the PLTSs,where the entire computational process relies on operations associated with these PLTSs.The standardization of the PLTSs used in other studies involves three steps,and the third step is ordering the PLTEs in descending order according to the multiplication of subscript of linguistic term and its probability.However,this process only focuses on the arrangement of PLTEs and overlooks the relative relationships with the PLTSs being compared,thereby resulting in a deficiency of crucial information.In contrast,the normalization method employed in this study takes a different approach.It begins by normalizing the probabilities and subsequently supplements the PLTS by incorporating the missing terms based on the subscripts of the PLTS being compared.This method completes the missing linguistic terms of the current PLTS and assigns a probability of 0,thus providing a more comprehensive comparison process.This step can align the subscripts of linguistic terms in two PLTSs.During the comparison,only the probabilistic linguistic terms with equivalence subscripts are taken into account,thereby eliminating the need to order the PLTSs.Thus the information loss caused by the previous methods is compensated through this process.The distance measure of the PL-TODIM[25],PL-TOPSIS[24],and PL-TODIM[53]are known to exist in some counter-examples,where the distance between those initially unequal PLTSs is calculated as 0.When it comes to such cases,it will lead to errors.The subscript equivalence distance measure represents a significant improvement over the existing methods.

(2)The PL-TOPSIS[24]method employs the maximum deviation method to determine criteria weights.This method only focuses on the variability of individual criteria but fails to effectively compare the differences between criteria.The PL-TODIM [25] method utilizes the probabilistic linguistic BWM method to compute weights,this method benefits from the limited number of comparisons in the BWM method.Nevertheless,the subjectivity of the method increases since all the comparison data is entirely provided by experts.The PL-TODIM [53] method employs the probabilistic linguistic entropy and probabilistic linguistic cross-entropy methods to determine weights,which can accurately capture the variability of criteria but fail to perform comparisons between criteria.Moreover,the method has a high dependency on data,making it susceptible to errors.In this paper,we propose the BWM+CRITIC method to determine the criterion weights,which combines the subjective opinions of experts with the objective data of the criteria.The BWM method can reflect the comparative relationship among criteria with a concise calculation process.By combining it with the CRITIC method,the subjectivity,objectivity,the relationship between the criteria themselves,and the relationship between criteria are considered as a whole,resulting in a more comprehensive perspective.Consequently,the weights generated through this approach exhibit a higher level of accuracy.

6 Conclusion

ICSs,functioning as the integral“brain”of industrial production,constitute a vital component of the industrial sector.Therefore,conducting an information security assessment of ICSs is essential to ensure that they work properly.This assessment is capable of assisting in identifying potential vulnerabilities and threats,enabling timely resolution,and ensuring the efficient and safe operation of industrial production.In this paper,we propose a novel subscript equivalence distance measure and verify the validity of the formula.We combine the BWM and CRITIC methods to obtain subjective weights and objective weights,then derive the combined weights of the criteria.Finally,we use the probabilistic linguistic VIKOR method to demonstrate the DM process for information security assessments of ICSs.Managers can guide the work of the company based on the assessment results.The proposed method also has some limitations.The application of the probabilistic linguistic VIKOR method depends on the operation rules of PLTSs,which shall lead to complex calculations when dealing with large volumes of data.Specifically,simultaneous consideration of subscripts of linguistic terms in PLTSs and their probabilities results in complicated calculations.Therefore,the proposed method is well-suited for decision problems with fewer alternative solutions and evaluation criteria.

In future work,further validation and empirical research are needed to assess the reliability and applicability of the proposed methods in practical applications.The proposed method can also be extended to other small forms of DM.For example,engineering quality assessment,supply chain risk assessment,etc.On the other hand,we can research the application of the proposed methods to those problems with larger datasets.

Acknowledgement:Not applicable.

Funding Statement:The authors received no specific funding for this study.

Author Contributions:The authors confirm contribution to the paper as follows:study conception and design:Wenshu Xu,Mingwei Lin;data collection:Wenshu Xu;analysis and interpretation of results:Wenshu Xu;draft manuscript preparation:Wenshu Xu,Mingwei Lin.All authors reviewed the results and approved the final version of the manuscript.

Availability of Data and Materials:Not applicable.

Conflicts of Interest:The authors declare that they have no conflicts of interest to report regarding the present study.