Adapting an Agent-Based Model of Socio-Technical Systems to Analyze Security Failures

An agent-based model of a socio-technical system is built by modifying the components of an existing model from a different domain. This includes adapting an agent decision-making and communication model, a task workflow model, and a performance model. The goal is to enable the modeling of scenarios related to critical infrastructure system failures for use in computer security simulations. This scenario models the non-intentional complex system failure which resulted in the 2003 Northeast Blackout, focusing on the people, tools, and organizations involved. The adapted model formalizes and explains the Blackout's causes, and transforms them into a security scenario. An agent-based framework allows us to implement the model and perform multiple iterations of the simulation. We study features of the output, and conduct experiments adjusting the assignment of tasks to increase the system's robustness to failure.