Related Experiment Videos
Cyber Defense Effectiveness Evaluation for ICS Under Uncertainty: A Dynamic Bayesian Network Approach with
Rongbao Kang1,2, Zhiyong Zhang2, Xiao Zhang2
1School of Cyberspace Security, University of Science and Technology of China, Hefei 230026, China.
Entropy (Basel, Switzerland)
|June 26, 2026
Summary
This study introduces a Dynamic Bayesian Network (DBN) framework to manage uncertainties in Industrial Control Systems (ICS) cyber defense planning. It quantifies defense strategy effectiveness and prediction uncertainty for improved resilience.
Area of Science:
- Cybersecurity
- Control Systems Engineering
- Artificial Intelligence
Background:
- Industrial Control Systems (ICS) cyber defense planning faces significant challenges due to epistemic and aleatoric uncertainties.
- Limited observability and incomplete knowledge of attacker strategies (epistemic) complicate defense assessments.
- Stochastic state transitions and inter-device dependencies (aleatoric) further hinder quantitative evaluation of defense strategies.
Purpose of the Study:
- To develop a novel framework for proactive defense planning in ICS that explicitly models multiple sources of uncertainty.
- To quantitatively assess the effectiveness and prediction uncertainty of cyber defense strategies before deployment.
- To provide theoretical and methodological support for resilience-oriented cyber defense in ICS.
Main Methods:
- A Dynamic Bayesian Network (DBN)-based framework was developed to model four key sources of uncertainty.
- The expectation of the effectiveness differential was coupled with its information entropy to quantify performance and prediction uncertainty.
- A case study on a substation automation system and ablation experiments were used for validation.
Main Results:
- The DBN framework effectively distinguishes the relative effectiveness of different defense strategies.
- The framework demonstrates robustness, maintaining reliable assessment results even with up to 15% noise in Conditional Probability Tables (CPTs).
- Ablation experiments quantified the impact of observability, dependency propagation, and attacker strategy on prediction uncertainty, revealing a coupling between epistemic and aleatoric uncertainty.
Conclusions:
- The proposed DBN framework offers a robust method for managing uncertainties in ICS cyber defense planning.
- The research provides valuable insights into the interplay of different uncertainty types and their impact on defense strategy effectiveness.
- This work supports the development of more resilient cyber defense strategies for critical infrastructure.
Related Concept Videos
02:39Entropy
Salt particles that have dissolved in water never spontaneously come back together in solution to reform solid particles. Moreover, a gas that has expanded in a vacuum remains dispersed and never spontaneously reassembles. The unidirectional nature of these phenomena is the result of a thermodynamic state function called entropy (S). Entropy is the measure of the extent to which the energy is dispersed throughout a system, or in other words, it is proportional to the degree of disorder of a...
01:18Entropy
The first law of thermodynamics is quantitatively formulated via an equation relating the internal energy of a system, the heat exchanged by it, and the work done on it. A quantitative formulation of the second law of thermodynamics leads to defining a state function, the entropy.
When an ideal gas expands isothermally, the disorder in the gas increases. From the molecular perspective, the gas molecules have more volume to move around in.
Consider an infinitesimal step in the expansion, which...
When an ideal gas expands isothermally, the disorder in the gas increases. From the molecular perspective, the gas molecules have more volume to move around in.
Consider an infinitesimal step in the expansion, which...
01:10Propagation of Uncertainty from Systematic Error
The atomic mass of an element varies due to the relative ratio of its isotopes. A sample's relative proportion of oxygen isotopes influences its average atomic mass. For instance, if we were to measure the atomic mass of oxygen from a sample, the mass would be a weighted average of the isotopic masses of oxygen in that sample. Since a single sample is not likely to perfectly reflect the true atomic mass of oxygen for all the molecules of oxygen on Earth, the mass we obtain from this particular...
00:59Propagation of Uncertainty from Random Error
An experiment often consists of more than a single step. In this case, measurements at each step give rise to uncertainty. Because the measurements occur in successive steps, the uncertainty in one step necessarily contributes to that in the subsequent step. As we perform statistical analysis on these types of experiments, we must learn to account for the propagation of uncertainty from one step to the next. The propagation of uncertainty depends on the type of arithmetic operation performed on...
00:59Uncertainty: Overview
In analytical chemistry, we often perform repetitive measurements to detect and minimize inaccuracies caused by both determinate and indeterminate errors. Despite the cares we take, the presence of random errors means that repeated measurements almost never have exactly the same magnitude. The collective difference between these measurements - observed values - and the estimated or expected value is called uncertainty. Uncertainty is conventionally written after the estimated or expected value.
01:14The Entropy as a State Function
Consider an arbitrary process that moves between two specific states (A and B) in a cyclic manner. This process is reversible and broken down into smaller parts that each follow a Carnot cycle. A Carnot cycle has two isothermal (constant temperature) processes. During these processes, the ratio of the amount of heat transferred to their respective temperature remains constant. The other two processes in the Carnot cycle are also reversible but adiabatic, which means they occur without any heat...