💻 computer science

Bayesian and Multi-Objective Decision Support for Real-Time Incident Mitigation in Critical Infrastructure

This paper proposes a real-time, adaptive decision-support framework for critical infrastructure incident mitigation that integrates hierarchical system modeling, Bayesian probabilistic reasoning, and multi-objective optimization to dynamically identify Pareto-optimal countermeasure portfolios under uncertainty and resource constraints.

Original authors: Shaofei Huang, Christopher M. Poskitt, Lwin Khin Shar

Published 2026-02-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shaofei Huang, Christopher M. Poskitt, Lwin Khin Shar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the captain of a massive, high-speed ship (our Critical Infrastructure, like a power grid or a railway system). This ship is powered by a complex engine room where digital computers control physical gears, valves, and turbines.

Suddenly, a storm hits. But this isn't just rain and wind; it's a digital storm. Hackers are trying to jam the ship's navigation systems, trick the engine controls, or even steer the ship off course.

The problem? The old rulebooks for handling emergencies are broken. They assume the storm is static, they don't know exactly how bad the damage is, and they only look at one thing at a time (like "how do we stop the hackers?" without asking "will stopping them crash the engine?").

This paper proposes a new, smart co-pilot for your ship. Here is how it works, using simple analogies:

1. The "Living Map" (Bayesian Networks)

Instead of a static paper map, this system uses a living, breathing 3D hologram of your ship.

How it works: It connects the dots between the digital code (the software) and the physical parts (the gears). If a hacker tricks a sensor (a digital node), the map instantly shows you which valve might burst (a physical node) and how likely that is to happen.
The Magic: If new information comes in (e.g., "The hacker just tried to enter through the Wi-Fi"), the map instantly updates. It doesn't just say "Risk is high"; it calculates the probability of the ship sinking based on the current situation.

2. The "Confidence Calculator" (Handling Uncertainty)

Sometimes, you don't have perfect information. Maybe you know a part is old, but you don't have the exact manual for it.

The Analogy: Imagine a weather forecaster. Sometimes they have satellite data (perfect info). Sometimes they only have a barometer and a gut feeling (imperfect info).
The Solution: This system acts like a super-smart forecaster. It takes the "perfect" data (known hacker tricks) and the "gut feelings" (estimates for unknown weaknesses) and blends them together. It uses a math trick called Bayesian Calibration to say, "We aren't 100% sure, but we are 90% confident this part is weak." This prevents the system from panicking over guesses or ignoring real dangers.

3. The "Tug-of-War" (Multi-Objective Optimization)

When you are under attack, you can't just fix everything at once. You have limited time and limited tools.

The Dilemma: If you patch the software to stop the hackers, the patch might be buggy and cause the engine to overheat. If you shut down the system to be safe, you stop delivering electricity to the city.
The Solution: The system plays a game of Tug-of-War. It pulls on three ropes simultaneously:
1. Security: Stop the hackers.
2. Safety: Don't let the physical machine explode.
3. Availability: Keep the lights on.
It runs thousands of simulations in seconds to find the "Perfect Balance Point" (Pareto-optimal). It tells you: "If you apply these 3 specific patches, you stop 90% of the attacks, keep the engine running, and only lose 5% of your power."

4. The "Crowd Wisdom" (Frequency Heuristics)

The system doesn't just run the simulation once; it runs it 10,000 times, like a chef tasting a soup 10,000 times to get the seasoning right.

The Analogy: Imagine asking 10,000 experts, "Which door should we lock first?"
The Result: If 9,000 of them say, "Lock the front door," the system knows that's the most important one. It ignores the noise and focuses on the actions that consistently work best across all scenarios. This helps the captain make a decision quickly, even when time is running out.

Real-World Examples from the Paper

The authors tested their "Smart Co-pilot" on three real-life scenarios:

Solar Panels: They simulated hackers trying to trick solar inverters to destabilize the power grid. The system figured out which specific software flaws were the "weakest links" to fix first.
The Ukrainian Power Grid (BlackEnergy): They looked at a real historical attack where hackers shut down a whole city. The system showed that to stop this, you can't just patch one thing; you have to defend many doors at once, or the hackers will just find another way in.
Railway Systems: They simulated hackers trying to mess with train signals. The system realized that even if the chance of a hack is low, the consequence (a train crash) is so high that you must be extremely careful.

The Bottom Line

This paper gives infrastructure operators a dynamic, intelligent dashboard. Instead of guessing or following a rigid checklist, they can see the "what-ifs" in real-time. It helps them make the hardest choice: How do we stop the bad guys without crashing the system?

It turns a chaotic, high-stress emergency into a calculated, data-driven decision, ensuring that our power grids, railways, and water systems stay safe, secure, and running.

1. Problem Statement

Critical Infrastructure (CI) increasingly relies on interconnected Cyber-Physical Systems (CPS), where security incidents can rapidly escalate into physical safety hazards and operational failures. Existing decision-support frameworks for incident response suffer from three primary limitations:

Static Assumptions: They rely on fixed model parameters and cannot dynamically update vulnerability exposure probabilities or asset interdependencies in real-time as an incident unfolds.
Incomplete Data Handling: They struggle with epistemic uncertainty, particularly when dealing with proprietary vulnerabilities lacking Common Vulnerabilities and Exposures (CVE) identifiers or heterogeneous metadata.
Single-Objective Focus: Traditional models often optimize for a single metric (e.g., risk reduction) without adequately balancing the trade-offs between attack likelihood, impact severity (safety/financial), and system availability. In CI, aggressive mitigation (e.g., patching) can sometimes induce system failures, making a multi-objective approach essential.

2. Methodology

The authors propose a real-time, adaptive decision-support framework that integrates Bayesian Networks (BN) with Multi-Objective Optimization and Frequency-Based Heuristics. The methodology consists of the following core components:

A. Bayesian Network (BN) Modeling

The framework constructs a probabilistic graphical model representing the CPS architecture, including:

Nodes: Assets, Vulnerabilities (CVE and non-CVE), and Hazards (physical failures).
Structure: Directed edges encode causal dependencies for attack propagation (Bayesian Attack Graph - BAG) and impact propagation (Bayesian Impact Graph - BIG).
Dynamic Updates: The model is encoded in a Domain-Specific Language (DSL) using AutomationML, allowing for rapid structural and parameter updates as new threat intelligence arrives.

B. Hybrid Exposure Probability Estimation

To address data uncertainty, the framework employs a Bayesian confidence calibration technique to fuse multiple vulnerability scoring metrics:

For CVE-linked vulnerabilities: It aggregates scores from EPSS (Exploit Prediction Scoring System), LEV (Likely Exploited Vulnerabilities), and KEV (Known Exploited Vulnerabilities). It uses a "maximal-envelope" approach where KEV acts as a logical ceiling (probability = 1 if confirmed exploited).
For Non-CVE vulnerabilities: It derives proxy scores from CVSS exploitability metrics and calibrates them using a Gaussian prior. This Bayesian inference produces a posterior distribution ( $\mu_{post}, \sigma^2_{post}$ ) that quantifies the exposure probability while accounting for the uncertainty of the proxy data.
Attack Feasibility (AF): A modifier ( $\phi$ ) adjusts probabilities based on system defense posture and adversary capabilities.

C. Multi-Objective Optimization

The framework treats mitigation strategies as countermeasure portfolios (tuples of mitigation probabilities for each vulnerability). It uses the Optuna library to perform multi-objective optimization to find Pareto-optimal solutions that simultaneously:

Minimize the probability of successful attack (Exposure).
Minimize the probability of severe impact (Safety/Operational/Financial).
Maximize System Availability (avoiding mitigation-induced failures).

The optimization accounts for risk-adjusted failure probabilities, acknowledging that applying security patches to legacy CPS assets can sometimes cause system degradation.

D. Frequency-Based Heuristic Analysis

To handle time and resource constraints during real-time response, the framework runs multiple optimization trials. It then applies frequency-based heuristics to analyze the Pareto-optimal portfolios. Vulnerability nodes that consistently appear in high-performing portfolios across trials are ranked as high-priority targets for immediate mitigation.

3. Key Contributions

Real-Time Adaptive BN Framework: A novel approach for CI incident response that moves beyond offline risk analysis, enabling dynamic updates to model structure and parameters via a DSL.
Confidence-Calibrated Exposure Estimation: A hybrid method that integrates CVSS, EPSS, LEV, and KEV metrics using Bayesian calibration, providing robust risk estimates even for vulnerabilities without CVEs or under incomplete data conditions.
Multi-Objective Decision Support: A methodology that explicitly balances security, safety, and availability, identifying Pareto-optimal countermeasure portfolios rather than a single "best" solution.
Frequency-Based Prioritization: A heuristic mechanism to distill complex optimization results into actionable, prioritized lists of mitigation actions suitable for time-critical scenarios.
Open-Source Validation: The release of models, source code, and reference data to ensure reproducibility and transparency.

4. Experimental Results

The framework was evaluated on three representative CI scenarios:

Solar PV Inverter System (Running Example):
- Demonstrated the ability to handle both CVE and non-CVE vulnerabilities.
- Identified that vulnerabilities V1–V4 were critical entry points with consistently high mitigation effectiveness.
- Revealed a systemic regularity where higher availability scenarios correlated with specific impact levels, suggesting latent causal structures.
Ukrainian Power Grid (BlackEnergy Attack):
- Applied to the 2015 attack scenario.
- Results showed that aggressive mitigation improved availability but did not fully suppress residual severe impact due to structural interdependencies.
- Key Insight: Effective mitigation requires a distributed strategy across multiple nodes simultaneously; focusing on a subset of vulnerabilities yields diminishing returns.
Railway CBTC System (Hypothetical Attack):
- Evaluated the framework's robustness using non-CVE vulnerabilities calibrated against synthetic EPSS priors.
- Found that optimization results favored system availability over total attack prevention, as the system architecture offered no mitigation for impact once the attack goal was achieved.
- Key Insight: Frequency analysis showed that while CVSS-based priors suggested uniform mitigation, EPSS-based priors suggested more targeted strategies, highlighting the value of multi-metric integration.

Computational Efficiency:

Parallelization using concurrent.futures reduced execution time for 10,000 trials from ~15 minutes to ~5 minutes.
Stability Analysis: Experiments indicated that 5,000 trials are sufficient to generate structurally consistent Pareto fronts, balancing computational cost with result reliability.

5. Significance and Implications

This research provides a critical bridge between theoretical risk modeling and the practical realities of Critical Infrastructure protection.

Operational Resilience: By explicitly modeling the trade-off between security interventions and system availability, the framework prevents "security over-reaction" that could destabilize physical processes.
Handling Uncertainty: The Bayesian calibration technique allows operators to make informed decisions even when facing incomplete threat intelligence or legacy systems with undocumented vulnerabilities.
Actionable Guidance: The frequency-based heuristic transforms complex mathematical outputs into clear, prioritized action plans for SOC operators under strict time constraints.
Scalability: The modular design and open-source nature of the framework allow it to be adapted to various CI domains (energy, transport, water) and integrated into existing Security Operations Center (SOC) workflows.

In conclusion, the paper presents a robust, mathematically grounded framework that enables CI operators to navigate the complex, multi-dimensional space of cyber-physical threats, ensuring that incident response enhances rather than compromises the resilience of critical systems.