Chen et al. (Electronics, 2024) proposed a Bayesian-attack-graph security assessment method for power systems: static risk is computed from priors derived from CVSS severity, asset importance, and attack cost, and dynamic risk is obtained by Bayesian conditioning on intrusion-detection alerts treated as ground-truth observations. The authors state that static accuracy depends entirely on the accuracy of the prior information, and their Data Availability Statement declares that the experimental data cannot be shared; the dynamic method itself treats each IDS-detected event as a definite observation and so silently presumes timely and correct detection. General techniques for uncertain alert evidence in Bayesian security models have existed since Xie et al. (2010), and optimal detection under imperfect monitoring is known for general Bayesian attack graphs (Kazeminajafabadi and Imani, 2023 and 2024), but no prior work integrates detection-error-aware posterior updating or data-calibrated priors into power-system Bayesian attack graph assessment, and none quantifies the effect of these input uncertainties on its risk metrics. The surviving open problem is that integration and its empirical validation.

Background

Modern electric power grids are cyber–physical systems: the electrical infrastructure is monitored and controlled through layered communication networks that connect control centers, substations, and large populations of intelligent business terminals. This connectivity exposes the grid to multi-stage cyberattacks in which an adversary chains exploits of individual vulnerabilities to progress from an entry point to high-value assets, as illustrated by the 2015 Ukraine power outage. Assessing and quantifying this risk is a prerequisite for allocating defensive resources.

An attack graph is a directed graph representation of the chained exploit steps (atomic attacks) available in a network; each node represents a resource, privilege, or vulnerability state. A Bayesian attack graph (BAG) upgrades this to a probabilistic graphical model: nodes are binary random variables indicating whether the corresponding resource is compromised, and conditional probability tables (CPTs) — tables giving each node's probability given the states of its parent nodes, combined by logical AND or OR over the parents — quantify how compromise propagates. Frigault and Wang (COMPSAC 2008) extended static BAG metrics to dynamic Bayesian networks; Poolsappasit, Dewri, and Ray (IEEE TDSC 2012) established the canonical dynamic risk management formulation, deriving CPTs from CVSS scores (the Common Vulnerability Scoring System, an industry-standard 0–10 severity score assigned to disclosed software vulnerabilities) and updating risk by Bayes' rule when node states are observed. An intrusion-detection system (IDS) is software that raises alerts when network or host activity matches attack signatures or anomalies; like any detector, an IDS commits false positives (alerting without a real attack) and false negatives (missing real attacks).

Chen et al. (Electronics 13(13):2628, 2024) adapted this line to power-system infrastructures. Their static assessment derives each attack node's success probability from CVSS exploitability and each attack's initiation probability from asset importance and attack cost, then propagates prior probabilities over all resource nodes; their dynamic assessment treats an IDS-detected attack event as an observation that fixes the corresponding node to a definite value (hard evidence) and computes posterior probabilities of all other nodes by Bayesian conditioning; attack paths are ranked by reachability probability, and a normalized mean of path probabilities (NMPP, their aggregate security metric) tracks overall risk level.

Three gaps underlie the open problem formulated below: the first is stated in the paper itself, as motivation for its dynamic update; the second follows from the update mechanism rather than any explicit statement; and the third appears in the journal's Data Availability Statement. First, "the accuracy of static risk assessment based on prior knowledge depends on the accuracy of the prior information, it does not always reflect the actual state of the system" — the priors come from static severity scores and engineering judgment, not from data on what is actually exploited. Second, the dynamic update silently assumes the IDS is timely and error-free: a detected event is set to certainly true, so false positives inflate and false negatives suppress the computed risk in ways the method cannot represent. Third, the Data Availability Statement declares that "all data are unavailable due to privacy restrictions", so the numeric demonstration cannot be externally replicated. Treating an alert as hard evidence contrasts with soft (virtual) evidence, the standard alternative in which an alert enters the Bayesian network as a likelihood-weighted observation whose reliability is an explicit parameter.

The surrounding literature has parts of the answer but not the whole. Xie, Li, Ou, Liu, and Levy (DSN 2010) modeled IDS sensors as child nodes of attacker-action nodes whose CPTs express false-positive and false-negative probabilities explicitly; Chen et al. cite this work but do not adopt the technique. Muñoz-González, Sgandurra, Paudice, and Lupu (ACM TOPS 2017) made BAG inference scale to thousands of nodes via loopy belief propagation for both static analysis and dynamic analysis on evidence of compromise. Kazeminajafabadi and Imani (Cybersecurity, 2023) and Kazeminajafabadi, Ghoreishi, and Imani (ACC 2024) derived optimal minimum-mean-square-error attack detection and monitoring policies for general BAGs under partial and imperfect monitoring, explicitly rejecting the assumption that routine monitoring detects all compromises. On the prior side, the Exploit Prediction Scoring System (EPSS; Jacobs et al., ACM Digital Threats, 2021) provides open, data-driven probabilities that a vulnerability will be exploited in the wild, and Kausar, Batiste, Muallem, and Hussain (Energy Informatics, 2026) built a public cyber-physical-power-system vulnerability dataset of over 4,030 CVEs (2020–2025) enriched with CVSS, CISA KEV (the Known Exploited Vulnerabilities catalog of actively exploited bugs), and EPSS attributes, from which they learn CPPS-specific exploitation likelihoods. None of these works is connected to the power-system BAG assessment pipeline of the source, and none quantifies what detection errors or prior misspecification do to its risk outputs.

Problem Statement

Develop and validate a dynamic security-risk assessment method, of the Bayesian-attack-graph class introduced by Chen et al. (Electronics, 2024) for power systems, whose risk estimates demonstrably reflect the actual state of the system despite the two input uncertainties that the source method leaves unmodeled. The single scientific objective is a probabilistically honest, empirically checkable assessment pipeline, and the requested results jointly serve it as follows.

(1) Detection-error-aware posterior updating. Replace the current hard-evidence treatment — an IDS-detected attack event fixes the corresponding resource node to a definite value — with an update that no longer treats a detected event as certainly true and that is parameterized by the detection error rates (false-positive and false-negative probabilities) of the deployed IDS, and characterize how these error rates propagate through the Bayesian attack graph to the posterior node probabilities, the attack-path reachability probabilities and rankings, and the aggregate security metric (NMPP). The error rates are parameters of the model, not fixed numbers; the characterization should cover the regimes relevant to operational power-system deployments, including the effect of missed detections on risk underestimation and of false alerts on risk overestimation.

(2) Prior calibration and sensitivity. Ground the static assessment's priors — exploitability probabilities derived from CVSS severity and initiation probabilities derived from asset importance and attack cost — in verifiable exploitation evidence, and quantify the sensitivity of the static risk metrics to prior misspecification, including for large or evolving deployments whose topologies and terminal populations change over time.

(3) Empirical validation. Demonstrate the resulting method on power-system scenarios or datasets with documented provenance and known or verifiable ground truth, so that the numeric behavior of the assessment under varying prior quality and detection quality can be checked against the actual system state, rather than resting on the private, unavailable data of the source demonstration.

Components (1) and (2) address the two input uncertainties that the source method leaves unmodeled — unreliable alert evidence and uncalibrated priors — while component (3) makes the resulting numeric behavior inspectable against a known ground truth.

References

  1. Lu Chen, Tao Zhang, Yuanyuan Ma, Yong Li, Chen Wang, Chuan He, Zhuo Lv, Nuannuan Li, "A Bayesian-Attack-Graph-Based Security Assessment Method for Power Systems", Electronics 13(13):2628, 2024. DOI: 10.3390/electronics13132628, https://doi.org/10.3390/electronics13132628
  2. Peng Xie, Jason H. Li, Xinming Ou, Peng Liu, Renato Levy, "Using Bayesian Networks for Cyber Security Analysis", in Proceedings of the 2010 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2010, pp. 211–220. DOI: 10.1109/DSN.2010.5544924, https://doi.org/10.1109/DSN.2010.5544924
  3. N. Poolsappasit, R. Dewri, I. Ray, "Dynamic Security Risk Management Using Bayesian Attack Graphs", IEEE Transactions on Dependable and Secure Computing 9(1):61–74, 2012. DOI: 10.1109/TDSC.2011.34, https://doi.org/10.1109/TDSC.2011.34
  4. Marcel Frigault, Lingyu Wang, "Measuring Network Security Using Bayesian Network-Based Attack Graphs", in Proceedings of the 2008 32nd Annual IEEE International Computer Software and Applications Conference (COMPSAC), 2008, pp. 698–703. DOI: 10.1109/COMPSAC.2008.88, https://doi.org/10.1109/COMPSAC.2008.88
  5. Luis Muñoz-González, Daniele Sgandurra, Andrea Paudice, Emil C. Lupu, "Efficient Attack Graph Analysis through Approximate Inference", ACM Transactions on Privacy and Security 20(3):1–30, 2017. DOI: 10.1145/3105760, https://doi.org/10.1145/3105760
  6. Armita Kazeminajafabadi, Mahdi Imani, "Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs", Cybersecurity 6, 2023. DOI: 10.1186/s42400-023-00155-y, https://doi.org/10.1186/s42400-023-00155-y
  7. Armita Kazeminajafabadi, Seyede Fatemeh Ghoreishi, Mahdi Imani, "Optimal Detection for Bayesian Attack Graphs Under Uncertainty in Monitoring and Reimaging", in 2024 American Control Conference (ACC), 2024. DOI: 10.23919/ACC60939.2024.10644873, https://doi.org/10.23919/ACC60939.2024.10644873
  8. Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Idris Adjerid, Michael Roytman, "Exploit Prediction Scoring System (EPSS)", ACM Digital Threats: Research and Practice 2(3):1–17, 2021. DOI: 10.1145/3436242, https://doi.org/10.1145/3436242
  9. Firdous Kausar, Lisette Batiste, Asmah Muallem, Sajid Hussain, "Integrated risk scoring and exploit prediction for cyber-physical power system vulnerabilities", Energy Informatics 9(1):1–22, 2026. DOI: 10.1186/s42162-026-00640-x, https://doi.org/10.1186/s42162-026-00640-x
  10. Mostafa Arjmand, Behzad Akbari, Hamid Reza Ghaeini, "From voltage to vulnerability: A comprehensive survey of dynamic security risk assessment techniques in smart grids", International Journal of Information Security 25(1), 2025. DOI: 10.1007/s10207-025-01173-2, https://doi.org/10.1007/s10207-025-01173-2
  11. Arda Bayer, David Maluf, Behnaam Aazhang, "Network Risk Estimation: A Risk Estimation Paradigm for Cyber Networks", ACM Transactions on Privacy and Security, 2026. DOI: 10.1145/3834769, https://doi.org/10.1145/3834769
  12. Fangfang Dang, Xun Zhao, Lijing Yan, Kehe Wu, Shuai Li, "Research on network intrusion response method based on Bayesian attack graph", in 2023 3rd International Conference on Consumer Electronics and Computer Engineering (ICCECE), 2023, pp. 639–645. DOI: 10.1109/ICCECE58074.2023.10135239, https://doi.org/10.1109/ICCECE58074.2023.10135239
  13. Yuanzhi Li, Wei Chen, Wei Tang, Xun Mao, Haijun Yu, Kai Lv, Hao Zhang, Junjiang He, "Fine-Grained Dynamic Attack Tree Modeling for Multi-Stage Cyber Attack Risk Assessment in Cyber-Physical Power Systems", in 2026 IEEE 4th International Conference on Power Science and Technology (ICPST), 2026, pp. 530–536. DOI: 10.1109/ICPST69917.2026.11637696, https://doi.org/10.1109/ICPST69917.2026.11637696