Bayesian and Multi-Objective Decision Support for Real-Time Incident Mitigation in Critical Infrastructure

TL;DR

This work tackles real-time incident mitigation in cyber-physical CI by marrying Bayesian Networks with multi-objective optimisation to produce Pareto-optimal countermeasure portfolios under tight time and resource constraints. It introduces confidence-calibrated exposure probabilities by fusing CVSS, EPSS, KEV, and LEV within BN-based risk graphs, and operationalises these into a running decision loop that updates mitigation choices and propagates effects through BAG/BIG structures. The framework is demonstrated on three CI scenarios—the BlackEnergy Ukrainian power grid attack, a solar PV inverter network, and a railway CBTC system—showing robust, adaptive decision support and revealing practical trade-offs between attack likelihood, impact, and availability. The contributions include a DSL-enabled BN model, a hybrid exposure estimation mechanism, an iterative multi-objective optimisation workflow with frequency-based prioritisation, and open-source code to support reproducibility and real-world deployment.

Abstract

Critical infrastructure increasingly relies on interconnected cyber-physical systems whose security incidents can escalate rapidly into safety and operational failures. Existing decision-support approaches struggle to support real-time incident response because they rely on static assumptions, incomplete vulnerability data, and single-objective risk models that do not adequately capture trade-offs between attack likelihood, impact severity, and system availability. This paper proposes a real-time, adaptive decision-support framework for incident mitigation in critical infrastructure that combines hierarchical system modelling with Bayesian probabilistic reasoning. The framework leverages probabilistic graphical models (Bayesian Networks) constructed from system architecture and vulnerability data, and employs confidence-calibrated exposure estimation to integrate complementary vulnerability scoring metrics under epistemic uncertainty. Mitigation strategies are explored as countermeasure portfolios and refined using multi-objective optimisation to identify Pareto-optimal trade-offs suitable for time- and resource-constrained response scenarios. Frequency-based heuristics are applied to prioritise robust mitigation actions across optimisation runs. The framework is evaluated on three representative cyber-physical attack scenarios, demonstrating its ability to adapt to evolving threats and provide actionable decision support under real-time constraints, thereby enhancing the operational resilience of critical infrastructure.

Figures (10)

• Figure 1: Architecture of our proposed critical infrastructure security framework. The diagram shows an iterative process integrating a CPS model (vulnerabilities, hazards, assets, exposure/impact probability attributes) with BN construction (BAG and BIG). Multi-objective optimisation generates Pareto-optimal countermeasure portfolios, updating model attributes and propagating exposure/impact probabilities. Frequency heuristic analysis selects the optimal portfolio.
• Figure 2: Bayesian Network of a hypothetical cyber-physical attack on solar PV inverters connected to a power grid. Node colours denote assets (orange), vulnerabilities (green), hazards (yellow), attack feasibility (cyan), and attacker goal (red). A high-resolution version of the graph is available in the project’s GitHub repository Huang_GitHub.
• Figure 3: Pareto fronts derived over 10,000 multi-objective optimisation trials in the solar PV inverter case study
• Figure 4: Average rank positions of mitigation probabilities across 100 runs of 10,000 optimisation trials in each run
• Figure 5: Bayesian Network of the Ukrainian power grid (BlackEnergy) attack, adapted from the attack tree model by Kumar et al. Kumar2022. Node colours denote assets (orange), vulnerabilities (green), hazards (yellow), attack feasibility (cyan), and attacker goal (red). The graph shows how exploits and attack procedures propagate through CPS assets to cause grid disruption and support probabilistic risk analysis. A high-resolution version is available in the project’s GitHub repository (Huang_GitHub).