Bayesian and Multi-Objective Decision Support for Incident Mitigation in Cyber-Physical Systems

What is it about?

When hackers attack systems that blend physical equipment with digital controls — like power grids or water treatment plants — security teams need to respond fast, but current tools often rely on outdated assumptions and give them only one narrow view of the risk, ignoring trade-offs like "will this fix keep things running?" This research builds a smarter decision-support system that models a facility's architecture and known weaknesses using probability-based reasoning, accounts for uncertainty in how vulnerabilities are scored, and weighs multiple goals at once — how likely an attack is to succeed, how bad the damage would be, and whether the system stays operational. It then suggests combinations of countermeasures, ranked by how well they balance these competing priorities, and updates its recommendations as a threat evolves. Tested against three realistic attack scenarios, the framework helps organizations make better-informed, faster decisions when defending critical infrastructure.

Featured Image

Photo by Maximalfocus on Unsplash

Photo by Maximalfocus on Unsplash

Why is it important?

Cyber-physical systems now run much of the infrastructure society depends on — power grids, water treatment plants, transportation systems — and a cyberattack on them doesn't just risk stolen data, it can cause real-world safety incidents, outages, or physical damage. When an attack happens, security teams often have minutes, not days, to decide how to respond, yet the tools they rely on tend to assume conditions that don't hold in practice: they treat vulnerability data as complete and certain, and they judge mitigation options against a single measure of risk, ignoring the fact that a fix which reduces one danger might knock a critical system offline or be impractical to deploy under pressure. This research matters because it tackles those gaps directly, building a framework that stays honest about uncertainty in the data it uses and weighs multiple competing priorities at once, so that the mitigation strategies it recommends are realistic, defensible, and actionable in the moment they're needed. As critical infrastructure becomes more connected and attacks grow more sophisticated, decision-support tools like this one are a step toward making incident response faster and more resilient, with the ultimate goal of protecting the physical and safety-critical systems people rely on every day.

Perspectives