Source-linked AI summary
From Security Events to Conflict States: A Three-layer Cyber Defense Scenario Model for Enhanced Cyber Situational Awareness
Miguel Requena Micó, Mario Fernandez-Tarraga, Daniel Díaz-López, Sergio López Bernal, Gregorio Martínez Pérez
TL;DR
Mission-critical cyber defense requires a unified way to represent adversarial progression, uncertain telemetry, mission impact, and defensive decisions. The paper develops a three-layer probabilistic CSA framework with a NetLogo simulation prototype and reports coherent relationships among progression, uncertainty management, mission assessment, and cost-aware response. Its validation remains scenario-based and illustrative rather than evidence of operational effectiveness.
Problem
Existing cyber-defense representations only partially integrate adversarial progression, telemetry inference, operational state, mission risk, and defensive response under incomplete observations.
Method
The paper combines an attack-progression graph, telemetry-driven Bayesian event inference, conflict-state and mission-risk abstraction, and a one-step defensive action rule in an executable NetLogo prototype.
Results
The framework and implementation preserve coherent relationships among attack progression, telemetry-driven uncertainty management, mission-impact assessment, and cost-aware defensive decision support.
Takeaways & Limitations
The framework provides a mission-oriented CSA loop connecting posterior beliefs to conflict states, mission risk, and immediate defensive action selection.
Takeaways & Limitations
Validation is scenario-based and illustrative, using a controlled synthetic topology and representative traces rather than statistically exhaustive experiments.
Abstract
from arXiv · showhide
Cyber defense in mission-critical environments requires integrated approaches capable of representing adversarial progression, defender-side uncertainty, mission impact, and defensive decision support within a unified framework. In operational domains, defenders must continuously estimate the evolving security posture while preserving the continuity and integrity of mission-critical functions under incomplete and noisy observations. This paper presents a mission-oriented cyber-defense framework for Cyber Situational Awareness (CSA) and decision support based on a three-layer integrated probabilistic model and an executable simulation prototype. The model combines: (i) an attack-graph model that represents possible adversarial progression through mission-relevant assets, (ii) an event model that transforms observed telemetry into posterior defender beliefs through Bayesian inference, and (iii) a state model that abstracts the inferred posture into conflict states and mission-risk levels. These components are connected to a one-step defensive action rule that balances estimated residual mission risk and operational cost. The framework is instantiated in a NetLogo agent-based simulation of an operational environment structured across the Tactical Edge Zone (TEZ), Mission Operations Zone (MOZ), and Enterprise Support Zone (ESZ). The proposal is assessed through mathematical consistency analysis, local robustness assessment under telemetry perturbations, and representative simulation traces. Results indicate that the framework and its implementation preserve coherent relationships between attack progression, telemetry-driven uncertainty management, mission-impact assessment, and cost-aware defensive decision support guided by mission-risk prioritization.
1 Introduction
The paper frames cyber defense as a mission-oriented CSA problem requiring integration of hidden adversarial progression, noisy telemetry interpretation, mission impact, and constrained defensive response. It proposes a three-layer model with an executable simulation and validates the framework through analytical and scenario-based methods.
- Motivation: Mission-critical defense requires understanding adversarial progression across interconnected assets, interpreting partial telemetry, and prioritizing responses by mission impact.The motivating mission functions include ISR availability and C2 continuity.
- Motivation: Existing models provide partial CSA because structural attack paths, telemetry evidence, and decision-making under partial observability are not fully unified.The paper identifies a need to connect progression, inference, operational state, mission risk, and response in one loop.
- Contributions: The proposed framework combines a three-layer mathematical model with an executable simulation prototype for mission-oriented CSA and decision support.The layers capture hidden attacker dynamics, probabilistic belief updates, posture abstraction, mission risk, and defensive action selection.
- Validation: The model is assessed through mathematical consistency arguments, local robustness analysis under observation-model perturbations, and representative simulation traces.The validation is scenario-based and supports inspection of interactions among attacker progression, mission impact, and defensive response.
- Organization: The paper is organized around related work, mathematical modeling, simulation adaptation, validation results, and conclusions with future research directions.
2 Related Work
Related work offers separate formalisms for adversarial structure, probabilistic inference, temporal uncertainty, causal reasoning, and strategic response. The paper identifies insufficient integration across these capabilities for holistic, mission-oriented CSA.
- Attack graphs: Attack graphs represent multi-step adversarial progression using vulnerabilities, reachability, privilege dependencies, and rule-based preconditions or postconditions.Practical tools also emphasize scalable attack-graph generation for network defense.
- Probabilistic and mission-centric models: Bayesian Attack Graphs combine attack-graph structure with Bayesian semantics to support dynamic security risk management and inference from cyber evidence.Mission-centric extensions additionally incorporate mission impact and decision support, but the surveyed approaches remain incompletely integrated.
- Temporal and decision models: Hidden Markov Models and POMDPs address temporal uncertainty and decision-making from partial observations, although sequential models may compress branching attacker behavior.
- Causal and strategic models: Fuzzy Cognitive Maps emphasize interpretable weighted causal relations, while game-theoretic models represent strategic attacker-defender interaction and adaptive defense.These approaches do not naturally provide the full telemetry-driven Bayesian treatment of multi-step attack dependencies described in the paper.
- Research gap: Existing research remains fragmented across technical events, attack progression, probabilistic reasoning, temporal decision-making, and mission-oriented considerations.The paper positions broader integration as a way to support a more holistic view of cyber defense scenarios and CSA maturity.
3 Mathematical Mission-Oriented Cyber-Defense Model
The framework integrates graph-based adversarial progression, telemetry-driven Bayesian inference, conflict-state abstraction, mission-risk assessment, and cost-aware immediate defensive action within one CSA loop.
- Integrated framework: The model combines a progression graph, an event model, and a state model with a defensive action rule for mission-oriented CSA.The graph represents adversarial progression, events update beliefs from noisy observations, and states summarize operational posture and mission risk.
- Graph model: The progression graph encodes hidden attack conditions as binary variables linked by directed enabling relations and local conditional probabilities.A complete configuration represents which graph nodes the adversary has reached, while the graph factorization captures dependencies among attack steps.
- Event model: Telemetry events provide indirect evidence about hidden attack steps, and Bayesian updating converts observations into a posterior distribution over adversarial configurations.Events may be alerts, sensor outputs, anomalous behaviors, or other monitoring evidence, including noisy observations and potentially informative absences.
- State model: Posterior node probabilities are aggregated for tactical-edge, pivot, and mission-impact groups, then mapped with observations into conflict states ordered by operational severity.The state mapping prioritizes direct mission-impact evidence, followed by mission-risk, pivot, and tactical-edge indicators.
- Mission risk: Mission risk weights posterior compromise probabilities for COP, ISR, and C2 functions, distinguishing technical compromise from operational mission impact.The risk score increases with inferred compromise probabilities and is bounded by the sum of the corresponding mission weights.
- Defensive actions: The one-step defensive rule selects an immediate action by balancing estimated residual mission risk against operational cost rather than claiming long-horizon optimality.The pipeline updates beliefs from alerts, computes compromise probabilities and conflict state, and uses mission risk to guide action selection.
- Consistency and robustness: The model is mathematically consistent and locally robust when normalization remains positive and bounded away from zero, scores stay separated from thresholds, and actions have a positive objective margin.Under these conditions, posterior-derived quantities vary in a controlled way and the discrete conflict state and selected action remain unchanged under sufficiently small telemetry perturbations.
4 Simulation-Oriented Adaptation and Practical Implementation
The prototype adapts the framework into an interpretable NetLogo simulation that models staged compromise, partial telemetry, conflict states, mission risk, and defensive response. It supports both exploratory manual operation and an automatic, state-aware approximation of the one-step decision rule.
- Prototype adaptation: The NetLogo prototype represents adversarial progression through explicit graph nodes, making compromised, protected, quarantined, and exposed assets directly observable at each simulation tick.This increases interpretability while reducing abstraction relative to the mathematical model.
- Node-based scenario: The simulated environment is a directed graph whose nodes are distributed across the TEZ, MOZ, and ESZ operational zones.TEZ models tactical-edge communications and entry points, MOZ mission-operation assets, and ESZ enterprise-support services.
- Attack propagation and telemetry: Discrete-time attack propagation depends on reachable assets, zone-specific parameters, node risk factors, and the current defensive configuration.Hardening, quarantine, and outgoing-path restrictions can reduce subsequent propagation.
- Attack propagation and telemetry: Telemetry is generated from compromise events but observed only partially, preserving the model’s partial-observability principle in an interactive implementation.The simulator uses compact event families for activity across the TEZ, MOZ, and ESZ, plus weak pre-alerts.
- Conflict states and mission risk: The simulator preserves six conflict states and computes mission risk as a weighted score that prioritizes mission-connected assets such as COP, ISR, and C2.Risk therefore reflects the operational relevance of compromised assets rather than only their number.
- Defensive execution: Automatic mode recommends an action-target pair using conflict state, mission-risk score, observed telemetry, target importance, compromise status, and expected local effect.The prototype approximates rather than exactly solves the one-step optimization rule; admissible actions are gated by conflict state.
5 Results and Scenario Validation
The representative NetLogo execution tests whether attacker progression, telemetry, conflict-state escalation, mission risk, and defensive actions remain coherent under controlled conditions. Across 120 ticks, compromise progresses from TEZ toward mission-critical assets, while defenses delay and modulate escalation; the validation is illustrative rather than operational evidence.
- Evaluation scope: The controlled evaluation examines coherence among attacker progression, telemetry generation, conflict-state escalation, mission-risk evolution, and defensive actions.The authors explicitly frame the execution as an assessment of implementation behavior, not operational validation against real incidents.
- Simulation setup: The scenario begins with a forced TEZ-GW compromise in an initial low-risk condition and includes TEZ, MOZ, and ESZ mission-relevant assets.The monitored mission-critical assets include ISR, C2, and COP.
- Representative execution: R = 0.5 during ticks 1–22, when TEZ compromises minimally affect mission risk but escalate the system to S1 and trigger A6-Contain-TEZ.At tick 22, TEZ-B2 compromise escalates the posture to S2, prompting A1-Quarantine-Node over the TEZ frontier.
- Representative execution: A1-Quarantine-Node prevents direct MOZ transition until 34 ticks into the execution after the system reaches S2 at tick 22.The subsequent MOZ pivot is delayed until tick 56 despite repeated PRE@MOZ-IN alerts between ticks 34–55.
- Observed outcomes: Figure 3 shows low early-TEZ mission risk, higher risk after MOZ compromise, and a sharp rise when mission-critical assets are affected.Its plots represent staged zone expansion, conflict-state escalation, and partial, time-varying telemetry; A6, A1, and A5 modulate attack dynamics.
- Limitations: The validation is scenario-based and illustrative, using a synthetic topology and a representative trace rather than statistically exhaustive experiments.The prototype also derives conflict states from explicit compromise rather than posterior beliefs and uses a heuristic response policy instead of global or multi-objective optimization.
6 Conclusions and Future Work
The paper concludes that its three-layer probabilistic CSA framework and NetLogo prototype maintain coherent links among uncertainty, attacker progression, mission risk, and defensive response. It identifies more realistic graphs and quantitative stochastic evaluation as priorities for future validation.
- Conclusions: The framework connects hidden attacker dynamics, noisy telemetry, posterior beliefs, conflict-state abstraction, mission-risk assessment, and one-step defensive action selection.Its decision rule balances residual mission risk and operational cost.
- Conclusions: Mathematical analysis supports well-posed inference and local robustness under bounded observation-model perturbations.The simulation additionally shows staged progression, coherent telemetry, conflict-state escalation, and mission-risk increases aligned with compromise of ISR, C2, and COP.
- Future work: Future validation should use larger, more operationally grounded graphs derived from cyber-range exercises, mission-thread analysis, or MITRE ATT&CK/D3FEND-informed mappings.This is the first of two directions proposed for improving scenario realism.
- Future work: Future experiments should run batches of stochastic simulations under fixed random seeds and report aggregate metrics including maximum and cumulative mission risk and mission-impact timing.Additional proposed metrics include compromised mission-critical assets, conflict-state stability, and action distribution.