DYNAMIC MODEL FOR ASSESSING THE CYBERSECURITY STATE OF DATA IN A HETEROGENEOUS INFORMATION AND COMMUNICATION SYSTEM
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1411Keywords:
data cybersecurity, dynamic state estimation, dynamic Bayesian network, residual risk, heterogeneous system, evidence quality, delayed telemetryAbstract
This study develops and evaluates a dynamic model for assessing the cybersecurity state of data in a heterogeneous information and communication system under incomplete and delayed observations, accounting for component dependencies and changes over time. Residual risk is derived from the estimated joint state as expected future loss under specified protective actions. The literature review recognises existing dynamic Bayesian approaches; the proposed contribution is a specific integration of typed states, evidence quality, event-time updates and a testable loss functional. A normalised observation model and an archive-based refiltering procedure are specified. Synthetic evaluation uses 300 trajectories of 80 steps per configuration, paired comparisons and trajectory-bootstrap confidence intervals. As missing observations increase from zero to 60%, the full model's Brier score rises from 0.0280 to 0.0555, compared with 0.0664 to 0.0887 for an independent static baseline. Six figures show sensitivity to missingness, delays of up to five steps, evidence quality, dependency misspecification and protective controls. Incorrectly assumed dependencies can degrade estimation relative to a model without dependencies. These findings establish behaviour on the stated synthetic benchmark, not validation on operational telemetry. The model distinguishes physical system states from uncertainty about these states, functional service dependencies from compromise propagation, and transport delay from the intrinsic age of evidence. Missing observations trigger prediction without introducing unsupported evidence of safety. Delayed observations are incorporated at their event time and the filter is rerun to the present using archived evidence and model versions. Conditions for normalised transitions and observations, monotonic protection effects and state distinguishability are specified. Residual risk is evaluated as expected future loss under a fixed protection scenario without claiming an optimal response policy. The practical value lies in comparing specified protective actions for interdependent components. The experiment covers a reduced three-component model; parameter learning, attack-dependent missingness, correlated sources and validation of the complete typed state remain subjects for further research.
Downloads
References
Тарасенко, Я., Туровський, О., Іванкін, В., Матусяк, П., & Томашевський, М. (2025). Забезпечення кіберзахисту корпоративної мережі передачі даних в ході організації взаємодії між пристроями IoT дослідницьких лабораторій. Вимірювальна та обчислювальна техніка в технологічних процесах, 2(82), 334–343. https://doi.org/10.31891/2219-9365-2025-82-48
Іванченко, Є., Туровський, О., & Рижаков, М. (2026). Методика побудови системи безпеки об’єкта інформаційної діяльності для роботи з інформацією з обмеженим доступом. Вимірювальна та обчислювальна техніка в технологічних процесах, (3), 309–320. https://doi.org/10.31891/2219-9365-2026-87-37
Dempsey, K., Chawla, N., Johnson, L., Johnston, R., Jones, A., Orebaugh, A., Scholl, M., & Stine, K. (2011). Information security continuous monitoring (ISCM) for federal information systems and organizations (NIST SP 800-137). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-137
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
Wang, L., Singhal, A., & Jajodia, S. (2007). Measuring the overall security of network configurations using attack graphs. In Data and Applications Security XXI (pp. 98–112). Springer. https://doi.org/10.1007/978-3-540-73538-0_9
Frigault, M., Wang, L., Singhal, A., & Jajodia, S. (2008). Measuring network security using dynamic Bayesian network. In Proceedings of the 4th ACM Workshop on Quality of Protection (pp. 23–30). ACM. https://doi.org/10.1145/1456362.1456368
Poolsappasit, N., Dewri, R., & Ray, I. (2012). Dynamic security risk management using Bayesian attack graphs. IEEE Transactions on Dependable and Secure Computing, 9(1), 61–74. https://doi.org/10.1109/TDSC.2011.34
Behbehani, D., Komninos, N., Al-Begain, K., & Rajarajan, M. (2023). Cloud Enterprise Dynamic Risk Assessment (CEDRA): A dynamic risk assessment using dynamic Bayesian networks for cloud environment. Journal of Cloud Computing, 12, Article 79. https://doi.org/10.1186/s13677-023-00454-2
Husák, M., Komárková, J., Bou-Harb, E., & Čeleda, P. (2019). Survey of attack projection, prediction, and forecasting in cyber security. IEEE Communications Surveys & Tutorials, 21(1), 640–660. https://doi.org/10.1109/COMST.2018.2871866
Cerotti, D., Savarro, D., Codetta Raiteri, D., Dondossola, G., Egidi, L., Franceschinis, G., Portinale, L., & Terruggia, R. (2025). Dynamic Bayesian networks for the detection and analysis of cyber attacks to power systems. IEEE Access, 13, 186289–186306. https://doi.org/10.1109/ACCESS.2025.3624345
Thevaratnam, S., & Rezaeifar, Z. (2026). Quantifying cyber threat using Bayesian statistical analysis. International Journal of Information Security, 25, Article 43. https://doi.org/10.1007/s10207-026-01220-6
Boyen, X., & Koller, D. (1998). Tractable inference for complex stochastic processes. In Proceedings of the Fourteenth Conference on Uncertainty in Artificial Intelligence (pp. 33–42). Morgan Kaufmann. https://ai.stanford.edu/~xb/uai98/index.html
Murphy, K. P. (2002). Dynamic Bayesian networks: Representation, inference and learning [Doctoral dissertation, University of California, Berkeley]. https://www2.eecs.berkeley.edu/Pubs/TechRpts/2002/8174.html
Särkkä, S., & Svensson, L. (2023). Bayesian filtering and smoothing (2nd ed.). Cambridge University Press. https://doi.org/10.1017/9781108917407
National Institute of Standards and Technology. (2012). Guide for conducting risk assessments (NIST SP 800-30 Rev. 1). https://doi.org/10.6028/NIST.SP.800-30r1
National Institute of Standards and Technology. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5). https://doi.org/10.6028/NIST.SP.800-53r5
Gneiting, T., & Raftery, A. E. (2007). Strictly proper scoring rules, prediction, and estimation. Journal of the American Statistical Association, 102(477), 359–378. https://doi.org/10.1198/016214506000001437
Allman, E. S., Matias, C., & Rhodes, J. A. (2009). Identifiability of parameters in latent structure models with many observed variables. The Annals of Statistics, 37(6A), 3099–3132. https://doi.org/10.1214/09-AOS689
Brier, G. W. (1950). Verification of forecasts expressed in terms of probability. Monthly Weather Review, 78(1), 1–3. https://doi.org/10.1175/1520-0493(1950)078<0001:VOFEIT>2.0.CO;2
Guo, C., Pleiss, G., Sun, Y., & Weinberger, K. Q. (2017). On calibration of modern neural networks. In Proceedings of the 34th International Conference on Machine Learning (Vol. 70, pp. 1321–1330). PMLR. https://proceedings.mlr.press/v70/guo17a.html
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Олександр Туровский
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
