{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T02:02:00Z","timestamp":1780624920400,"version":"3.54.1"},"reference-count":33,"publisher":"MDPI AG","issue":"6","license":[{"start":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T00:00:00Z","timestamp":1780531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Sichuan Provincial Leading Scientist Special Fund for Basic Research","award":["2024JDKXJ0011"],"award-info":[{"award-number":["2024JDKXJ0011"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Proactive defense planning in Industrial Control Systems (ICS) is critically constrained by two intertwined types of uncertainty: epistemic uncertainty, arising from the defender\u2019s limited observability of the system state and incomplete knowledge of attacker strategies, and aleatoric uncertainty, stemming from the stochastic nature of state transitions and the propagation of disturbances through inter-device dependencies. These factors significantly complicate the quantitative assessment of defense strategies before deployment. To address this challenge, this study proposes a Dynamic Bayesian Network (DBN)-based framework that explicitly models four sources of uncertainty. Within this framework, the expectation of the effectiveness differential is coupled with its information entropy to jointly quantify expected performance and prediction uncertainty. A casestudy on a typical substation automation system, complemented by systematic ablation experiments, demonstrates that the framework can effectively distinguish the relative effectiveness of defense strategies. The framework maintains robust assessment results under up to 15% noise in Conditional Probability Tables (CPTs). The ablation experiments further quantify the individual contributions of observability, dependency propagation, and attacker strategy to prediction uncertainty, and reveal a non-trivial coupling between epistemic and aleatoric uncertainty. This research provides theoretical and methodological support for resilience-oriented cyber defense planning in ICS.<\/jats:p>","DOI":"10.3390\/e28060635","type":"journal-article","created":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T01:23:21Z","timestamp":1780622601000},"page":"635","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Cyber Defense Effectiveness Evaluation for ICS Under Uncertainty: A Dynamic Bayesian Network Approach with Information Entropy"],"prefix":"10.3390","volume":"28","author":[{"given":"Rongbao","family":"Kang","sequence":"first","affiliation":[{"name":"School of Cyberspace Security, University of Science and Technology of China, Hefei 230026, China"},{"name":"No. 30 Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0843-2540","authenticated-orcid":false,"given":"Zhiyong","family":"Zhang","sequence":"additional","affiliation":[{"name":"No. 30 Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiao","family":"Zhang","sequence":"additional","affiliation":[{"name":"No. 30 Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3528-7131","authenticated-orcid":false,"given":"Jianfeng","family":"Chen","sequence":"additional","affiliation":[{"name":"No. 30 Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-3664-2496","authenticated-orcid":false,"given":"Ruoyu","family":"Xu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Northwestern Polytechnical University, Xi\u2019an 710072, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yongdong","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, University of Science and Technology of China, Hefei 230026, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhihong","family":"Rao","sequence":"additional","affiliation":[{"name":"No. 30 Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,6,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1109\/MSP.2011.67","article-title":"Stuxnet: Dissecting a cyberwarfare weapon","volume":"9","author":"Langner","year":"2011","journal-title":"IEEE Secur. Priv."},{"key":"ref_2","unstructured":"Lee, R.M., Assante, M., and Conway, T. (2016). Analysis of the Cyber Attack on the Ukrainian Power Grid: Defense Use Case, Electricity Information Sharing and Analysis Center (EISAC). Technical Report."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"106946","DOI":"10.1016\/j.comnet.2019.106946","article-title":"Cybersecurity in industrial control systems: Issues, technologies, and challenges","volume":"165","author":"Asghar","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"784","DOI":"10.1109\/JAS.2022.105548","article-title":"A Survey of Cyber Attacks on Cyber Physical Systems: Recent Advances and Challenges","volume":"9","author":"Duo","year":"2022","journal-title":"IEEE\/CAA J. Autom. Sin."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"020801","DOI":"10.1115\/1.4070764","article-title":"Risk and Reliability Evaluation of Future Industrial Automation Systems: A Systematic Literature Review and Research Agenda","volume":"12","author":"Morozov","year":"2026","journal-title":"ASCE-ASME J. Risk Uncertain. Eng. Syst. Part B Mech. Eng."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"823","DOI":"10.1109\/OJIES.2024.3439388","article-title":"AutomationML Meets Bayesian Networks: A Comprehensive Safety-Security Risk Assessment in Industrial Control Systems","volume":"5","author":"Bhosale","year":"2024","journal-title":"IEEE Open J. Ind. Electron. Soc."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Maradova, K., Blecha, P., Samelova, V., Marada, T., and Zuth, D. (2026). Bayesian Networks for Cybersecurity Decision Support: Enhancing Human-Machine Interaction in Technical Systems. Appl. Sci., 16.","DOI":"10.3390\/app16063053"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"104439","DOI":"10.1016\/j.cose.2025.104439","article-title":"A novel proactive and dynamic cyber risk assessment methodology","volume":"154","author":"Cheimonidis","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Yang, W., Hou, F., Jia, Z., Wang, H., Yao, Y., Yin, P., Xu, X., and Liu, S. (2025, January 16\u201318). A Dynamic Risk Assessment Method for Industrial Control Network Security Based on Bayesian Attack Graph. Proceedings of the 2025 5th International Conference on Computer, Control and Robotics, Hangzhou, China.","DOI":"10.1109\/ICCCR65461.2025.11072640"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ren, J., Liu, J., Dong, Y., Li, Z., and Li, W. (2024). An Attacker\u2013Defender Game Model with Constrained Strategies. Entropy, 26.","DOI":"10.3390\/e26080624"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"102338","DOI":"10.1016\/j.aei.2023.102338","article-title":"Statistical Knowledge and Game-Theoretic Integrated Model for Cross-Layer Impact Assessment in Industrial Cyber-Physical Systems","volume":"59","author":"Yao","year":"2024","journal-title":"Adv. Eng. Inform."},{"key":"ref_12","unstructured":"Aftabi, N., Li, D., and Sharkey, T. (2023). An Optimization Framework for Cyber-Physical Vulnerability Analysis in Industrial Cyber-Physical Systems. Proceedings of IISE Annual Conference and Expo, IISE."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"91949","DOI":"10.1109\/ACCESS.2023.3306593","article-title":"BAN: Predicting APT Attack Based on Bayesian Network with MITRE ATT&CK Framework","volume":"11","author":"Kim","year":"2023","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Kazeminajafabadi, A., Ghoreishi, S.F., and Imani, M. (2024, January 10\u201312). Optimal Detection for Bayesian Attack Graphs under Uncertainty in Monitoring and Reimaging. Proceedings of the 2024 American Control Conference (ACC), Toronto, ON, Canada.","DOI":"10.23919\/ACC60939.2024.10644873"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"6433","DOI":"10.1109\/TII.2025.3564074","article-title":"A Novel Quantitative Risk Assessment Model for Industrial Control Systems Integrating the Cyber\u2013Physical Domain","volume":"21","author":"Zhou","year":"2025","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_16","first-page":"103497","article-title":"Probability Elicitation for Bayesian Networks to Distinguish Between Intentional Attacks and Accidental Technical Failures","volume":"75","author":"Chockalingam","year":"2023","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"104580","DOI":"10.1016\/j.cose.2025.104580","article-title":"Strengthening Edge Defense: A Differential Game-Based Edge Intelligence Strategy Against APT Attacks","volume":"157","author":"Zhou","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"109691","DOI":"10.1016\/j.ress.2023.109691","article-title":"Resilience Assessment of Critical Infrastructures Using Dynamic Bayesian Networks and Evidence Propagation","volume":"241","author":"Caetano","year":"2024","journal-title":"Reliab. Eng. Syst. Saf."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Alevizos, C., and Ta, V.-T. (2024). Threat-Informed Cyber Resilience Index: A Probabilistic Quantitative Approach to Measure Defence Effectiveness Against Cyber Attacks. arXiv.","DOI":"10.1007\/979-8-8688-1122-7"},{"key":"ref_20","unstructured":"Stouffer, K., Falco, J., and Scarfone, K. (2011). Guide to Industrial Control Systems (ICS) Security."},{"key":"ref_21","unstructured":"Koller, D., and Friedman, N. (2009). Probabilistic Graphical Models: Principles and Techniques, MIT Press."},{"key":"ref_22","unstructured":"(2025, May 19). pgmpy Package. Available online: https:\/\/pgmpy.org."},{"key":"ref_23","unstructured":"(2016). Telecontrol Equipment and Systems \u2013 Part 5-104: Transmission Protocols \u2013 Network Access for IEC 60870-5-101 Using Standard Transport Profiles (Standard No. IEC 60870-5-104)."},{"key":"ref_24","unstructured":"(2012). Power Systems Management and Associated Information Exchange\u2014Data and Communications Security (Standard No. IEC 62351)."},{"key":"ref_25","unstructured":"(2026, April 09). [Dataset] Simulation Data. Available online: https:\/\/github.com\/engutou\/ICS-Effectiveness."},{"key":"ref_26","unstructured":"Janani, K. (2025). Cybersecurity through Entropy Injection: A Paradigm Shift from Reactive Defense to Proactive Uncertainty. arXiv."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1007\/s10994-006-6889-7","article-title":"The max-min hill-climbing Bayesian network structure learning algorithm","volume":"65","author":"Tsamardinos","year":"2006","journal-title":"Mach. Learn."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Pradhan, S., Singh, R., Kachru, K., and Narasimhamurthy, S. (2007). A Bayesian network based approach for root cause analysis in industrial processes. Proceedings of the 2007 International Conference on Computational Intelligence and Security (CIS 2007), IEEE.","DOI":"10.1109\/CIS.2007.214"},{"key":"ref_29","unstructured":"MITRE Corporation (2026, April 09). MITRE ATT&CK for Industrial Control Systems. Available online: https:\/\/attack.mitre.org\/versions\/v12\/matrices\/ics."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Alam, M.T., Bhusal, D., Park, Y., and Rastogi, N. (2023, January 16\u201318). Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI. Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2023), Hong Kong, China.","DOI":"10.1145\/3607199.3607208"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Arafune, M., Rajalakshmi, S., Jaldon, L., Jadidi, Z., Pal, S., and Foo, E. (2022). Design and Development of Automated Threat Hunting in Industrial Control Systems. Proceedings of the 2022 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops), IEEE.","DOI":"10.1109\/PerComWorkshops53856.2022.9767375"},{"key":"ref_32","unstructured":"Formby, D., Rad, M., and Beyah, R. (2018). Lowering the Barriers to Industrial Control System Security with GRFICS. Proceedings of the 2018 USENIX Workshop on Advances in Security Education (ASE), USENIX Association."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Goh, J., Adepu, S., Junejo, K.N., and Mathur, A. (2016). A Dataset to Support Research in the Design of Secure Water Treatment Systems. Critical Information Infrastructures Security, Springer.","DOI":"10.1007\/978-3-319-71368-7_8"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/28\/6\/635\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T01:30:46Z","timestamp":1780623046000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/28\/6\/635"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,4]]},"references-count":33,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2026,6]]}},"alternative-id":["e28060635"],"URL":"https:\/\/doi.org\/10.3390\/e28060635","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,4]]}}}