Cyber Defense Effectiveness Evaluation for ICS Under Uncertainty: A Dynamic Bayesian Network Approach with Information Entropy

Proactive defense planning in Industrial Control Systems (ICS) is critically constrained by two intertwined types of uncertainty: epistemic uncertainty, arising from the defender’s limited observability of the system state and incomplete knowledge of attacker strategies, and aleatoric uncertainty, stemming from the stochastic nature of state transitions and the propagation of disturbances through inter-device dependencies. These factors significantly complicate the quantitative assessment of defense strategies before deployment. To address this challenge, this study proposes a Dynamic Bayesian Network (DBN)-based framework that explicitly models four sources of uncertainty. Within this framework, the expectation of the effectiveness differential is coupled with its information entropy to jointly quantify expected performance and prediction uncertainty. A casestudy on a typical substation automation system, complemented by systematic ablation experiments, demonstrates that the framework can effectively distinguish the relative effectiveness of defense strategies. The framework maintains robust assessment results under up to 15% noise in Conditional Probability Tables (CPTs). The ablation experiments further quantify the individual contributions of observability, dependency propagation, and attacker strategy to prediction uncertainty, and reveal a non-trivial coupling between epistemic and aleatoric uncertainty. This research provides theoretical and methodological support for resilience-oriented cyber defense planning in ICS.