Counterfactual labels improve incident response decisions in cyber-physical systems
Original title: Gather or Act? Belief-Level Counterfactual Labels for Deadline-Aware Incident Response in Cyber-Physical Systems
New TE-GvA dataset with belief-level labels for Tennessee Eastman process shows gradient-boosted rules achieve 11 percent lower regret than hindsight labels on stress sets.
Cyber-physical systems require decisions between gathering evidence and acting on likely causes under time pressure. No prior public dataset provides counterfactual labels for every candidate action. TE-GvA contains 9,908 decision points from 1,990 simulated incidents with 4 to 35 actions each. Hindsight labels indicate gathering is optimal in only 1.1 to 1.3 percent of decisions. Belief labels from twin episodes weighted by posterior improve performance in ambiguous cases. Gradient-boosted rules trained on belief labels show lower regret after Holm correction.
- 9,908 decision points from 1,990 incidents
- Gathering optimal in 1.1-1.3 percent of hindsight decisions
- Gathering optimal in 15.5 percent of natural and 33.1 percent of stress ambiguous decisions
- 11 percent lower regret on stress set versus hindsight labels
- Soft labels tolerate moderate posterior errors
From the original article
1 min read at arxiv.orgWhen an industrial control system misbehaves, the defender often must choose between acting now on the most likely cause and first gathering evidence that separates two look-alike causes, while the process drifts toward a shutdown. Learning or evaluating such decisions requires the cost of every candidate action from the same situation, which no public cyber-physical security dataset provides.
By Ali Mohammadi Ruzbahani · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.