---
title: Bayesian Attack Graphs
url: https://www.emergentmind.com/topics/bayesian-attack-graph
type: topic
---

# Bayesian Attack Graphs

Bayesian Attack Graphs (BAGs) are a fusion of attack graphs with Bayesian network inference over a directed acyclic graph (DAG), used to model how an attacker can progress through a network by exploiting vulnerabilities and satisfying preconditions to reach security states such as privileges or asset compromise. They provide quantitative, evidence-driven analysis under uncertainty, enabling static analysis of compromise risk at rest and dynamic analysis that updates posterior probabilities when new observations such as IDS alerts, SIEM evidence, forensic findings, or process-monitoring signals arrive [1606.07025][1303.7397].

## 1. Formal definition and graph structure

A logical attack graph is commonly expressed as a directed bipartite DAG \(G = (E \cup C, R_r \cup R_i)\), where \(C\) are security conditions, \(E\) are exploits or vulnerabilities, \(R_r \subseteq C \times E\) encodes preconditions, and \(R_i \subseteq E \times C\) encodes postconditions. BAGs turn these conditions into random variables and impose Bayesian-network semantics on the resulting structure. A more explicit formulation defines a BAG as the tuple \(BAG = (V, E, U, P)\), where \(V\) are nodes representing security conditions or privilege levels on specific hosts, \(E\) are directed exploit transitions between security conditions, \(U\) are the vulnerabilities affecting devices, and \(P\) is the exploitation probability associated to each vulnerability [1510.02427][2604.18080].

In the Bayesian-network view, each node is a binary random variable indicating whether the corresponding security condition is achieved. In one formulation, each node \(X_i\) is a Bernoulli variable with domain \(\{T,F\}\); in another, \(X_i \in \{0,1\}\) with \(1\) meaning compromised or achieved. Directed edges encode causal dependencies induced by exploits, connectivity, credentials, or prior footholds. The joint distribution factorizes in the standard way:
$$
P(X_1,\ldots,X_n)=\prod_{i=1}^n P(X_i \mid \mathrm{Pa}(X_i)).
$$
A common modeling convention is to introduce a special initial node \(X_0\) denoting the attacker’s own machine and clamp it to \(\Pr(X_0=T)=1\) [1606.07025].

BAGs are acyclic by construction. This is a substantive modeling constraint rather than a superficial presentation choice. Attack graphs can contain cycles, but BAGs remove cycles to obtain an acyclic structure amenable to Bayesian inference. The survey literature cites the monotonicity constraint and procedures by Wang et al. as cycle-removal strategies; related exact-inference work also recommends splitting an initial attacker state into one node per entry path when this reduces unnecessary loops and inference complexity [1303.7397].

Within the survey taxonomy of DAG-based security models, BAGs are classified as Attack-focused, Sequential, with Specific quantification, and with Main purpose Risk. Their listed characteristics are Structure DAG, Connectors AND/OR with conditional probabilities, and Formalization Formal [1303.7397].

| Aspect | Survey classification |
|---|---|
| Modeling capability | Attack-focused; Sequential; Specific quantification; Main purpose Risk |
| Structural characterization | Structure DAG; Connectors AND/OR with conditional probabilities; Formalization Formal |
| Maturity/usability | Tool availability Commercial; Case study Toy; External use Independent; Paper count 10; Year 2005 |

This placement is important because it distinguishes BAGs from qualitative attack trees and from purely reachability-based attack graphs. A BAG is not merely a graph of possible paths; it is a probabilistic causal model over those paths.

## 2. Probabilistic semantics and CPT design

The central modeling task in a BAG is the construction of conditional probability tables (CPTs) or equivalent local conditional distributions. BAGs typically use AND or OR semantics to encode whether a child state requires all parent preconditions or only one of several alternative exploit paths. In the survey literature, Frigault et al. assign CPTs and estimate them from CVSS scores, Liu and Man assign edge probabilities, and Poolsappasit et al. use local conditional probability distributions and augment the graph with hardening or defense nodes [1303.7397].

A standard BAG construction parameterizes CPTs with exploit success probabilities \(p_{v_j}\) associated with vulnerabilities on incoming edges. These are estimated from CVSS, typically the exploitability subscore scaled to \([0,1]\). To account for imperfect alerts or observations with error rate \(p_e\), one formulation gives the following CPTs for a child \(X_i\) with parents \(pa_i\) [1606.07025]:

For an AND gate,
$$
p(X_i \mid pa_i)=
\begin{cases}
p_e, & \text{if } \exists X_j \in pa_i \text{ with } X_j=F;\\
1-(1-p_e)\left(1-\prod_{j:X_j=T} p_{v_j}\right), & \text{otherwise.}
\end{cases}
$$

For an OR gate using noisy-OR semantics,
$$
p(X_i \mid pa_i)=
\begin{cases}
p_e, & \text{if } \forall X_j \in pa_i,\ X_j=F;\\
1-(1-p_e)\prod_{j:X_j=T}(1-p_{v_j}), & \text{otherwise.}
\end{cases}
$$

Closely related exact-inference work states the same logical content in a more compact form: for AND-type conditions the child probability is zero if any prerequisite is false and otherwise equals the product of the relevant exploit probabilities, while for OR-type conditions the canonical noisy-OR is
$$
P(C=1 \mid A_1,\ldots,A_k)=1-\prod_{i=1}^k (1-w_i \cdot \mathbf{1}[A_i=1]).
$$
Here \(w_i\) is often set to the exploit success probability for parent path \(i\) [1510.02427].

Observation noise can also be modeled by adding an explicit observation node \(O_i\) with \(p(O_i \mid X_i)\) specified by detection and false-alarm rates. This separates attack-progression semantics from sensing semantics and supports hard evidence, soft evidence, or likelihood potentials during dynamic inference [1606.07025].

Several assumptions recur across the literature. Exploit success probabilities are often treated as independent across vulnerabilities and roughly constant over days or weeks; if these change, one recommendation is to rebuild the model rather than introduce temporal dynamics into a static BAG. Probabilities are typically attacker-agnostic unless an external attacker model is available. Network topology, reachability, and the vulnerability set are often assumed fixed during dynamic inference; patching can be represented by setting \(p_v=0\), while adding hosts or vulnerabilities requires regeneration of the attack graph [1606.07025].

These choices make BAGs technically tractable, but they also delimit what the model claims to represent. A BAG is only as faithful as its CPTs, its attack graph, and the causal assumptions encoded in its parent sets.

## 3. Static and dynamic inference

BAG analysis is usually divided into static and dynamic modes. Static analysis computes unconditional marginals \(p(X_i)\), used as risk estimates of compromise at rest:
$$
p(X_i)=\sum_{X \setminus X_i} p(X)=\sum_{X \setminus X_i}\prod_{j=1}^n p(X_j \mid pa_j).
$$
Dynamic analysis incorporates evidence \(E\) and computes posteriors
$$
p(X_i \mid E)=\frac{p(X_i,E)}{p(E)}=
\frac{\sum_{X \setminus \{X_i,E\}} p(X)}
{\sum_{X \setminus E} p(X)}.
$$
In practice, hard evidence is often represented by clamping nodes to \(T\), while soft evidence can be represented through observation nodes or explicit likelihood factors [1606.07025].

Exact inference methods for BAGs include Variable Elimination (VE) and Junction Tree (JT) inference with belief propagation. The broader Bayesian-networks-for-security literature also highlights variable elimination, bucket elimination, importance sampling, the bucket tree algorithm, and the Lauritzen–Spiegelhalter algorithm. The attraction of JT for BAGs is that it amortizes computation across all marginals and supports fast re-computation when new evidence arrives [1510.02427][1303.7397].

The structural parameter governing exact inference is treewidth. In standard asymptotic form, exact inference runs in time and memory \(O(n \cdot \exp(w))\), where \(w\) is the treewidth; for binary BAGs this means the largest clique or intermediate factor dominates the blow-up. This is why clustered or modular topologies with bounded in-degree are much more tractable than dense graphs. In experiments on synthetic BAGs, JT was orders of magnitude faster than VE, and dynamic JT was nearly linear and faster on clustered BAGs once the clique tree existed [1510.02427].

Dynamic inference also raises a methodological issue: which posterior summary should be used for operational risk assessment. Exact-inference work explicitly cautions against maximum posterior explanation or most probable explanation for BAG risk assessment, noting that in the worked example MPE yields implausible “everything compromised” explanations. Marginals and posteriors over relevant nodes are advocated instead [1510.02427].

Evidence can be integrated at different abstraction levels. In conventional BAGs, alerts from IDS or SIEM tools are mapped to node states and absorbed as hard or soft evidence. The survey literature emphasizes that posterior updating is one of the principal reasons to use Bayesian networks rather than bottom-up attack-tree operators. This supports queries such as the posterior probability that a target host is compromised, the posterior probability of intermediate footholds, and the relative likelihood of competing attack paths [1303.7397].

The distinction between static and dynamic BAG analysis is therefore not merely temporal. Static analysis answers “what is the network risk posture at rest,” whereas dynamic analysis answers “how should the risk posture be updated, conditioned on observed evidence.”

## 4. Scalability, approximate inference, and cyclic BAGs

Exact Bayesian inference does not scale well on large or dense attack graphs, which motivates approximate methods. One influential approach maps the BAG factorization to a factor graph and applies Loopy Belief Propagation (LBP). With variable-to-factor messages
$$
m_{i \to a}(x_i)=\prod_{b \in N(i)\setminus a} m_{b \to i}(x_i),
$$
factor-to-variable messages
$$
m_{a \to j}(x_j)=\sum_{x_{N(a)\setminus j}} \psi_a(x_{N(a)}) \prod_{i \in N(a)\setminus j} m_{i \to a}(x_i),
$$
and beliefs
$$
b_i(x_i)\propto \prod_{a \in N(i)} m_{a \to i}(x_i),
$$
LBP yields exact marginals on trees or polytrees and approximate marginals on loopy graphs [1606.07025].

Initialization and scheduling materially affect numerical behavior. One reported setup initializes \(m_{i \to a}(x_i)\leftarrow 1\), initializes factor-to-variable messages by summing out other variables, uses convergence tolerance \(\epsilon = 10^{-3}\), sets \(\mathrm{max\_iter} \approx 2|X|\), and optionally applies damping
$$
\hat{m}^{(t)}=\alpha m^{(t)}_{\text{new}} + (1-\alpha)m^{(t-1)}
$$
with \(\alpha \in [0,0.5]\), where \(\alpha \in [0.1,0.3]\) is recommended for stability on loopy graphs [1606.07025].

Empirical results make the computational trade-off explicit. On pseudo-random BAGs with 40 nodes and \(m=3\), LBP achieved RMSE typically \(< 0.03\); on clustered BAGs with \(5 \times 20\) nodes and \(m=3\), RMSE was \(< 0.04\). On 100-node pseudo-random graphs, LBP typically converged in \(<15\) iterations, and after 5 iterations RMSE was approximately \(0.05\). For 3000-node BAGs, LBP static or dynamic runs required approximately 60 seconds on a standard laptop, whereas exact JT on a 16 GB machine was limited to \(n \le 120\) nodes for \(m=3\) and \(n \le 80\) for \(m=4\) due to memory limits [1606.07025].

A distinct line of work addresses a more fundamental problem: automatically generated BAGs often contain cycles, which make it impossible to use Bayesian network theory directly. “Cyclic Bayesian Attack Graphs: A Systematic Computational Approach” introduces an interpretation of BAGs based on combinational logic circuits, proves monotonicity and finite-time convergence of the associated Boolean dynamics, and gives an algorithm that computes state probabilities without altering the attack graphs. The algorithm “deals seamlessly with all cycles without the need to identify their types,” scales to graphs with 15000 nodes, and on realistic graphs with 1053, 2234, and 2341 nodes reported mean runtimes of about 3 s, 11 s, and 12 s respectively [2005.06350].

Stochastic simulation provides another computational regime. “Stochastic Simulation Techniques for Inference and Sensitivity Analysis of Bayesian Attack Graphs” compares Probabilistic Logic Sampling, Likelihood Weighting, and Backward Simulation for dynamic evidence and concludes that likelihood weighting is most efficient for most uses. The same work also gives a practical sensitivity measure
$$
\mathrm{Sens}_B(A)=P(A \mid B=1)-P(A \mid B=0),
$$
computed with two inference runs per leaf node [2103.10212].

| Approach | Setting | Reported properties |
|---|---|---|
| Junction Tree / Variable Elimination | Acyclic BAGs, exact inference | JT is orders of magnitude faster than VE; dynamic JT nearly linear on clustered BAGs once the clique tree exists [1510.02427] |
| Loopy Belief Propagation | Large loopy factor graphs from BAGs | Linear scaling with node count; RMSE \(< 0.03\) on 40-node pseudo-random graphs and \(< 0.04\) on \(5 \times 20\)-node clustered graphs; 3000-node runs in approximately 60 s [1606.07025] |
| Cyclic BAG algorithm | Cyclic BAGs | Computes state probabilities without altering the attack graphs; handles all cycles; scales to 15000 nodes [2005.06350] |
| Likelihood Weighting | Dynamic evidence, large BAGs | Most efficient for most uses [2103.10212] |

A plausible implication is that “Bayesian Attack Graph” now names a family of inference regimes rather than a single algorithmic stack. Exact JT, approximate LBP, stochastic simulation, and cyclic-graph procedures are all BAG analyses, but they apply under different structural and operational constraints.

## 5. Dynamic and domain-specific extensions

One extension aimed directly at dynamic risk assessment is the Bayesian Attack Model (BAM). BAM is a Bayesian-network-based extension to topological attack graphs that handles topological cycles by constructing, for each possible source asset, a Bayesian Attack Tree whose topological nodes are path-qualified states such as \(btn(tn_1,\ldots,tn_n)\). The model introduces Bayesian topological nodes, Bayesian attack-step nodes, Bayesian condition nodes, and Bayesian sensor nodes, with sensor CPTs parameterized by false-positive and false-negative rates. A topological node uses a noisy-OR with leak \(pua=\) probabilityUnknownAttack, and an attack-step node succeeds only if its source is compromised and all conditions succeed, modulated by \(pnas=\) probabilityNewAttackStep. Across all BATs, per-asset compromise probability is consolidated by taking the maximum probability over path-qualified nodes ending at that physical asset. On simulated topologies with up to 70 hosts and approximately 2000 vulnerabilities, generating BAM and running inference after a 7-step scenario completed in under approximately 90 seconds on a laptop-class machine [1606.09042].

Another direction injects richer behavioral evidence into BAGs. “Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining” updates BAG CPTs online using process-mining evidence derived from packet-level event logs. Offline attack replay yields alignment distributions for each vulnerability, online traffic is converted into event logs and diagnosed against learned process models, and cosine similarity
$$
\mathrm{CosSim}(\mathcal{D}_{o,i}, \mathcal{D}_{i})=
\frac{\langle \mathcal{D}_{o,i}, \mathcal{D}_{i} \rangle}
{\| \mathcal{D}_{o,i} \| \, \| \mathcal{D}_{i} \|}
$$
is used to refresh edge CPTs, with
$$
P_t(v_j=\mathrm{True} \mid v_i=\mathrm{True}) = s_i(t), \qquad
P_t(v_j=\mathrm{True} \mid v_i=\mathrm{False}) = 0.
$$
In the reported testbed, the posterior probability of terminal node \(RA{:}10.0.0.3\) increased along one attack path from \(1.2\%\) under benign traffic to \(96.8\%\) upon confirmed exploitation [2604.18080].

Recent cyber-physical-systems work uses BAG ideas in a different operational regime. “Active Bayesian Inference for Robust Control under Sensor False Data Injection Attacks” builds a Bayesian Attack Graph around a perception pipeline represented as a bipartite graph \(G=(Z \cup V_y, E)\), with sensor-compromise variables \(z_{i,k}\), soft-measurement compromise variables \(s_{j,k}\), and alert variables \(a_{i,k}\). The model uses exact probabilistic inference by summing over \(z_{-i,k}\) for small sensor sets, a simplified POMDP to justify a threshold-based probing policy, active probing to increase the KL divergence between competing hypotheses, and selective disabling of compromised sensors with EKF-based state estimation. The paper notes that for larger perception graphs, factor-graph message passing and approximate inference such as loopy belief propagation may be needed [2604.11410].

A further development, the Dynamic Causal Attack Graph (DCAG), instantiates BAG-like reasoning for temporally dynamic cyber-physical systems by adding weighted causal intensities \(r_{n;i}\), conditional attack event parameters \(a_{n,k;i,j}\), logic gateways, and time-indexed self-propagation terms. The core update equations are
$$
x_{n,k}=\sum_i \left(\frac{r_{n;i}}{r_n}\right)\sum_j a_{n,k;i,j}\,v_{i,j},
$$
and
$$
X_{n,1}^{t}=
\sum_i \left(\frac{r_{n;i}}{r_n}\right)\sum_j a_{n,1;i,j}\,V_{i,j}^{t}
+
\left(\frac{r_{n;n_{t-1}}}{r_n}\right)
A_{n,1;n_{t-1},1}\,X_{n,1}^{t-1}.
$$
In the CTCS-3 case study, central subsystem nodes accumulate risk faster than trackside nodes, and considering functional safety of CBI reduces long-term risk [2509.25786].

These extensions preserve the central BAG idea—latent attack states driving observable evidence—but broaden the evidential substrate from IDS alerts to process traces, perception-pipeline anomalies, and time-indexed causal propagation.

## 6. Relations to adjacent models, strengths, and limitations

BAGs are often confused with attack trees or with deterministic attack graphs, but the distinctions are explicit in the literature. Attack trees are AND–OR trees that decompose an attacker’s goal into subgoals and basic actions; they are typically static and often assume independence of leaves. BAGs replace fixed gate semantics with CPTs over a DAG, enabling probabilistic inference under conditional dependencies, handling sequential or causal dependencies, and supporting posterior updating when evidence arrives. By contrast, classical attack graphs model system states and transitions but do not, by themselves, provide the probabilistic semantics of Bayesian inference [1303.7397].

The same survey situates BAGs relative to defense-oriented models. Defense trees, protection trees, and attack–defense trees add defenses in tree formalisms; Bayesian Defense Graphs integrate countermeasures more systematically through chance, decision, and utility nodes; BDMPs target time-to-success and detection or reaction with Markov processes and ordered gates. Static BAGs generally do not attach explicit Markov timing unless extended to dynamic Bayesian networks, BAM-style constructions, or DCAG-like temporal models [1303.7397][2509.25786].

The principal strengths repeatedly identified are quantitative, evidence-driven analysis under uncertainty, efficient DAG inference when structure is favorable, integration of vulnerability scoring such as CVSS, support for what-if defense optimization, and the ability to rank compromise probabilities of target and intermediate nodes under observed evidence [1303.7397]. The worked examples reinforce this point. In one small BAG, exact JT gave \(p(F=T)=0.799\) and LBP estimated \(\hat{p}(F=T)=0.805\); after clamping \(D=T\), LBP became exact because the graph split into trees; setting \(p_v\) on one high-impact edge to zero reduced \(p(F=T \mid D=T)\) from \(0.848\) to \(0.242\) [1606.07025].

The limitations are equally explicit. Cycle handling is intrinsic and can be intricate; standard BN inference requires acyclicity, while real attack graphs often contain cycles. Parameter estimation is difficult: CVSS-based \(p_v\) values are rough proxies for exploit success, and mis-specification affects absolute probabilities. Naive independence assumptions inherited from tree models can mislead. Static BAGs do not capture explicit timing without DBNs or other temporal extensions. Exact methods are bounded by treewidth and can become memory-bound. LBP is not guaranteed to converge, and when it converges its beliefs can still be biased, especially with strong loops and highly noisy CPTs. One paper also notes that experiments used synthetic BAGs due to lack of public real attack graphs [1510.02427][1606.07025].

Several research gaps are stated directly in the survey literature: automatic model construction from attack patterns or templates, bridging theory and industry, standardization of node labels, and agent-oriented views. A plausible implication is that the BAG literature has matured from a single formalism into a broader methodology: attack-graph structure supplies causal reachability, Bayesian inference supplies uncertainty quantification and posterior updating, and the remaining open problems concern model construction, parameter fidelity, temporal realism, and adversarial adaptation [1303.7397][2404.03957].

Source: https://www.emergentmind.com/topics/bayesian-attack-graph