A Game-Theory-Based Risk Assessment Method for Industrial Control Systems via Bayesian Attack Graphs

A game-theoretic risk assessment framework is proposed for Industrial Control Systems (ICS), integrating Bayesian Attack Graphs (BAG) with attacker-defender utility modeling. The approach constructs a game based on enhanced vulnerability-based risk quantification, deriving Nash equilibrium strategies to estimate attack and defense probabilities. These probabilities are incorporated into BAG to enable dynamic inference of system attack likelihoods and associated risks based on observed evidence. Experimental results demonstrate improved assessment accuracy over traditional methods. The framework supports informed security decision-making in ICS by enhancing situational awareness.