# Bayesian Attack Model for Dynamic Risk Assessment

arXiv: https://arxiv.org/abs/1606.09042 · HTML: https://mlsanity.com/paper/1606.09042/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Jun 2016.

## Built on by (most cited first, 1 of 1)

- [On the Foundations of Cycles in Bayesian Networks](https://mlsanity.com/paper/2301.08608/) (2023)

## Abstract (arXiv)

Because of the threat of advanced multi-step attacks, it is often difficult for security operators to completely cover all vulnerabilities when deploying remediations. Deploying sensors to monitor attacks exploiting residual vulnerabilities is not sufficient and new tools are needed to assess the risk associated to the security events produced by these sensors. Although attack graphs were proposed to represent known multi-step attacks occurring in an information system, they are not directly suited for dynamic risk assessment. In this paper, we present the Bayesian Attack Model (BAM), a Bayesian network-based extension to topological attack graphs, capable of handling topological cycles, making it fit for any information system. Evaluation is performed on realistic topologies to study the sensitivity of its probabilistic parameters.