{"id":"https://openalex.org/W7155090507","doi":"https://doi.org/10.48550/arxiv.2604.18080","title":"Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining","display_name":"Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining","publication_year":2026,"publication_date":"2026-04-20","ids":{"openalex":"https://openalex.org/W7155090507","doi":"https://doi.org/10.48550/arxiv.2604.18080"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.18080","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.18080","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.18080","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101694358","display_name":"Francesco Vitale","orcid":"https://orcid.org/0000-0003-2325-0056"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vitale, Francesco","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134163225","display_name":"Simone Guarino","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guarino, Simone","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104161522","display_name":"Stefano Perone","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Perone, Stefano","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068111307","display_name":"Massimiliano Rak","orcid":"https://orcid.org/0000-0001-6708-4032"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rak, Massimiliano","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5045567395","display_name":"Nicola Mazzocca","orcid":"https://orcid.org/0000-0002-0401-9687"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mazzocca, Nicola","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10703","display_name":"Business Process Modeling and Analysis","score":0.4544999897480011,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T10703","display_name":"Business Process Modeling and Analysis","score":0.4544999897480011,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.13199999928474426,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.0731000006198883,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.703499972820282},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6833000183105469},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.6729000210762024},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.6312000155448914},{"id":"https://openalex.org/keywords/bayesian-network","display_name":"Bayesian network","score":0.6230000257492065},{"id":"https://openalex.org/keywords/conditional-probability","display_name":"Conditional probability","score":0.5194000005722046},{"id":"https://openalex.org/keywords/risk-assessment","display_name":"Risk assessment","score":0.5044999718666077}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7376000285148621},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.703499972820282},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6833000183105469},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.6729000210762024},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6312000155448914},{"id":"https://openalex.org/C33724603","wikidata":"https://www.wikidata.org/wiki/Q812540","display_name":"Bayesian network","level":2,"score":0.6230000257492065},{"id":"https://openalex.org/C44492722","wikidata":"https://www.wikidata.org/wiki/Q327069","display_name":"Conditional probability","level":2,"score":0.5194000005722046},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.5044999718666077},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5005999803543091},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4677000045776367},{"id":"https://openalex.org/C2778868856","wikidata":"https://www.wikidata.org/wiki/Q18394273","display_name":"Threat assessment","level":2,"score":0.4348999857902527},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.42320001125335693},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.37439998984336853},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.36739999055862427},{"id":"https://openalex.org/C82142266","wikidata":"https://www.wikidata.org/wiki/Q3456604","display_name":"Dynamic Bayesian network","level":3,"score":0.33899998664855957},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3091999888420105},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2865000069141388},{"id":"https://openalex.org/C160234255","wikidata":"https://www.wikidata.org/wiki/Q812535","display_name":"Bayesian inference","level":3,"score":0.27149999141693115},{"id":"https://openalex.org/C2984588014","wikidata":"https://www.wikidata.org/wiki/Q730675","display_name":"Quantitative assessment","level":2,"score":0.2694000005722046}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.18080","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.18080","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.18080","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.18080","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.46805599331855774,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"While":[0],"attack":[1,143],"graphs":[2],"are":[3,34,161],"useful":[4],"for":[5,19,166],"identifying":[6],"major":[7],"cybersecurity":[8,114],"threats":[9],"affecting":[10],"a":[11,25,83,93,113],"system,":[12],"they":[13],"do":[14],"not":[15],"provide":[16],"operational":[17],"support":[18],"determining":[20],"the":[21,63,79,148,171],"likelihood":[22],"of":[23,56,81,105,170,173],"having":[24,82],"known":[26],"vulnerability":[27,84,106],"exploited,":[28,164],"or":[29],"that":[30,154],"critical":[31],"system":[32,57,174],"nodes":[33],"likely":[35],"to":[36,70,92,112],"be":[37],"compromised.":[38],"In":[39],"this":[40],"paper,":[41],"we":[42],"perform":[43],"dynamic":[44,103],"risk":[45],"assessment":[46,104,169],"by":[47,125],"combining":[48],"Bayesian":[49],"Attack":[50],"Graphs":[51],"(BAGs)":[52],"and":[53,75,123,137],"online":[54],"monitoring":[55],"behavior":[58],"through":[59],"process":[60,67],"mining.":[61],"Specifically,":[62],"proposed":[64],"approach":[65],"applies":[66],"mining":[68],"techniques":[69],"characterize":[71],"malicious":[72,138],"network":[73,142],"traffic":[74,136],"derive":[76],"evidence":[77,88],"regarding":[78],"probability":[80,99,172],"actively":[85,163],"exploited.":[86],"This":[87],"is":[89,131],"then":[90],"provided":[91],"BAG,":[94],"which":[95,140],"updates":[96],"its":[97],"conditional":[98],"tables":[100],"accordingly,":[101],"enabling":[102],"exploitation.":[107],"We":[108],"apply":[109],"our":[110,155],"method":[111],"testbed":[115,130],"instantiating":[116],"several":[117,126],"machines":[118],"deployed":[119],"on":[120],"different":[121],"subnets":[122],"affected":[124],"CVE":[127,149],"vulnerabilities.":[128,150],"The":[129,151],"stimulated":[132],"with":[133],"both":[134],"benign":[135],"behavior,":[139],"simulates":[141],"patterns":[144],"aimed":[145],"at":[146],"exploiting":[147],"results":[152],"indicate":[153],"proposal":[156],"effectively":[157],"detects":[158],"whether":[159],"vulnerabilities":[160],"being":[162],"allowing":[165],"an":[167],"updated":[168],"compromise.":[175]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-04-22T00:00:00"}