Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining

arXiv:2604.18080v1 [cs.CR] 20 Apr 2026

Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining Francesco Vitale

Simone Guarino

Stefano Perone

DIETI University of Naples Federico II Naples, Italy [email protected]

Department of Engineering University Campus Bio-Medico of Rome Rome, Italy [email protected]

Department of Engineering University Campus Bio-Medico of Rome Rome, Italy [email protected]

Massimiliano Rak

Nicola Mazzocca

DIETI University of Naples Federico II Naples, Italy [email protected]

DIETI University of Naples Federico II Naples, Italy [email protected]

Abstract—While attack graphs are useful for identifying major cybersecurity threats affecting a system, they do not provide operational support for determining the likelihood of having a known vulnerability exploited, or that critical system nodes are likely to be compromised. In this paper, we perform dynamic risk assessment by combining Bayesian Attack Graphs (BAGs) and online monitoring of system behavior through process mining. Specifically, the proposed approach applies process mining techniques to characterize malicious network traffic and derive evidence regarding the probability of having a vulnerability actively exploited. This evidence is then provided to a BAG, which updates its conditional probability tables accordingly, enabling dynamic assessment of vulnerability exploitation. We apply our method to a cybersecurity testbed instantiating several machines deployed on different subnets and affected by several CVE vulnerabilities. The testbed is stimulated with both benign traffic and malicious behavior, which simulates network attack patterns aimed at exploiting the CVE vulnerabilities. The results indicate that our proposal effectively detects whether vulnerabilities are being actively exploited, allowing for an updated assessment of the probability of system compromise. Index Terms—Bayesian networks, process mining, packet-level inspection, CVE vulnerabilities, dynamic risk analysis

I. I NTRODUCTION The complexity of modern cyber-physical systems exposes them to several vulnerabilities that may be exploited by malicious users to impair their services and/or intrude on their network. To evaluate such risks, various assessment methods have been proposed based on graph theory and quantitative measures extracted from vulnerability databases, such as the Common Vulnerabilities and Exposures (CVE) database [1]. A widespread approach for risk assessment involves the use of attack graphs, which are abstract descriptions of multistep attacks aimed at compromising the different nodes of the This work was supported by Agenzia per la cybersicurezza nazionale under the programme for promotion of XL cycle PhD research in cybersecurity – C83C24000790001. The views expressed are those of the authors and do not represent the funding institution.

network. By combining attack graphs and known vulnerabilities, a quantitative evaluation of the risk can be obtained [2]. An effective method to quantitatively evaluate the risk of system compromise is the use of Bayesian Attack Graphs (BAGs), which model risk likelihood through conditional probabilities [3]. Specifically, to each node of a BAG is assigned a Conditional Probability Table (CPT), which reports the probability that the node is compromised based on the compromise of parent nodes linked to the attack path that can be followed. While BAGs can dynamically update posterior probabilities based on isolated alerts, their underlying CPTs traditionally rely on static metrics, such as CVSS scores. Furthermore, they lack a mechanism to continuously ingest complex behavioral evidence. In this paper, we aim to support dynamic risk assessment by extending BAGs with online diagnoses provided by process mining. This research area allows extracting process models from network event data that capture the packet-level sequencing of network protocols [4]. Hence, process mining techniques enable 1) packet-level inspection and modeling of network protocols, and 2) evaluating the similarity of new behavior with the prior characterization. In view of this twofold utility, our proposed approach leverages process mining techniques to characterize malicious network traffic and derive evidence regarding the probability of having a vulnerability actively exploited. This evidence is then provided to a BAG, which updates its conditional probability tables accordingly, enabling dynamic assessment of vulnerability exploitation. The novelties and contributions of our proposal are thus the following: • Process mining-based monitoring of vulnerability exploitation from the analysis of benign and malicious traffic. • Dynamic risk assessment through BAGs enhanced with the diagnoses provided by process mining-based monitoring.

We test our method with a cybersecurity testbed instantiating a network of nodes with known CVE vulnerabilities. The testbed is vulnerable to a multi-step attack captured in a BAG. The experiments involved characterizing malicious traffic associated with CVE vulnerabilities exploitation and providing dynamic risk assessment supported by process mining-based diagnoses. II. BACKGROUND AND R ELATED W ORK A. Dynamic Risk Assesment BAGs provide a powerful framework for vulnerability assessment by modeling exploitation probabilities of vulnerabilities affecting network infrastructures. Formally, a BAG is defined by the tuple BAG = (V, E, U, P ), where nodes V represent the attacker’s access privileges on specific devices, namely security conditions, edges E denote the existence of exploits that enable transitions between nodes, U is the set of software vulnerabilities affecting each device, and P represents the probability of successfully exploiting each vulnerability. In particular, each edge is defined by the tuple ei = (vi , vj , u, P (u)) ∈ E, where P (u) denotes the probability of exploiting vulnerability u to transition from condition vi to vj . These probabilities populate the Conditional Probability Tables (CPT) at each node, which encode the causal dependencies among different security conditions. In recent years, several studies have investigated methods for accurately estimating P (u) given a set of vulnerabilities U affecting a network infrastructure. Poolsappasit et al. [5] proposed a dynamic risk management framework based on BAGs, where the exploitation probability of vulnerabilities is evaluated using the Common Vulnerability Scoring System (CVSS) Exploitability sub-score, which captures how easily a vulnerability can be exploited. Similarly, Guarino et al. [6] proposed a BAG-based vulnerability assessment approach that considers both the Exploitability and Temporal metrics of CVSS, thus providing a more comprehensive characterization of vulnerability severity by accounting for the availability of patches and known exploits. Although CVSS is widely adopted, its scores have been demonstrated not being directly correlated to the exploitation probability [7]. To overcome this limitation, recent research has focused on the Exploit Prediction Scoring System (EPSS), a metric that explicitly estimates the probability that a given vulnerability will be exploited in the wild within 30 days. EPSS scores are updated daily, enabling the dynamic evaluation of vulnerability exploitation probability over time. Cheimonidis et al. [8] introduced a novel framework combining Bayesian Networks, Markov chains, and EPSS values to quantify the probabilistic transitions between compromised states and to measure the likelihood of reaching critical assets. Similarly, Yadav [9] proposed an approach to estimate transition probabilities within attack graphs by integrating both CVSS and EPSS, thereby capturing both the severity of vulnerabilities and their time-varying likelihood of exploitation. However, despite these advances, existing approaches still face challenges in updating posterior probabilities based on

live evidence from ongoing cyber-attacks. Such attacks usually follow well-defined stages in the exploitation of known vulnerabilities, which can be traced and recognized through pattern-based detection systems. Therefore, there is a need to feed BAGs with evidence of active vulnerability exploitation to dynamically update the posterior probabilities of system compromise. To date, most existing works tend to inject synthetic evidence on BAG nodes, without explicitly modeling the concrete sequence of steps required by an attacker to exploit a given vulnerability [10], [11]. B. Process Mining Process mining is able to bridge data science with process science by characterizing actual behavior from monitored events through process models and verifying the conformity of new events with that characterization [12]. In particular, process mining mainly involves two sets of algorithms: process discovery and conformance checking. Both types of algorithms deal with so-called event logs. An event log is a multiset of traces: L ∈ B(A∗ ), where A indicates a set of events, A∗ the set of all ordered sequences of events (i.e., traces), and B(A∗ ) the universe of multisets that can be built with A∗ . On the one hand, a process discovery algorithm γ can discover a process model N from L, i.e., γ(L) = N . Given a trace σ ∈ A∗ , a conformance checking algorithm is able to obtain a set of diagnoses dσ ∈ R|A|+1 by comparing σ with N . In particular, the diagnoses dσ contain local information about activities aligning with the description in N and a fuzzy value that quantifies global conformance to the overall process model, i.e., the fitness [13]. Process mining has been applied to network traffic of several protocols to analyze message patterns and uncover anomalous behavior. Its advantages include providing packetlevel inspection and explicit capture of control-flow aspects of network protocols, and verifying whether new traffic is aligned with historical patterns and potentially diagnose specific anomalies. For example, Bustos-Jimenez et al. [14] utilized process discovery to analyze the DNS traffic of a large dataset comprising DNS queries to different Internet services. Their findings highlight the potential of process mining to diagnose the most frequent network activities under normal conditions and verify anomalies in presence of network intrusions, such as botnet attacks. Wakup and Desel [15] developed an automated tool to convert TCP traffic into a process model through pre-processing and event-log extraction from network data; their work showed that it was possible to reconstruct a legacy protocol from TCP traffic. Vitale et al. [4] developed a dedicated pipeline to streamline and segment the traffic of network protocols into different states to build more precise and interpretable process models. The discussion above outlines that process mining is able to perform packet-level inspection of various network protocols and evaluate whether new network traffic complies with the extracted patterns. Combining process mining with the ability of BAGs to dynamically assess the risk associated with network intrusions, our method allows for early diagnosis of known

Computer network

System analysis

Attack graph definition Vulnerabilities

Attack path instantiation

BAG design

Attack graph

BAG

Pattern extraction Traffic data Alignment distribution

Process models

Offline System Characterization Traffic monitoring

<<iterative>> Online Monitoring

Similarity evaluation Traffic data

BAG update

Similarity

Dynamic risk assessment

Risk

Updated BAG

Fig. 1. The proposed approach for dynamic risk assessment through process mining and BAGs.

attack paths and dynamically assesses the risk of security breaches. III. P ROPOSED A PPROACH In this section, we present the proposed approach, depicted in Fig. 1. The approach is structured in two phases: offline system characterization and online monitoring. A. Offline System Characterization The offline phase begins by characterizing the target computer network in terms of its devices, installed software, and associated cyber vulnerabilities. First, system analysis aims to discover all reachable devices in the network, perform a comprehensive enumeration of the applications installed on each node, and, finally, associate with every device the corresponding list of known vulnerabilities that affect it. These vulnerabilities are automatically identified using network scanning tools such as Nmap and Greenbone OpenVAS, which retrieve vulnerability data from the CVE database. Subsequently, attack graph generation definition leverages this network characterization and vulnerability inventory to model all viable Attack Paths (APs) from one or multiple entry points to target devices via vulnerability exploitation. The attack graph construction employs pre-condition and post-condition modeling for each vulnerability, defining exploitation prerequisites and resulting privilege escalation. The resulting model constitutes a directed graph where each node represents the security condition of a specific host (guest, user, or root access), and each edge represents an elementary attack action exploiting a single vulnerability. Subsequently, the BAG design extends the AG by assigning an exploitation probability to each vulnerability. These probability values are dynamically updated within the CPTs at each node during the Online Monitoring phase. After generating the BAG, attack path instantiation involves capturing malicious behavioral patterns in response to the exploitation of the vulnerabilities resulting from network analysis. To this aim, known attacks are replicated against system nodes to exploit the corresponding vulnerability. The replication of the attack involves executing a series of actions that cause anomalous network traffic. After recording the

traffic data generated during the execution of the attack, pattern extraction characterizes the specific packet-level network patterns through the approach proposed in [4], which reports a structured method for extracting process models from traffic data. Let W = {W1 , . . . , Wα } indicate the set of α vulnerabilities found from network analysis, and T = {T1 , . . . , Tα } indicate the set of traffic data obtained by exploiting the α vulnerabilities. Without loss of generality, we will consider that each node of the computer network is associated with a single vulnerability. To characterize the pattern of the ith vulnerability Wi , the method involves the application of three steps: 1) feature extraction to obtain numerical statistics from the raw network data, 2) state-space characterization to cluster network patterns into distinct groups, and 3) event log extraction to turn the pre-processed traffic data Ti into β event logs Li = {L1 , . . . , Lβ : Lj ∈ B(A∗ )}, where A now represents a set of network events, e.g., TCP flags, and β represents the set of network states. Finally, process discovery is applied to each L1...β ∈ Li to extract the set of β process models Ni . Each process model N ∈ Ni captures a distinct network state: the more network states, the finer-grained the pattern characterization is. Finally, pattern extraction also outputs the alignment distribution Di,1...β for each state based on the diagnoses calculated between the event logs of Li and Ni through alignment-based conformance checking (see Section II).

B. Online Monitoring With the BAG and process models in place, the system can be monitored and the risk of vulnerability exploitation evaluated dynamically. First, traffic monitoring captures traffic data from the different system nodes under unknown conditions. Such data are processed through similarity evaluation, which compares the set of process models for each i-th vulnerability Vi . In particular, the traffic data associated with the i-th node is turned into a set of online event logs LO,i , which are checked against Vi with alignment-based conformance checking. The resulting online alignment distribution Do,i is compared with the alignment distribution Di obtained during

Fig. 3. The BAG of the cybersecurity testbed. TABLE I E DGE CHARACTERIZATION IN THE BAG. Fig. 2. The cybersecurity testbed.

offline system characterization through the cosine similarity: CosSim(Do,i , Di ) =

⟨Do,i , Di ⟩ . ||Do,i || ||Di ||

When CosSim(Do,i , Di ) has higher values, a known exploitation is taking place, whereas low values of this metric indicate that the attack is not in course of action, i.e., the network traffic is legitimate. The resulting similarity is passed on to BAG update, which refreshes the CPT tables associated with the BAG using the similarity values of each network node. The updated BAG is leveraged by dynamic risk assessment, which executes Bayesian inference algorithms, such as Variable Elimination [16], thereby computing the posterior probability of an attacker reaching target nodes P (vtarget |vattacker ), considering an adversary targeting the network as prior evidence. IV. E VALUATION This section presents the application of our method to the cybersecurity testbed that we built for our experimentation, depicted in Fig. 2, and shows the results of dynamic risk assessment with the instantiation of two attack paths. A. Offline System Characterization The adopted cybersecurity testbed consists of a corporate network infrastructure comprising three interconnected internal subnets linked via a Linux-based firewall. Specifically, subnet 192.168.56.0/24 represents the employee network, which is restricted from accessing the internal network (10.0.0.0/24) and can communicate solely with the DMZ (20.0.0.0/24); this subnet hosts employee-facing services such as web servers and VPN endpoints. The internal network (10.0.0.0/24) hosts critical servers containing sensitive assets, including patents, trade secrets, and proprietary data. Within each subnet, at least one device is affected by a known vulnerability, enabling an attacker who has gained access to the employee network to perform privilege escalation and lateral movement toward the high-value target at 10.0.0.3. In particular, the following wellknown vulnerabilities were selected: (1) CVE-2023-0600 affects host 192.168.56.1, enabling unauthenticated SQL injection in the “WP Visitor Statistics (Real Time Traffic)”

Edge

v i → vj

Vulnerability u

e1 e2 e3 e4 e5 e6 , e7

Attacker → RA:192.168.56.1 Attacker → RA:20.0.0.9 192.168.56.1 → RA:20.0.0.1 (login) RA:20.0.0.9 → RA:20.0.0.1 (login) RA:20.0.0.9 → RA:20.0.0.1 RA:20.0.0.1 → RA:10.0.0.3

CVE-2023-0600 CVE-2010-2075 Administrative Credentials Administrative Credentials CVE-2019-15107 CVE-2011-2523

WordPress plugin (version ≤ 6.9) for database credential extraction; (2) CVE-2019-15107 impacts the firewall, allowing command injection in the Webmin management tool (version ≤ 1.920) via password_change.cgi for root Remote Code Execution (RCE); (3) CVE-2010-2075 creates a backdoor in UnrealIRCd 3.2.8.1 on server 20.0.0.9, permitting unauthenticated remote command execution on TCP port 6667; (4) CVE-2011-2523 (vsftpd 2.3.4 backdoor) on 10.0.0.3 opens a root shell on TCP port 6200 granting root access without authentication. Finally, in each subnet, a sniffer device is connected to capture real-time network traffic and store it in pcap files. TABLE II C ONDITIONAL P ROBABILITY TABLE (CPT) FOR NODE vj . Node vi

False True

Node vj False

True

1 1 − CosSim(Do,i , Di )

0 CosSim(Do,i , Di )

Fig. 3 illustrates the BAG generated from the given network infrastructure and vulnerabilities affecting each device. In particular, the graph captures the logical sequence of steps an attacker, who gained access to the employee network (192.168.56.0/24), must execute to compromise the target device at 10.0.0.3. The characterization of each edge in terms of source and destination security condition, along with the associated enabling vulnerability, is detailed in Table I. Moreover, Table II reports the CPT associated with each node. As discussed in Section III-B, the CPT is dynamically updated during the Online Monitoring phase based on the similarity

value CosSim(Do,i , Di ), which captures the likelihood of detecting a vulnerability exploitation in the network traffic. This probability is then encoded in the CPT, as it governs the transition from a source security condition node to a destination one. According to the BAG, the attacker can pursue two distinct attack paths (AP1 and AP2) to reach the target. In both paths, the adversary must first acquire Root Access (RA) privileges on the DMZ server at 20.0.0.9, in order to compromise the firewall at 20.0.0.1, and remove its iptables rules to gain access to the internal network (10.0.0.0/24). Specifically, AP1 leverages vulnerabilities CVE-2023-0600 and CVE-2010-2075: the former enables retrieval of firewall administrative credentials via SQL injection at the employee network host (192.168.56.1), while the latter grants RA on the DMZ server through the UnrealIRCd service. By combining the credentials obtained from the employee machine with the network positioning provided by the DMZ server, the attacker can directly authenticate to the firewall’s Webmin management interface, effectively bypassing the need for further exploitation. Once logged into the firewall, the attacker modifies the iptables rules to enable direct access to the internal network, ultimately exploiting CVE-2011-2523 on 10.0.0.3 to secure root privileges. Alternatively, in path AP2, the attacker, after gaining RA privileges in the DMZ server, directly exploits CVE-2019-15107 at the firewall in order to bypass the login credentials in the Webmin management interface and gain root privileges. Once the firewall is compromised, as in AP1, the attacker modifies the iptables rules to enable direct access to 10.0.0.3 and then exploits the local vulnerability (CVE-2011-2523) to attain root privileges on the target. The exploitation of vulnerabilities for each AP has been executed through a Kali Linux machine connected to the employee network at IP address 192.168.56.102. Following the MITRE&Attack framework, before executing the exploit, the attacker performs the following steps. First, the adversary conducts network scanning to map the target subnet and identify active hosts. Second, host scanning is performed on the discovered IP addresses to enumerate open ports and active services. Third, the attacker executes vulnerability scanning on these services to detect the presence of known security flaws (i.e., CVEs). Finally, upon confirming a vulnerable service, the attacker proceeds to the exploitation phase, deploying the appropriate payload to compromise the target and move laterally to the subsequent node in the attack graph. Given v1,...,4 the BAG nodes such that v1 = RA:192.168.56.1, v2 = RA:20.0.0.9, v3 = RA:20.0.0.1, and v4 = RA:10.0.0.3, our method extracts the sets of process models V1...,4 that characterize the anomalous traffic when the corresponding vulnerabilities are exploited during the instantiation of the two attack paths. To maximize the state separation within the i-th set of process models Vi [4], we split the network traffic into three states and obtain the alignment distribution Di,j for each state j. Please, notice that BAG node RA:20.0.0.1 (login) was not considered as it

TABLE III T HE C OS S IM VALUES [%] FOR EACH NODE PER ATTACK STEP AND ATTACK PATH (AP). Attack

Node I

Attack Steps II III

IV

AP1

RA:192.168.56.1 RA:20.0.0.9 RA:20.0.0.1 RA:10.0.0.3

10.0 2.1 0.3 0.2

99.9 2.1 0.3 0.2

99.9 99.5 0.3

99.9 99.9 2.1 98.9

AP2

RA:192.168.56.1 RA:20.0.0.9 RA:20.0.0.1 RA:10.0.0.3

10.2 2.1 0.3 0.2

10.2 99.5 2.1 0.2

10.2 99.9 99.5 0.2

10.2 99.9 99.5 98.9

does not involve the exploitation of any vulnerability. B. Online Monitoring We have instantiated the two attack paths as follows. In both cases, we first stimulated the system nodes with legitimate traffic. Next, we progressively corrupted the network traffic node by node with the paths described above. This led to a multi-step dynamic risk assessment for each attack path. During traffic monitoring, the traffic data associated with nodes v1,...,4 are collected with the packet sniffer. This produces the set of traffic data T1...4 . Once the traffic data are collected, they are pre-processed to generate the four sets of online event logs LO,1...4 , which are run through similarity evaluation to obtain the four similarity values CosSim1...4 . These values are used to update the CPTs of the BAG and obtain the final probabilities that the system nodes are compromised for dynamic risk assessment. C. Results Table III shows the CosSim values populating the CPT of each node in the BAG, updated for each attack step and attack path. For attack step I, the CosSim for each node is very low since only legitimate traffic circulates across nodes v1...4 . In the subsequent steps, malicious traffic that was replicated in the offline phase is progressively recognized. For example, for AP1 , the attack step II involves the compromise of node v1 by leveraging vulnerability CVE-2023-0600; this is successfully recognized through the CosSim measure, which achieves 99.9% similarity to the known malicious pattern. In the end, when attack paths are complete at attack step IV, the nodes involves in the attack show almost perfect similarity, outlining the utility of process mining in identifying malicious network traffic. Figure 4 shows the posterior compromise probabilities of all nodes along both attack paths, updated at each attack step. As the attacker traverses the attack path toward the target device, the posterior probability of compromise associated with each node increases, eventually reaching values close to 100%. In particular, the compromise probability of the terminal node RA:10.0.0.3 rises at every step, reflecting the attacker’s progressive advancement toward the target device in the computer network. Specifically, in the first AP, the compromise probability increases from 1.2% at Step I (when

the attacker gains access to the employee network) to 1.8% after the exploitation of CVE-2023-0600 at Step II, and to 11.5% after the exploitation of CVE-2010-2075 and the subsequent login to the firewall at Step III. Finally, it reaches 96.8% after the exploitation of CVE-2011-2523, which affects the target host. A similar trend is observed for the second attack path as well.

was conducted, which leaves open the question of how algorithm choice affects the overall performance of the method. Future work will include the extension of the proposal with intrusion detection systems able to automatically filter benign traffic and focus the analysis on malicious network data, which could enhance the ability of process mining to recognize the presence of anomalous packet-level network patterns associated with known vulnerabilities. In addition, we aim to extend the proposal with automatic online mechanisms to account for past exploitation of system nodes. R EFERENCES

Fig. 4. Exploit probability values for each attack step in AP1 (a) and AP2 (b).

V. C ONCLUSION This paper proposed a novel dynamic risk assessment method integrating BAGs and process mining, combining the insights of process-based packet-level inspection with the capabilities of BAGs. The proposed approach enables real-time updates to the probability of system compromise as evidence of vulnerability exploitation accumulates during an ongoing attack. The method proves particularly valuable in two practical scenarios: honeypot deployments, where it supports attacker profiling and forensic analysis, and budgetconstrained or legacy environments where patching is unfeasible, enabling timely response and mitigation actions based on exploitation probabilities along known attack paths. We evaluated the approach on a cybersecurity testbed featuring a complex network topology and multiple vulnerable machines exposed to active cyber attacks. Our results show that our method successfully characterizes malicious traffic monitored under the exploitation of vulnerabilities and allows dynamic risk assessment by updating a posteriori probabilities of the BAG with process mining-driven insights. Nevertheless, the proposed method is subject to some limitations. First, exploitation probabilities at each node were estimated after a vulnerability was successfully exploited, without capturing the intermediate steps followed by the attacker during the exploitation process. Second, the approach was validated on a single case study, which may limit the generalizability of the results to larger networks. Third, no sensitivity analysis across different process mining algorithms

[1] F. Arat, A. Karakaya, and S. Akleylek, “A taxonomy of graph-based risk, vulnerability, and attack assessment methods in iot systems,” Journal of Information Security and Applications, vol. 97, p. 104360, 2026. [2] A. Viticchié, A. S. Colletto, G. Sunder, C. Basile, and A. Aliberti, “Advanced attack graph framework for operational technology: scalable modeling, validation, and risk mitigation,” Cluster Computing, vol. 28, no. 8, p. 531, 2025. [3] S. Perone, S. Guarino, L. Faramondi, and R. Setola, “Vulnerability Assessment Combining CVSS Temporal Metrics and Bayesian Networks,” in 2025 IEEE International Conference on Cyber Security and Resilience (CSR), 2025, pp. 606–611. [4] F. Vitale, P. Palmiero, M. Rak, and N. Mazzocca, “Network Traffic Analysis with Process Mining: The UPSIDE Case Study,” 2025. [Online]. Available: https://arxiv.org/abs/2512.23718 [5] N. Poolsappasit, R. Dewri, and I. Ray, “Dynamic security risk management using bayesian attack graphs,” IEEE Transactions on Dependable and Secure Computing, vol. 9, no. 1, pp. 61–74, 2012. [6] S. Guarino, L. Faramondi, G. Oliva, E. Del Prete, and R. Setola, “Holistic risk assessment in industrial control systems: Combining multiple bayesian networks with multi-criteria decision making,” in 2024 32nd Mediterranean Conference on Control and Automation (MED). IEEE, 2024, pp. 37–42. [7] R. Sato, H. Kawaguchi, and Y. Nakatani, “A stochastic model for calculating well-founded probabilities of vulnerability exploitation,” in 2022 IEEE 22nd International Conference on Software Quality, Reliability, and Security Companion (QRS-C), 2022, pp. 34–43. [8] P. Cheimonidis and K. Rantos, “A bayesian–markov framework for proactive and dynamic cyber risk assessment driven by epss,” in 2025 IEEE International Conference on Cyber Security and Resilience (CSR), 2025, pp. 281–286. [9] M. Yadav and P. J. Hawrylak, “Extent of an attack in an attack graph: Method to evaluate evidence set,” in 2025 13th International Symposium on Digital Forensics and Security (ISDFS). IEEE, 2025, pp. 1–6. [10] A. Sahu and K. Davis, “Inferring adversarial behaviour in cyber-physical power systems using a bayesian attack graph approach,” IET CyberPhysical Systems: Theory & Applications, vol. 8, no. 2, pp. 91–108, 2023. [11] D. Cerotti, D. Savarro, D. C. Raiteri, G. Dondossola, L. Egidi, G. Franceschinis, L. Portinale, and R. Terruggia, “Dynamic bayesian networks for the detection and analysis of cyber attacks to power systems.” IEEE Access, 2025. [12] W. M. P. van der Aalst and J. Carmona, Process Mining Handbook. Cham, Switzerland: Springer, 2022. [13] F. Vitale, M. Pegoraro, W. M. van der Aalst, and N. Mazzocca, “Controlflow anomaly detection by process mining-based feature extraction and dimensionality reduction,” Knowledge-Based Systems, vol. 310, p. 112970, 2025. [14] J. Bustos-Jiménez, C. Saint-Pierre, and A. Graves, “Applying process mining techniques to dns traces analysis,” in 2014 33rd International Conference of the Chilean Computer Science Society (SCCC), 2014, pp. 12–16. [15] C. Wakup and J. Desel, “Analyzing a tcp/ip-protocol with process mining techniques,” in Business Process Management Workshops, F. Fournier and J. Mendling, Eds. Cham: Springer International Publishing, 2015, pp. 353–364. [16] L. Muñoz-González, D. Sgandurra, M. Barrère, and E. C. Lupu, “Exact inference techniques for the analysis of bayesian attack graphs,” IEEE Transactions on Dependable and Secure Computing, vol. 16, no. 2, pp. 231–244, 2019.