← 研踪 PaperTrailarXiv:2611.03974 · v1
Gather or Act? Belief-Level Counterfactual Labels for Deadline-Aware Incident Response in Cyber-Physical Systems
首次提交 2026-11-03 05:13
版本更新 2026-11-03 05:13
雷达观测 2026-11-04 23:40
摘要
When an industrial control system misbehaves, the defender often must choose between acting now on the most likely cause and first gathering evidence that separates two look-alike causes, while the process drifts toward a shutdown. Learning or evaluating such decisions requires the cost of every candidate action from the same situation, which no public cyber-physical security dataset provides. We present TE-GvA, a counterfactual decision dataset for fault-driven incident response on the revised Tennessee Eastman process, with 9,908 decision points from 1,990 simulated incidents, each with 4 to 35 candidate actions labelled by branched rollouts with common random numbers. Labels computed under the true hidden cause (hindsight labels) make gathering the best choice in only 1.1-1.3% of decisions. For the dominant look-alike pair, a failed network link versus a frozen I/O module, we add pair-conditioned belief labels from twin episodes that replay the defender's history under the other cause, weighted by the exact posterior. With them, gathering is best in 15.5% of ambiguous natural decisions and in 33.1% of ambiguous stress decisions without a backup channel. When the posterior is correct and the twin is faithful, belief labels have the same regression target as hindsight labels and lower variance. In a pre-specified, single-look test evaluation, a gradient-boosted rule trained on belief labels has 11% lower regret on the stress set than the same rule trained on hindsight labels, and 27% lower regret on ambiguous stress decisions without a backup channel, which remains significant after Holm correction. With a backup channel and in the natural distribution, the two label sets perform about the same. Soft labels tolerate moderate posterior errors, whereas hard labels that commit to one cause do worse than hindsight labels.
作者备注：20 pages, 7 figures, 10 tables. Data: https://doi.org/10.5281/zenodo.23830595; code: https://github.com/ruzbahani/TE-GvA
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-03 05:13 · 最新观测版本
Gather or Act? Belief-Level Counterfactual Labels for Deadline-Aware Incident Response in Cyber-Physical Systems
When an industrial control system misbehaves, the defender often must choose between acting now on the most likely cause and first gathering evidence that separates two look-alike causes, while the process drifts toward a shutdown. Learning or evaluating such decisions requires the cost of every candidate action from the same situation, which no public cyber-physical security dataset provides. We present TE-GvA, a counterfactual decision dataset for fault-driven incident response on the revised Tennessee Eastman process, with 9,908 decision points from 1,990 simulated incidents, each with 4 to 35 candidate actions labelled by branched rollouts with common random numbers. Labels computed under the true hidden cause (hindsight labels) make gathering the best choice in only 1.1-1.3% of decisions. For the dominant look-alike pair, a failed network link versus a frozen I/O module, we add pair-conditioned belief labels from twin episodes that replay the defender's history under the other cause, weighted by the exact posterior. With them, gathering is best in 15.5% of ambiguous natural decisions and in 33.1% of ambiguous stress decisions without a backup channel. When the posterior is correct and the twin is faithful, belief labels have the same regression target as hindsight labels and lower variance. In a pre-specified, single-look test evaluation, a gradient-boosted rule trained on belief labels has 11% lower regret on the stress set than the same rule trained on hindsight labels, and 27% lower regret on ambiguous stress decisions without a backup channel, which remains significant after Holm correction. With a backup channel and in the natural distribution, the two label sets perform about the same. Soft labels tolerate moderate posterior errors, whereas hard labels that commit to one cause do worse than hindsight labels.
查看此版本解读 →查看此版本原文 ↗