Estimating the global state of a networked system is an important problem in many application domains. The classical approach to tackling this problem is the periodic (observation) method, which is inefficient because it often observes states at a very high frequency. This inefficiency has motivated the idea of event-based method, which leverages the evolution dynamics in question and makes observations only when some rules are triggered (i.e., only when certain conditions hold). This paper initiates the investigation of using the event-based method to estimate the equilibrium in the new application domain of cybersecurity, where equilibrium is an important metric that has no closed-form solutions. More specifically, the paper presents an event-based method for estimating cybersecurity equilibrium in the preventive and reactive cyber defense dynamics, which has been proven globally convergent. The presented study proves that the estimated equilibrium from our trigger rule i) indeed converges to the equilibrium of the dynamics and ii) is Zeno-free, which assures the usefulness of the event-based method. Numerical examples show that the event-based method can reduce 98% of the observation cost incurred by the periodic method. In order to use the event-based method in practice, this paper investigates how to bridge the gap between i) the continuous state in the dynamics model, which is dubbed probability-state because it measures the probability that a node is in the secure or compromised state, and ii) the discrete state that is often encountered in practice, dubbed sample-state because it is sampled from some nodes. This bridge may be of independent value because probability-state models have been widely used to approximate exponentially-many discrete state systems.

中文翻译：

---

使用基于事件的方法来估计网络安全均衡


估计网络系统的全局状态是许多应用领域中的一个重要问题。解决这个问题的经典方法是周期性（观察）方法，这种方法效率低下，因为它经常以非常高的频率观察状态。这种低效率激发了基于事件的方法的想法，该方法利用所讨论的进化动力学，仅在触发某些规则时（即仅当某些条件成立时）才进行观察。本文启动了使用基于事件的方法来估计网络安全新应用领域中的均衡的研究，其中均衡是没有封闭式解的重要度量。更具体地说，本文提出了一种基于事件的方法，用于估计预防性和反应性网络防御动态中的网络安全平衡，该方法已被证明具有全球收敛性。本研究证明，根据我们的触发规则 i）估计的平衡确实收敛到动态平衡，并且 ii）是无芝诺的，这确保了基于事件的方法的有用性。数值例子表明，基于事件的方法可以减少周期性方法98%的观测成本。为了在实践中使用基于事件的方法，本文研究了如何弥合动态模型中 i) 连续状态之间的差距，该状态被称为概率状态，因为它测量节点处于安全或安全状态的概率。妥协状态，ii）实践中经常遇到的离散状态，称为样本状态，因为它是从某些节点采样的。这个桥梁可能具有独立的价值，因为概率状态模型已被广泛用于近似指数多离散状态系统。