Multi-Agent Influence Diagrams to Hybrid Threat Modeling
Authors: Maarten C. Vonk, Anna V. Kononova, Thomas Bäck, Tim Sweijs
Organizations: The Hague Centre of Strategic Studies, Lange Voorhout 1, The Hague, 2514EA, Netherlands. · LIACS, Leiden University, Einsteinweg 55, Leiden, 2333CC Netherlands.
Western governments have adopted an assortment of counter-hybrid threat measures to defend against hostile actions below the conventional military threshold. The impact of these measures is unclear because of the ambiguity of hybrid threats, their cross-domain nature, and uncertainty about how countermeasures shape adversarial behavior. This paper offers a novel approach to clarifying this impact by unifying previously bifurcating hybrid threat modeling methods through a (multi-agent) influence diagram framework. The model balances the costs of countermeasures, their ability to dissuade the adversary from executing hybrid threats, and their potential to mitigate the impact of hybrid threats. We run 1000 semi-synthetic variants of a real-world-inspired scenario simulating the strategic interaction between attacking agent A and defending agent B over a cyber attack on critical infrastructure to explore the effectiveness of a set of five different counter-hybrid threat measures. Counter-hybrid measures range from strengthening resilience and denial of the adversary's ability to execute a hybrid threat to dissuasion through the threat of punishment. Our analysis primarily evaluates the overarching characteristics of counter-hybrid threat measures. This approach allows us to generalize the effectiveness of these measures and examine parameter impact sensitivity. In addition, we discuss policy relevance and outline future research avenues.
Figures & tables
Figure 1: The figure illustrates the processes involved in counter-hybrid threat analysis as proposed in this study. Initially, domain experts identify the hybrid threat and develop corresponding counter-hybrid measures. They also provide key input parameters, which are used to construct probabilistic input distributions for the model. Samples from these distributions are used to run simulations with the causal influence diagram (CID) as well as the multi-agent influence diagram (MAID) model. Finally, a sensitivity analysis is performed and the model results are interpreted and compared with existing studies.
Figure 2: (Multi-Agent) Causal Influence Diagram encoding hybrid threat modeling. While the bottom background layer groups the deterministic variables, the top layer represents the probabilistic variables. Probabilistic relations are displayed by black arrows and deterministic relations by grey arrows.
Value
Meaning
Probability Distribution
θh
Potential damage of a hybrid attack
Drawn from different truncated normal distributions for each category of damaging impacts ( Norgaard and Killeen, 1980 ) .
γi
Cost for conducting counter-hybrid measure di
Drawn from different truncated normal distributions for each counter-hybrid measure di ( Norgaard and Killeen, 1980 )
qij
Probability of the adversary conducting hybrid operation cj after counter-hybrid measure di
Drawn from different Beta distributions for each counter-hybrid measure.
wijh
Probability of potential damage θh after the adversary conducts hybrid conduct cj and defender counter-hybrid measure di
Drawn from different Dirichlet distributions for each counter-hybrid measure and hybrid operation combination ( Spiegelhalter and Lauritzen, 1990 ) .
Table 1: Values drawn from probability distributions. Costs of counter-hybrid measures and damaging impacts of hybrid attacks are expressed in US million dollars. While the costs of counter-hybrid measures and damaging impacts of hybrid attacks are drawn from variants of the normal distribution, the probability values for the ability to deter and the ability to mitigate damaging impacts are drawn from their corresponding conjugate priors (Beta and Dirichlet, respectively).
Domain
Title
Capability
Rationale
Cyber
Boost cyber resilience at the wider societal level
Introduce legislation or collaboration that requires individuals and companies to adopt sufficient levels of cyber resilience, based on the specific risk exposure of the subject.
Boosting cyber resilience at the broader societal level is one of the core tenets of a whole-of-society approach to hybrid/cyber threats.
Cyber
Employ offensive cyber capabilities
Use offensive cyber operations in order to undermine the target.
It is often the case that cyber attacks are not directly attributable. In the short term, it provides a covert way to influence the target. The effect of an offensive cyber attack is scalable.
Legal
Market restrictions
Introduce legislation to restrict an opponent from accessing your market in a specific sector (such as ICT).
Such measure reduces the possibilities for an adversary to exploit vulnerabilities but it may also clash with other legal commitments (see international trade commitments against market restrictions based on nationality).
Diplomatic
Open deterrence messaging through strategic communications
Communicate one’s strategic posture in order to convince a target to comply with one’s strategic aims.
Being transparent with the hostile actor regarding one’s own strategic strengths and possible actions. This increases the possibility of a better-informed decision by the hostile actor.
Table 2: Five Counter-Hybrid Measures
Figure 3: The count of the specific rank that each of the counter-hybrid measures is computed to attain.
Figure 4: SHAP summary plot for counter-hybrid measure imposing market restrictions: The y-axis represents the features ranked by their importance to the model output. The x-axis shows the SHAP value, indicating the magnitude and direction of each feature’s impact on the model output. The color gradient reflects the feature values.
Counter-hybrid Measures
Top Features
#1
#2
#3
D1 Intelligence Sharing
q11
ω111
ω113
D2 Boosting Cyber Resilience
γ2
q12
ω213
D3 Offensive Cyber Operation
q13
ω311
ω313
D4 Market Restrictions
q14
γ4
ω411
D5 Open Messaging
q15
γ5
θ1
Table 3: Top 3 Most Importance Features of the SHAP Plots for each Counter-Hybrid Measure
Figure 5: The probability that each of the counter-hybrid measures succeeds in deterring the adversary. While the green indicates the probability that the adversary is successfully dissuaded, the red illustrates the probability that the adversary still conducts a cyber operation.
Figure 6: The probability that each of the counter-hybrid measures succeeds in mitigating the hybrid operation. While the red indicates the probability the hybrid operation has a severe impact, the blue indicates the operation has a mediocre impact and the green indicates the hybrid operation has negligible impact.
Autonomous agents are increasingly deployed in both offensive and defensive cyber operations, creating high-speed, closed-loop interactions in critical infrastructure environments. Advanced Persistent Threat (APT) actors exploit "Living off the Land" techniques and targeted telemetry perturbations to induce ambiguity in monitoring systems, causing automated defenses to overreact or misclassify benign behavior as malicious activity. Existing monolithic and multi-agent defense pipelines largely operate on correlation-based signals, lack structural constraints on response actions, and are vulnerable to reasoning drift under ambiguous or adversarial inputs. We present the Causal Multi-Agent Decision Framework (C-MADF), a structurally constrained architecture for autonomous cyber defense that integrates causal modeling with adversarial dual-policy control. C-MADF first learns a Structural Causal Model (SCM) from historical telemetry and compiles it into an investigation-level Directed Acyclic Graph (DAG) that defines admissible response transitions. This roadmap is formalized as a Markov Decision Process (MDP) whose action space is explicitly restricted to causally consistent transitions. Decision-making within this constrained space is performed by a dual-agent reinforcement learning system in which a threat-optimizing Blue-Team policy is counterbalanced by a conservatively shaped Red-Team policy. Inter-policy disagreement is quantified through a Policy Divergence Score and exposed via a human-in-the-loop interface equipped with an Explainability-Transparency Score that serves as an escalation signal under uncertainty. On the real-world CICIoT2023 dataset, C-MADF reduces the false-positive rate from 11.2%, 9.7%, and 8.4% in three cutting-edge literature baselines to 1.8%, while achieving 0.997 precision, 0.961 recall, and 0.979 F1-score.
Yiyao Zhang, Diksha Goel, Hussain Ahmad
Adelaide University, Australia · CSIRO’s Data61, Australia
LLMs are increasingly deployed as autonomous agents with access to tools, databases, and external services, yet practitioners (across different sectors) lack systematic methods to assess how known threat classes translate into concrete risks within a specific agentic deployment. We present MATRA, a pragmatic threat modeling framework for agentic AI systems that adapts established risk assessment methodology to systematically assess how known LLM threats translate into deployment-specific risks. MATRA begins with an asset-based impact assessment and utilizes attack trees to determine the likelihood of these impacts occurring within the system architecture. We demonstrate MATRA on a personal AI agent deployment using OpenClaw, quantifying how architectural controls such as network sandboxing and least-privilege access reduce risk by limiting the blast radius of successful injections.
Tim Van hamme, Thomas Vissers, Javier Carnerero-Cano +4
DistriNet, KU Leuven, 3001 Leuven, Belgium · IBM Research · CISPA Helmholtz Center for Information Security +2
The rapid proliferation of Model Context Protocol (MCP)-based agentic systems has introduced a new category of security threats that existing frameworks are inadequately equipped to address. We present MCPThreatHive, an open-source platform that automates the end-to-end lifecycle of MCP threat intelligence: from continuous, multi-source data collection through AI-driven threat extraction and classification, to structured knowledge graph storage and interactive visualization. The platform operationalizes the MCP-38 threat taxonomy, a curated set of 38 MCP-specific threat patterns mapped to STRIDE, OWASP Top 10 for LLM Applications, and OWASP Top 10 for Agentic Applications. A composite risk scoring model provides quantitative prioritization. Through a comparative analysis of representative existing MCP security tools, we identify three critical coverage gaps that MCPThreatHive addresses: incomplete compositional attack modeling, absence of continuous threat intelligence, and lack of unified multi-framework classification.