Multi-Agent Influence Diagrams to Hybrid Threat Modeling

Maarten C. Vonk; Anna V. Kononova; Thomas Bäck; Tim Sweijs

cs.MAMar 3, 2026

Multi-Agent Influence Diagrams to Hybrid Threat Modeling

Authors: Maarten C. Vonk, Anna V. Kononova, Thomas Bäck, Tim Sweijs

Organizations: The Hague Centre of Strategic Studies, Lange Voorhout 1, The Hague, 2514EA, Netherlands. · LIACS, Leiden University, Einsteinweg 55, Leiden, 2333CC Netherlands.

Abstract

Western governments have adopted an assortment of counter-hybrid threat measures to defend against hostile actions below the conventional military threshold. The impact of these measures is unclear because of the ambiguity of hybrid threats, their cross-domain nature, and uncertainty about how countermeasures shape adversarial behavior. This paper offers a novel approach to clarifying this impact by unifying previously bifurcating hybrid threat modeling methods through a (multi-agent) influence diagram framework. The model balances the costs of countermeasures, their ability to dissuade the adversary from executing hybrid threats, and their potential to mitigate the impact of hybrid threats. We run 1000 semi-synthetic variants of a real-world-inspired scenario simulating the strategic interaction between attacking agent A and defending agent B over a cyber attack on critical infrastructure to explore the effectiveness of a set of five different counter-hybrid threat measures. Counter-hybrid measures range from strengthening resilience and denial of the adversary's ability to execute a hybrid threat to dissuasion through the threat of punishment. Our analysis primarily evaluates the overarching characteristics of counter-hybrid threat measures. This approach allows us to generalize the effectiveness of these measures and examine parameter impact sensitivity. In addition, we discuss policy relevance and outline future research avenues.

Figures & tables

Panel of Figure 1 — Figure 1: The figure illustrates the processes involved in counter-hybrid threat analysis as proposed in this study. Initially, domain experts identify the hybrid threat and develop corresponding counter-hybrid measures. They also provide key input parameters, which are used to construct probabilistic input distributions for the model. Samples from these distributions are used to run simulations with the causal influence diagram (CID) as well as the multi-agent influence diagram (MAID) model. Finally, a sensitivity analysis is performed and the model results are interpreted and compared with existing studies.

Panel of Figure 2 — Figure 2: (Multi-Agent) Causal Influence Diagram encoding hybrid threat modeling. While the bottom background layer groups the deterministic variables, the top layer represents the probabilistic variables. Probabilistic relations are displayed by black arrows and deterministic relations by grey arrows.

Value	Meaning	Probability Distribution
$\theta_{h}$	Potential damage of a hybrid attack	Drawn from different truncated normal distributions for each category of damaging impacts ( Norgaard and Killeen, 1980 ) .
$\gamma_{i}$	Cost for conducting counter-hybrid measure $d_{i}$	Drawn from different truncated normal distributions for each counter-hybrid measure $d_{i}$ ( Norgaard and Killeen, 1980 )
$q_{ij}$	Probability of the adversary conducting hybrid operation $c_{j}$ after counter-hybrid measure $d_{i}$	Drawn from different Beta distributions for each counter-hybrid measure.
$w_{ijh}$	Probability of potential damage $\theta_{h}$ after the adversary conducts hybrid conduct $c_{j}$ and defender counter-hybrid measure $d_{i}$	Drawn from different Dirichlet distributions for each counter-hybrid measure and hybrid operation combination ( Spiegelhalter and Lauritzen, 1990 ) .

Table 1: Values drawn from probability distributions. Costs of counter-hybrid measures and damaging impacts of hybrid attacks are expressed in US million dollars. While the costs of counter-hybrid measures and damaging impacts of hybrid attacks are drawn from variants of the normal distribution, the probability values for the ability to deter and the ability to mitigate damaging impacts are drawn from their corresponding conjugate priors (Beta and Dirichlet, respectively).

Domain	Title	Capability	Rationale
Cyber	Boost cyber resilience at the wider societal level	Introduce legislation or collaboration that requires individuals and companies to adopt sufficient levels of cyber resilience, based on the specific risk exposure of the subject.	Boosting cyber resilience at the broader societal level is one of the core tenets of a whole-of-society approach to hybrid/cyber threats.
Cyber	Employ offensive cyber capabilities	Use offensive cyber operations in order to undermine the target.	It is often the case that cyber attacks are not directly attributable. In the short term, it provides a covert way to influence the target. The effect of an offensive cyber attack is scalable.
Legal	Market restrictions	Introduce legislation to restrict an opponent from accessing your market in a specific sector (such as ICT).	Such measure reduces the possibilities for an adversary to exploit vulnerabilities but it may also clash with other legal commitments (see international trade commitments against market restrictions based on nationality).
Diplomatic	Open deterrence messaging through strategic communications	Communicate one’s strategic posture in order to convince a target to comply with one’s strategic aims.	Being transparent with the hostile actor regarding one’s own strategic strengths and possible actions. This increases the possibility of a better-informed decision by the hostile actor.

Table 2: Five Counter-Hybrid Measures

Figure 3: The count of the specific rank that each of the counter-hybrid measures is computed to attain.

Figure 4: SHAP summary plot for counter-hybrid measure imposing market restrictions: The y-axis represents the features ranked by their importance to the model output. The x-axis shows the SHAP value, indicating the magnitude and direction of each feature’s impact on the model output. The color gradient reflects the feature values.

Counter-hybrid Measures	Top Features
Counter-hybrid Measures	#1	#2	#3
D1 Intelligence Sharing	$q_{11}$	$\omega_{111}$	$\omega_{113}$
D2 Boosting Cyber Resilience	$\gamma_{2}$	$q_{12}$	$\omega_{213}$
D3 Offensive Cyber Operation	$q_{13}$	$\omega_{311}$	$\omega_{313}$
D4 Market Restrictions	$q_{14}$	$\gamma_{4}$	$\omega_{411}$
D5 Open Messaging	$q_{15}$	$\gamma_{5}$	$\theta_{1}$

Table 3: Top 3 Most Importance Features of the SHAP Plots for each Counter-Hybrid Measure

Counter-hybrid Measures	Hybrid Operation
Counter-hybrid Measures	Attack	No Attack
D1 Intelligence Sharing	15	697
D2 Boosting Cyber Resilience	1	98
D3 Offensive Cyber Operation	3	76
D4 Market Restrictions	0	110
D5 Open Messaging	0	0

Table 4: Subgame Perfect Equilibria Outcome Occurences

Figure 5: The probability that each of the counter-hybrid measures succeeds in deterring the adversary. While the green indicates the probability that the adversary is successfully dissuaded, the red illustrates the probability that the adversary still conducts a cyber operation.

Figure 6: The probability that each of the counter-hybrid measures succeeds in mitigating the hybrid operation. While the red indicates the probability the hybrid operation has a severe impact, the blue indicates the operation has a mediocre impact and the green indicates the hybrid operation has negligible impact.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning
Apr 6, 2026Yiyao Zhang, Diksha Goel, Hussain AhmadAdversarial MARL Autonomous Cyber Defense
Adelaide University, Australia · CSIRO’s Data61, Australia
MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study
May 11, 2026Tim Van hamme, Thomas Vissers, Javier Carnerero-Cano +4AI Risk Management AI Agent Security
DistriNet, KU Leuven, 3001 Leuven, Belgium · IBM Research · CISPA Helmholtz Center for Information Security +2
MCPThreatHive: Automated Threat Intelligence for Model Context Protocol Ecosystems
Apr 15, 2026Yi Ting Shen, Kentaroh Toyoda, Alex LeungMCP Security AI Agent Security
Vulcan Research, AIFT

Apr 6, 2026J/K move · Enter open · S save

Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning

Yiyao Zhang, Diksha Goel, Hussain Ahmad

Adelaide University, Australia · CSIRO’s Data61, Australia

Adversarial MARL Autonomous Cyber Defense Multi-Agent Reinforcement Learning Causal RL Interpretability in RL

Open paper AskPDF arXiv

Autonomous agents are increasingly deployed in both offensive and defensive cyber operations, creating high-speed, closed-loop interactions in critical infrastructure environments. Advanced Persistent Threat (APT) actors exploit "Living off the Land" techniques and targeted telemetry perturbations to induce ambiguity in monitoring systems, causing automated defenses to overreact or misclassify benign behavior as malicious activity. Existing monolithic and multi-agent defense pipelines largely operate on correlation-based signals, lack structural constraints on response actions, and are vulnerable to reasoning drift under ambiguous or adversarial inputs. We present the Causal Multi-Agent Decision Framework (C-MADF), a structurally constrained architecture for autonomous cyber defense that integrates causal modeling with adversarial dual-policy control. C-MADF first learns a Structural Causal Model (SCM) from historical telemetry and compiles it into an investigation-level Directed Acyclic Graph (DAG) that defines admissible response transitions. This roadmap is formalized as a Markov Decision Process (MDP) whose action space is explicitly restricted to causally consistent transitions. Decision-making within this constrained space is performed by a dual-agent reinforcement learning system in which a threat-optimizing Blue-Team policy is counterbalanced by a conservatively shaped Red-Team policy. Inter-policy disagreement is quantified through a Policy Divergence Score and exposed via a human-in-the-loop interface equipped with an Explainability-Transparency Score that serves as an escalation signal under uncertainty. On the real-world CICIoT2023 dataset, C-MADF reduces the false-positive rate from 11.2%, 9.7%, and 8.4% in three cutting-edge literature baselines to 1.8%, while achieving 0.997 precision, 0.961 recall, and 0.979 F1-score.

Abstract

Cybersecurity

Explore similar work

Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning

MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study

MCPThreatHive: Automated Threat Intelligence for Model Context Protocol Ecosystems