Gather or Act? Belief-Level Counterfactual Labels for Deadline-Aware Incident Response in Cyber-Physical Systems

Abstract

When an industrial control system misbehaves, the defender often must choose between acting now on the most likely cause and first gathering evidence that separates two look-alike causes, while the process drifts toward a shutdown. Learning or evaluating such decisions requires the cost of every candidate action from the same situation, which no public cyber-physical security dataset provides. We present TE-GvA, a counterfactual decision dataset for fault-driven incident response on the revised Tennessee Eastman process, with 9,908 decision points from 1,990 simulated incidents, each with 4 to 35 candidate actions labelled by branched rollouts with common random numbers. Labels computed under the true hidden cause (hindsight labels) make gathering the best choice in only 1.1-1.3% of decisions. For the dominant look-alike pair, a failed network link versus a frozen I/O module, we add pair-conditioned belief labels from twin episodes that replay the defender's history under the other cause, weighted by the exact posterior. With them, gathering is best in 15.5% of ambiguous natural decisions and in 33.1% of ambiguous stress decisions without a backup channel. When the posterior is correct and the twin is faithful, belief labels have the same regression target as hindsight labels and lower variance. In a pre-specified, single-look test evaluation, a gradient-boosted rule trained on belief labels has 11% lower regret on the stress set than the same rule trained on hindsight labels, and 27% lower regret on ambiguous stress decisions without a backup channel, which remains significant after Holm correction. With a backup channel and in the natural distribution, the two label sets perform about the same. Soft labels tolerate moderate posterior errors, whereas hard labels that commit to one cause do worse than hindsight labels.