defenders into indefinite, always ongoing, resource-intensive response. To allocate
resources effectively, the defender must analyze and respond to an uncertain stream of
potentially undetected multiple multi-step attacks and take measures of attack and response
intensity over time into account. Such response requires estimation of overall attack success
metrics and evaluating effect of defender strategies and actions associated with specific …