Dynamic Vulnerability Assessment for Connected Healthcare Systems via ContinuousTime Bayesian Networks

Connected healthcare environments increasingly rely on Internet of Medical Things (IoMT) devices and integrated medical networks to support clinical operations. However, this high level of connectivity expands the attack surface and introduces significant cybersecurity risks that can endanger patient safety and compromise data confidentiality. In this context, effective vulnerability assessment and prioritization are essential; nevertheless, current approaches are predominantly static and fail to capture the temporal dynamics associated with real-world vulnerability exploitation processes. For this reason, the paper introduces a vulnerability assessment approach based on ContinuousTime Bayesian Networks (CTBNs), which enable explicit modeling of vulnerability state transitions as continuoustime stochastic processes. Unlike discrete-time formulations, CTBNs incorporate time-dependent factors such as the evolving time to exploit, the likelihood of exploitation over time, and changes in adversarial capabilities. This enables the computation of exploitation probabilities as continuous functions, providing an adaptive vulnerability prioritization mechanism aligned with the operational requirements of clinical environments. The proposed approach is evaluated within a simulated hospital network. By modeling vulnerability dependencies through CTBNs, the framework enables the computation of posterior exploitation probabilities along potential attack paths targeting critical clinical assets. Preliminary results indicate that the CTBN-based approach improves the timeliness and responsiveness of vulnerability assessment compared with static methods. This dynamic perspective supports better-informed and proactive risk mitigation strategies in safety-critical healthcare settings, further improving cybersecurity management in these environments.

Keywords: Vulnerability Prioritization, Bayesian Networks, Temporal Analysis, Cybersecurity, Healthcare.