## 3 Materials and Methods
### Analysis on the APT's Advantage  
We presume that an APT is considered successful in the case that the output of the level 2 fusion attributes the most mass value to the NORMAL hypothesis. Accordingly, let \(N\) denote the total number of detectors, where (for simplicity) we assumed that each detector is configured to attest the behaviour of one observable variable. Then, let \(P\) denote the number of compromised observable variables. We use the term compromised detector to denote a detector that uses a compromised observable variable as its input. Subsequently, we use \(F\) to denote the remaining number of non-compromised (attack-free) detectors, such that \(N=P+F\).  
Since an attacker may wish to increase his chances of not being detected, then he/she will try to predict the next best value for a compromised observable variable. Therefore, the best scenario for an attacker is when the compromised detectors activate only the NORMAL and \(\Theta\) hypothesis. Subsequently, the remaining non-compromised detectors will output the actual detected system state ANOMALY, alongside \(\Theta\).  
According to these assumptions, let \(X_{p}^{P}=m_{1,2,P}\), \(Z_{p}^{P}=m_{1,2,P}\) denote the \(P\)-th fusion on the attacker's mass functions on hypothesis NORMAL, and, \(\Theta\), respectively. Let \(Y_{f}^{F}=m_{1,2,F}\), \(Z_{f}^{F}=m_{1,2,F}\) denote the \(F\)-th fusion on the clear (non-compromised) mass functions on hypothesis ANOMALY, and \(\Theta\), respectively. Then, by means of deduction, we obtained the following recursive formulas, which express the result of fusion on \(P\) compromised detectors:  
\[X_{p}^{P}=\sum_{i=1}^{P}a_{i}^{P}X_{p}^{P-i+1}Z_{p}^{i-1},\]  
\[\text{where }\ a_{i}^{P}=a_{i-1}^{P-1}+a_{i}^{P-1},\text{and }\ a_{i-1}^{P-1}=0,\ \ \text{if }\ P-1=0;a_{i}^{P-1}=1,\ \ \text{if }\ P=i. \tag{11}\]  
Similarly, for the case of the non-compromised (attack-free) \(F\) detectors, we obtained the following equations:  
\[Y_{f}^{F}=\sum_{i=1}^{F}b_{i}^{F}Y_{f}^{F-i+1}Z_{f}^{i-1},\]  
\[\text{where }\ b_{i}^{F}=b_{i-1}^{F-1}+b_{i}^{F-1},\text{and }\ b_{i-1}^{F-1}=0,\ \ \text{if }\ F-1=0;b_{i}^{F-1}=1,\ \ \text{if }\ F=i. \tag{12}\]  
Next, we fuse the two mass functions \(X_{p}^{P}\) and \(Y_{f}^{F}\) on all hypothesis obtaining the following final mass function (\(m_{f}\), where \(K=X_{p}^{P}Y_{f}^{F}\)):  
\[m_{f}(\text{NORMAL})=\frac{1}{1-K}X_{p}^{P}Z_{f}^{F},m_{f}( \text{ANOMALY})=\frac{1}{1-K}Y_{f}^{F}Z_{p}^{P},\] \[m_{f}(\Theta)=\frac{1}{1-K}Z_{p}^{P}Z_{f}^{F}. \tag{13}\]  
The advantage of the attacker \(\mathtt{Avd}(\mathtt{APT})\) is then defined as:  
\[\mathtt{Adv}(\mathtt{APT})=m_{f}(\text{ANOMALY})-m_{f}(\text{NORMAL}). \tag{14}\]Consequently, as long as \(\texttt{Avd}(\texttt{APT})>0\), the attack is not reported by the decision fusion system. Therefore, the following condition needs to hold:  
\[\frac{1}{1-K}X_{p}^{p}Z_{f}^{F}>\frac{1}{1-K}Y_{f}^{F}Z_{p}^{p}. \tag{15}\]  
By eliminating the fraction from the left and right sides we obtain the following simplified equation:  
\[X_{p}^{p}Z_{f}^{F}>Y_{f}^{F}Z_{p}^{p}. \tag{16}\]  
Subsequently, by replacing the specific values we obtain that:  
\[Z_{f}^{F}\sum_{i=1}^{P}a_{i}^{p}X_{p}^{p-i+1}Z_{p}^{i-1}>Z_{p}^{p}\sum_{i=1}^{ F}b_{i}^{F}Y_{f}^{F-i+1}Z_{f}^{i-1}. \tag{17}\]  
The equation above shows that the advantage of the attacker is influenced by the precision of the compromised elements, as well as, by the number of compromised process outputs. However, we observe that a larger number of compromised elements (\(P>F\)) but with lower precision (\(X_{p}^{P}<Y_{f}^{F}\)) will have a negative impact on the attacker's advantage. Therefore, the attacker needs to strive and achieve high precision for predicting the correct value of compromised variables. Otherwise, even for a large number of compromised components, the attack may still be reported.