## 4 Results
### Discussion  
As demonstrated by the previous experiments, E-APTDetect comprises a proactive methodology for triggering certain behavior, and consequently, for the detection of APTs. Its main building block considers that APTs are able to compromise a large number of components, and that, in the extreme case, all observed variables may be under the attacker's control. As a result, the adversary will hide its presence by recreating the process's state by various techniques ranging from replaying previous values, to reproducing the process behaviour in case sufficient details are acquired [41].  
To counteract such sophisticated threats, E-APTDetect leverages system dynamics. The approach presumes randomly triggered changes to control variables, which lead to process behavioral changes that are randomly distributed in time. Consequently, while an adversary may easily hide its presence in the case of a steady-state process, random changes may be difficult to predict, and consequently, to forge. As illustrated by Equation (17), the adversary's advantage is influenced not only by the number of compromised components, but also by the quality of forged values. Accordingly, in case the attacker compromises a large number of components, but with a reduced quality (i.e., low precision of forging observable variables), this will have a negative impact on the attacker's advantage. Conversely, the adversary should strive to produce high-quality observable values to ensure stealthiness. For this purpose the adversary may need to observe and analyse the process behavior for a long time period; to identify the process state; and, to use highly accurate process models. Essentially, the APT's success may be reduced to the quality of the elements used to hide the attacker's presence.  
While certain doubts may be raised about using process models in E-APTDetect's validation, we observe that throughout the scientific literature, the use of simulation is a well-known technique to conduct security experiments [42; 43; 44]. Subsequently, considering the safety requirements for building such testbeds [44], process models represent an ideal candidate for such purposes. We further note that, the VAM process is a complex and large-scale model of a realistic physical system. As already stated, the process exhibits 246 states, 26 control variables, and 43 observed variables, which provides a complex environment for conducting a wide variety of experiments. Obviously, the output of the experiments needs to be interpreted within the process limitations and safety constraints. Nonetheless, the aim of E-APTDetect's interventions is not to generate severe deviations in the process state, but to cause minor changes, which do not alter the process state, and ensure process execution within safety limitations. As a result, the output of the VAM process considering the defined interventions and experimental results can be considered as close to reality as the model is.  
In terms of applications of E-APTDetect to real systems, a critical aspect is safety. Therefore, the interventions need to be defined by process experts such that these do not cause significant process deviations and are within the process safety limitations. Subse  
Figure 18: Progressive increase in the number of compromised detectors (compromised observable variables).  
quently, since interventions will generate certain costs, the attestation costs, as defined in Equation (10) need to be estimated. As mentioned earlier, the estimated costs encapsulate the costs of products and operations required for performing the attestation. Considering also the complexity of the procedure, as exhibited in Algorithm 1, a higher number of behavioral scenarios and attested subsystems can further raise the attestation costs. Consequently, the application of E-APTDetect in the context of a real industrial system requires careful planning performed by process experts that take into account both the costs and system safety.