Abstract
Adversarial Risk Analysis (ARA) provides a principled framework for modeling cybersecurity decisions under uncertainty, where the defender does not react to individual attacks but instead optimizes a security posture across the full threat landscape. However, existing ARA formulations for Network Intrusion Detection Systems (NIDS) rely on assumed parameter values, limiting their practical applicability. We present a methodology for grounding ARA-OSID (Adversarial Risk Analysis for Open Set Intrusion Detection) utility functions in empirical threat intelligence from MITRE ATT&CK v16. Building on an existing hybrid Long Short-Term Memory (LSTM) Markov attack chain prediction pipeline that generates over 8,000 tactic-ordered attack chains from 33 real-world campaigns, we extract attacker and defender utility parameters directly from ATT&CK technique metadata, group usage statistics, and D3FEND [1] defensive coverage mappings. Attacker effort, detection probability, resource cost, and benefit are derived from technique permissions, defensive countermeasure counts, kill-chain position, and National Cyber Incident Scoring System (NCISS) severity scores. Defender threat probability, false negative and false positive costs, model repair costs, and operation costs are computed from group frequency, severity weighted detection gaps, evasion sub technique counts, and mitigation portfolio size. The majority of parameters are derived directly from existing pipeline data structures, requiring no additional data collection, while a small number of configurable weights are explored through sensitivity analysis. The resulting empirically grounded utility functions are validated against NCISS campaign severity scores.