Abstract:Cyber vulnerabilities become ever more critical in modern industrial systems since the attacker can utilize the vulnerabilities to degrade their performance or even cause disasters. In 2015, a series of sequential and well-organized cyber attacks intruded into the Ukrainian power grid, compromised access to the control system, and interrupted the power supply system, finally causing a widespread power outage. To assist the defender, e.g., power grid operator, to allocate protection resources against cyber attacks, existing studies have devoted considerable efforts to risk and reliability analysis and interaction analysis using game theory. The defender's protection strategy includes preevent defense strategy and postevent repair strategy. The strategy spaces of both players were static in previous studies. However, facing Ukrainian-style cyber attacks, the strategy spaces could variate during the attacker–defender confrontation. In other words, the vulnerability compromised by the attacker in one stage could expose the subsequential vulnerabilities, leading to the change of strategy spaces. In this work, a multistage attack–defense graph game model is proposed to assist the defender in allocating protection resources optimally against sequential cyber attacks during multiple stages. In addition, we consider the existence of the rationality evolution of the attacker, which mainly results from asymmetric information, capacity limitation, and progressive learning during the confrontation. Compared to previous studies based on static strategy spaces and static rationalities, our model is more practical and effective in dealing with Ukrainian-style cyber attacks. The simulation results show the superiority of our approach, and some notable observations and practical suggestions are summarized for the defender.

Network defense decision-making based on deep reinforcement learning and dynamic game theory

Network Security Defense Decision-Making Method Based on Stochastic Game and Deep Reinforcement Learning

A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning

Research and Challenges of Reinforcement Learning in Cyber Defense Decision-Making for Intranet Security

Optimal Network Defense Strategy Selection Method: A Stochastic Differential Game Model

Adversarial Decision-Making for Moving Target Defense: A Multi-Agent Markov Game and Reinforcement Learning Approach

Intelligent Decision‐Making System of Air Defense Resource Allocation via Hierarchical Reinforcement Learning

Markov Decision Process For Automatic Cyber Defense

Defense Strategy Selection Model Based on Multistage Evolutionary Game Theory

Multistage Attack–Defense Graph Game Analysis for Protection Resources Allocation Optimization Against Cyber Attacks Considering Rationality Evolution

Deep Reinforcement Learning‐Based Air Defense Decision‐Making Using Potential Games

Optimal Network Defense Strategy Selection Based on Bayesian Game

DDoS Defense Method in Software-Defined Space-Air-Ground Network from Dynamic Bayesian Game Perspective

Optimal Decision Making Approach for Cyber Security Defense Using Evolutionary Game.

Tripartite evolutionary game in the process of network attack and defense

Optimal Repair Strategy Against Advanced Persistent Threats Under Time-Varying Networks

Network Security Defense Strategy of Deep Reinforcement Learning Oriented to Game Battle

Autonomous Network Defence using Reinforcement Learning

Application of hybrid strategies of complex network attack and defense games

Deep Reinforcement Learning for Cyber System Defense under Dynamic Adversarial Uncertainties

Improving anti-jamming decision-making strategies for cognitive radar via multi-agent deep reinforcement learning