# A Dynamic Games Approach to Proactive Defense Strategies against Advanced Persistent Threats in Cyber-Physical Systems

arXiv: https://arxiv.org/abs/1906.09687 · HTML: https://mlsanity.com/paper/1906.09687/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Jun 2019.

## Built on by (most cited first, 17 of 17)

- [The Confluence of Networks, Games and Learning](https://mlsanity.com/paper/2105.08158/) (2021)
- [Reinforcement Learning for Feedback-Enabled Cyber Resilience](https://mlsanity.com/paper/2107.00783/) (2021)
- [Learning Near-Optimal Intrusion Responses Against Dynamic Attackers](https://mlsanity.com/paper/2301.06085/) (2023)
- [Automated Security Response through Online Learning with Adaptive Conjectures](https://mlsanity.com/paper/2402.12499/) (2024)
- [Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search](https://mlsanity.com/paper/2407.11070/) (2024)
- [Game Theory Meets LLM and Agentic AI: Reimagining Cybersecurity for the Age of Intelligent Threats](https://mlsanity.com/paper/2507.10621/) (2025)
- [Symbiotic Game and Foundation Models for Cyber Deception Operations in Strategic Cyber Warfare](https://mlsanity.com/paper/2403.10570/) (2024)
- [ADVERT: An Adaptive and Data-Driven Attention Enhancement Mechanism for Phishing Prevention](https://mlsanity.com/paper/2106.06907/) (2021)
- [Learning Security Strategies through Game Play and Optimal Stopping](https://mlsanity.com/paper/2205.14694/) (2022)
- [Agentic AI for Cyber Resilience: A New Security Paradigm and Its System-Theoretic Foundations](https://mlsanity.com/paper/2512.22883/) (2025)
- [RADAMS: Resilient and Adaptive Alert and Attention Management Strategy against Informational Denial-of-Service (IDoS) Attacks](https://mlsanity.com/paper/2111.03463/) (2021)
- [Adaptive Anomaly Detection for Identifying Attacks in Cyber-Physical Systems: A Systematic Literature Review](https://mlsanity.com/paper/2411.14278/) (2024)
- [Combating Informational Denial-of-Service (IDoS) Attacks: Modeling and Mitigation of Attentional Human Vulnerability](https://mlsanity.com/paper/2108.08255/) (2021)
- [ZETAR: Modeling and Computational Design of Strategic and Adaptive Compliance Policies](https://mlsanity.com/paper/2204.02294/) (2022)
- [Patrol Security Game: Defending Against Adversary with Freedom in Attack Timing, Location, and Duration](https://mlsanity.com/paper/2410.15600/) (2024)
- [A Study on the Importance of Features in Detecting Advanced Persistent Threats Using Machine Learning](https://mlsanity.com/paper/2502.07207/) (2025)
- [Dynamical low-rank equilibrium computation for stochastic games between advanced persistent threats and moving target defense](https://mlsanity.com/paper/2610.06885/) (2026)

## Abstract (arXiv)

Advanced Persistent Threats (APTs) have recently emerged as a significant security challenge for a cyber-physical system due to their stealthy, dynamic and adaptive nature. Proactive dynamic defenses provide a strategic and holistic security mechanism to increase the costs of attacks and mitigate the risks. This work proposes a dynamic game framework to model a long-term interaction between a stealthy attacker and a proactive defender. The stealthy and deceptive behaviors are captured by the multi-stage game of incomplete information, where each player has his own private information unknown to the other. Both players act strategically according to their beliefs which are formed by the multi-stage observation and learning. The perfect Bayesian Nash equilibrium provides a useful prediction of both players' policies because no players benefit from unilateral deviations from the equilibrium. We propose an iterative algorithm to compute the perfect Bayesian Nash equilibrium and use the Tennessee Eastman process as a benchmark case study. Our numerical experiment corroborates the analytical results and provides further insights into the design of proactive defense-in-depth strategies.