# Simulation of Attacker Defender Interaction in a Noisy Security Game

arXiv: https://arxiv.org/abs/2212.04281 · HTML: https://mlsanity.com/paper/2212.04281/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 20 references that are in the map.
- First posted on arXiv 8 Dec 2022.

## Builds on (most cited first, 3 of 3)

- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [A Game-Theoretic Model and Best-Response Learning Method for Ad Hoc Coordination in Multiagent Systems](https://mlsanity.com/paper/1506.01170/) (2015)
- [Evaluation of an Anomaly Detector for Routers using Parameterizable Malware in an IoT Ecosystem](https://mlsanity.com/paper/2111.00097/) (2021)

## Built on by (most cited first, 2 of 2)

- [The Price of Pessimism for Automated Defense](https://mlsanity.com/paper/2409.19237/) (2024)
- [Towards Type Agnostic Cyber Defense Agents](https://mlsanity.com/paper/2412.01542/) (2024)

## Abstract (arXiv)

In the cybersecurity setting, defenders are often at the mercy of their detection technologies and subject to the information and experiences that individual analysts have. In order to give defenders an advantage, it is important to understand an attacker's motivation and their likely next best action. As a first step in modeling this behavior, we introduce a security game framework that simulates interplay between attackers and defenders in a noisy environment, focusing on the factors that drive decision making for attackers and defenders in the variants of the game with full knowledge and observability, knowledge of the parameters but no observability of the state (``partial knowledge''), and zero knowledge or observability (``zero knowledge''). We demonstrate the importance of making the right assumptions about attackers, given significant differences in outcomes. Furthermore, there is a measurable trade-off between false-positives and true-positives in terms of attacker outcomes, suggesting that a more false-positive prone environment may be acceptable under conditions where true-positives are also higher.