# CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization

arXiv: https://arxiv.org/abs/2508.00478 · HTML: https://mlsanity.com/paper/2508.00478/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 16 of its 49 references that are in the map.
- First posted on arXiv 1 Aug 2025.

## Builds on (most cited first, 16 of 16)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks](https://mlsanity.com/paper/1908.10084/) (2019)
- [Language Models as Zero-Shot Planners: Extracting Actionable Knowledge for Embodied Agents](https://mlsanity.com/paper/2201.07207/) (2022)
- [AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks](https://mlsanity.com/paper/2403.01038/) (2024)
- [Strategic Behavior of Large Language Models: Game Structure vs. Contextual Framing](https://mlsanity.com/paper/2309.05898/) (2023)
- [Large Language Models in Cybersecurity: State-of-the-Art](https://mlsanity.com/paper/2402.00891/) (2024)
- [CySecBERT: A Domain-Adapted Language Model for the Cybersecurity Domain](https://mlsanity.com/paper/2212.02974/) (2022)
- [A Game-Theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy](https://mlsanity.com/paper/1712.05441/) (2017)
- [Exploit Prediction Scoring System (EPSS)](https://mlsanity.com/paper/1908.04856/) (2019)
- [Generative AI for Game Theory-based Mobile Networking](https://mlsanity.com/paper/2404.09699/) (2024)
- [SUB-PLAY: Adversarial Policies against Partially Observed Multi-Agent Reinforcement Learning Systems](https://mlsanity.com/paper/2402.03741/) (2024)
- [Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights](https://mlsanity.com/paper/2302.14172/) (2023)
- [IntellBot: Retrieval Augmented LLM Chatbot for Cyber Threat Knowledge Delivery](https://mlsanity.com/paper/2411.05442/) (2024)
- [A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges](https://mlsanity.com/paper/2502.11070/) (2025)
- [Exploring Equilibrium Strategies in Network Games with Generative AI](https://mlsanity.com/paper/2405.08289/) (2024)
- [VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs](https://mlsanity.com/paper/2502.11143/) (2025)

## Abstract (arXiv)

Modern cyber attacks unfold through multiple stages, requiring defenders to dynamically prioritize mitigations under uncertainty. While game-theoretic models capture attacker-defender interactions, existing approaches often rely on static assumptions and lack integration with real-time threat intelligence, limiting their adaptability. This paper presents CyGATE, a game-theoretic framework modeling attacker-defender interactions, using large language models (LLMs) with retrieval-augmented generation (RAG) to enhance tactic selection and patch prioritization. Applied to a two-agent scenario, CyGATE frames cyber conflicts as a partially observable stochastic game (POSG) across Cyber Kill Chain stages. Both agents use belief states to navigate uncertainty, with the attacker adapting tactics and the defender re-prioritizing patches based on evolving risks and observed adversary behavior. The framework's flexible architecture enables extension to multi-agent scenarios involving coordinated attackers, collaborative defenders, or complex enterprise environments with multiple stakeholders. Evaluated in a dynamic patch scheduling scenario, CyGATE effectively prioritizes high-risk vulnerabilities, enhancing adaptability through dynamic threat integration, strategic foresight by anticipating attacker moves under uncertainty, and efficiency by optimizing resource use.