# Dynamical low-rank equilibrium computation for stochastic games between advanced persistent threats and moving target defense

arXiv: https://arxiv.org/abs/2610.06885 · HTML: https://mlsanity.com/paper/2610.06885/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 16 of its 63 references that are in the map.
- First posted on arXiv 20 Sep 2026.

## Builds on (most cited first, 16 of 16)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [A Dynamic Games Approach to Proactive Defense Strategies against Advanced Persistent Threats in Cyber-Physical Systems](https://mlsanity.com/paper/1906.09687/) (2019)
- [Robust low-rank training via approximate orthonormal constraints](https://mlsanity.com/paper/2306.01485/) (2023)
- [Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense](https://mlsanity.com/paper/1909.08092/) (2019)
- [A Generalized Minimax Q-learning Algorithm for Two-Player Zero-Sum Stochastic Games](https://mlsanity.com/paper/1906.06659/) (2019)
- [Dynamical Low-Rank Compression of Neural Networks with Robustness under Adversarial Attacks](https://mlsanity.com/paper/2505.08022/) (2025)
- [Data-Injection Attacks in Stochastic Control Systems: Detectability and Performance Tradeoffs](https://mlsanity.com/paper/1704.00748/) (2017)
- [Moving-Target Defense Against Cyber-Physical Attacks in Power Grids via Game Theory](https://mlsanity.com/paper/2006.07697/) (2020)
- [A Bayesian Nash equilibrium-based moving target defense against stealthy sensor attacks](https://mlsanity.com/paper/2111.06682/) (2021)
- [Tackling Cyberattacks through AI-based Reactive Systems: A Holistic Review and Future Vision](https://mlsanity.com/paper/2312.06229/) (2023)
- [Controller-jammer game models of Denial of Service in control systems operating over packet-dropping links](https://mlsanity.com/paper/1706.01559/) (2017)
- [Dynamic Information Flow Tracking for Detection of Advanced Persistent Threats: A Stochastic Game Approach](https://mlsanity.com/paper/2006.12327/) (2020)
- [Stochastic Dynamic Information Flow Tracking Game using Supervised Learning for Detecting Advanced Persistent Threats](https://mlsanity.com/paper/2007.12327/) (2020)
- [Consensus for Clusters of Agents with Cooperative and Antagonistic Relationships](https://mlsanity.com/paper/2008.12398/) (2020)
- [BG-FlipIn: A Bayesian game framework for FlipIt-insider models in advanced persistent threats](https://mlsanity.com/paper/2510.07430/) (2025)

## Abstract (arXiv)

Moving target defense (MTD) against advanced persistent threats (APTs) in industrial control systems (ICS) has well-established game-theoretic formulations, but their practical value hinges on equilibrium computation, which faces two gaps: full-rank value iteration is prohibitively expensive at industrial scale, and the resulting defense strategies admit no certified robustness against adversarial perturbations. We first reveal that the attack and defense influence matrices of ICS dynamics are intrinsically low-rank: APTs infiltrate through a handful of entry points and MTD reconfigures only a few components per cycle. Our theory makes four contributions. First, an augmented gradient matrix certifies that the low-rank structure propagates through the non-smooth Bellman operator of the zero-sum stochastic game, so that every Bellman target lies near a low-dimensional subspace and low-rank truncation incurs an explicit error bound (Lemma 1, Theorem 1). Second, we propose the Dynamical Low-Rank Nash Equilibrium algorithm, named DLR-NE, which augments the rank-r search space each iteration, regularizes the core matrix spectrum, and retracts via truncated SVD, and prove that it converges geometrically to a neighborhood whose error decomposes into five physically interpretable sources (Theorem 2). Third, its per-step cost is O(nr^2), a Theta(n/r^2) speedup over full-rank value iteration (Theorem 3). Fourth, a single weight trades accuracy against a certified sensitivity bound of the induced defense strategy under core-matrix perturbations (Corollary 1). Six experiments on a nonlinear power-system testbed confirm each prediction, with 94% parameter compression at 2.3% utility loss. All experimental data and code are publicly available.