Scholarlink

Advanced Persistent Threats (APTs), exemplified by the SolarWinds attack, demand adaptive defenses in partially observable network environments. We model the defender-attacker interaction as a Partially Observable Markov Decision Process (POMDP)-based stochastic game, executed in the test environment AttackBed, and solved using reinforcement learning (RL) with Proximal Policy Optimization (PPO) and Recurrent PPO (RPPO). Our contributions include: (1) theorems proving equilibrium existence, threshold-structured best responses, and convergence properties, (2) a high-fidelity GNS3-based simulation aligned with MITRE ATT&CK/D3FEND frameworks, and (3) empirical comparisons showing PPO outperforms RPPO in mitigating attacks. PPO reduces attack success rates by 65%, leveraging sample efficiency in realistic settings. This comprehensive study advances game-theoretic RL for cyber defense, providing a foundation for future multi-agent frameworks.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Dynamic Shields: A Game-Theoretic Reinforcement Learning Framework for APT Mitigation

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Gustaf Johansson,
  • Aws Jaber,
  • Florian Skopik,
  • Max Landauer,
  • Wolfgang Hotwagner,
  • Markus Wurzenberger

摘要

Advanced Persistent Threats (APTs), exemplified by the SolarWinds attack, demand adaptive defenses in partially observable network environments. We model the defender-attacker interaction as a Partially Observable Markov Decision Process (POMDP)-based stochastic game, executed in the test environment AttackBed, and solved using reinforcement learning (RL) with Proximal Policy Optimization (PPO) and Recurrent PPO (RPPO). Our contributions include: (1) theorems proving equilibrium existence, threshold-structured best responses, and convergence properties, (2) a high-fidelity GNS3-based simulation aligned with MITRE ATT&CK/D3FEND frameworks, and (3) empirical comparisons showing PPO outperforms RPPO in mitigating attacks. PPO reduces attack success rates by 65%, leveraging sample efficiency in realistic settings. This comprehensive study advances game-theoretic RL for cyber defense, providing a foundation for future multi-agent frameworks.