{"id":"https://openalex.org/W7214891024","doi":"https://doi.org/10.48550/arxiv.2609.36485","title":"From Reconnaissance to Response: Quantitative Risk Parameterization and Game Theoretic Containment in Modern Enterprise Attack","display_name":"From Reconnaissance to Response: Quantitative Risk Parameterization and Game Theoretic Containment in Modern Enterprise Attack","publication_year":2026,"publication_date":"2026-09-29","ids":{"openalex":"https://openalex.org/W7214891024","doi":"https://doi.org/10.48550/arxiv.2609.36485"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.36485","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.36485","pdf_url":"https://arxiv.org/pdf/2609.36485","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.36485","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5153643184","display_name":"Shadeeb Hossain","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hossain, Shadeeb","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5124354153","display_name":"Elias Calboreanu","orcid":"https://orcid.org/0009-0008-9194-0589","observed_orcids":["https://orcid.org/0009-0008-9194-0589"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Calboreanu, Elias","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.7705000042915344,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.7705000042915344,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.22130000591278076,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.0010999999940395355,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/incident-response-automation","display_name":"automated incident response","score":0.6850000023841858},{"id":"https://openalex.org/keywords/security-operations-center","display_name":"security operations center","score":0.6610000133514404},{"id":"https://openalex.org/keywords/reconnaissance","display_name":"reconnaissance","score":0.4490000009536743},{"id":"https://openalex.org/keywords/cyber-kill-chain","display_name":"cyber kill chain","score":0.6800000071525574},{"id":"https://openalex.org/keywords/game-theory","display_name":"game theory","score":0.6110000014305115},{"id":"https://openalex.org/keywords/stackelberg-game","display_name":"Stackelberg game","score":0.9660000205039978},{"id":"https://openalex.org/keywords/bayesian-filtering","display_name":"Bayesian filtering","score":0.7540000081062317},{"id":"https://openalex.org/keywords/poisson-process","display_name":"Poisson process","score":0.6589999794960022},{"id":"https://openalex.org/keywords/cvss","display_name":"CVSS","score":0.878000020980835},{"id":"https://openalex.org/keywords/soar","display_name":"SOAR","score":0.6110000014305115},{"id":"https://openalex.org/keywords/network-isolation","display_name":"network isolation","score":0.9459999799728394}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7075999975204468},{"id":"https://openalex.org/C199510392","wikidata":"https://www.wikidata.org/wiki/Q1184602","display_name":"Stackelberg competition","level":2,"score":0.6310999989509583},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4521999955177307},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.44589999318122864},{"id":"https://openalex.org/C177142836","wikidata":"https://www.wikidata.org/wiki/Q44455","display_name":"Game theory","level":2,"score":0.4307999908924103},{"id":"https://openalex.org/C200594392","wikidata":"https://www.wikidata.org/wiki/Q812529","display_name":"Bayesian game","level":4,"score":0.42289999127388},{"id":"https://openalex.org/C160343169","wikidata":"https://www.wikidata.org/wiki/Q968642","display_name":"Backward induction","level":3,"score":0.4101000130176544},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3984000086784363},{"id":"https://openalex.org/C73795354","wikidata":"https://www.wikidata.org/wiki/Q287618","display_name":"Sequential game","level":3,"score":0.39399999380111694},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.3912000060081482},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.38519999384880066},{"id":"https://openalex.org/C113336015","wikidata":"https://www.wikidata.org/wiki/Q574010","display_name":"Complete information","level":2,"score":0.3804999887943268},{"id":"https://openalex.org/C169087156","wikidata":"https://www.wikidata.org/wiki/Q2131593","display_name":"Framing (construction)","level":2,"score":0.35089999437332153},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.3474000096321106},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3456000089645386},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.3407999873161316},{"id":"https://openalex.org/C33724603","wikidata":"https://www.wikidata.org/wiki/Q812540","display_name":"Bayesian network","level":2,"score":0.3352000117301941},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.32919999957084656},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.32659998536109924},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.31610000133514404},{"id":"https://openalex.org/C22171661","wikidata":"https://www.wikidata.org/wiki/Q1074380","display_name":"Stochastic game","level":2,"score":0.3061999976634979},{"id":"https://openalex.org/C2778868856","wikidata":"https://www.wikidata.org/wiki/Q18394273","display_name":"Threat assessment","level":2,"score":0.3018999993801117},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.30160000920295715},{"id":"https://openalex.org/C107327155","wikidata":"https://www.wikidata.org/wiki/Q330268","display_name":"Decision support system","level":2,"score":0.2992999851703644},{"id":"https://openalex.org/C126042441","wikidata":"https://www.wikidata.org/wiki/Q1324888","display_name":"Frame (networking)","level":2,"score":0.2992999851703644},{"id":"https://openalex.org/C89246107","wikidata":"https://www.wikidata.org/wiki/Q1398821","display_name":"Rule of thumb","level":2,"score":0.29490000009536743},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.2928999960422516},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.2847000062465668},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2842999994754791},{"id":"https://openalex.org/C57830394","wikidata":"https://www.wikidata.org/wiki/Q278079","display_name":"Posterior probability","level":3,"score":0.2824999988079071},{"id":"https://openalex.org/C19499675","wikidata":"https://www.wikidata.org/wiki/Q232207","display_name":"Monte Carlo method","level":2,"score":0.2802000045776367},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.27900001406669617},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.27869999408721924},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2775999903678894},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C46743427","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference engine","level":3,"score":0.2689000070095062},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.26739999651908875},{"id":"https://openalex.org/C37404715","wikidata":"https://www.wikidata.org/wiki/Q380679","display_name":"Dynamic programming","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.2644999921321869},{"id":"https://openalex.org/C205706631","wikidata":"https://www.wikidata.org/wiki/Q2319304","display_name":"Expected utility hypothesis","level":2,"score":0.26420000195503235}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.36485","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.36485","pdf_url":"https://arxiv.org/pdf/2609.36485","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.36485","doi":"https://doi.org/10.48550/arxiv.2609.36485","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.36485","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.36485","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.36485","pdf_url":"https://arxiv.org/pdf/2609.36485","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7214891024.pdf","grobid_xml":"https://content.openalex.org/works/W7214891024.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W7166531001"],"related_works":["https://openalex.org/W7221576257","https://openalex.org/W2140140369","https://openalex.org/W4308081858","https://openalex.org/W2622921428","https://openalex.org/W2041007383","https://openalex.org/W7215065779","https://openalex.org/W3082226847","https://openalex.org/W7160662401","https://openalex.org/W7122648282","https://openalex.org/W4388599691"],"abstract_inverted_index":{"Modern":[0],"Security":[1],"Operations":[2],"Centers":[3],"struggle":[4],"with":[5],"delayed":[6],"manual":[7],"incident":[8],"response,":[9],"enabling":[10],"adversaries":[11],"to":[12,41,43,73,184],"advance":[13],"through":[14,109],"the":[15,121,130,143,156,179],"Cyber":[16],"Kill":[17],"Chain":[18],"during":[19],"early":[20],"stage":[21],"reconnaissance.":[22],"While":[23],"classical":[24],"game":[25],"theoretic":[26,191],"defense":[27],"models":[28],"optimize":[29],"strategic":[30],"resource":[31],"allocation,":[32],"they":[33],"rely":[34],"on":[35],"static":[36],"utility":[37],"matrices":[38],"that":[39,55,155,178],"fail":[40],"adapt":[42],"dynamic":[44,125],"telemetry.":[45],"This":[46],"paper":[47],"presents":[48],"an":[49],"integrated,":[50],"metrics":[51],"driven":[52],"decision":[53,180],"engine":[54,157],"bridges":[56],"quantitative":[57],"risk":[58,133],"parameterization":[59],"and":[60,77,147],"continuous":[61],"automated":[62,164,196],"response":[63],"time.":[64],"Common":[65],"Vulnerability":[66],"Scoring":[67],"Systems":[68],"exploitability":[69],"parameters":[70],"are":[71,96],"mapped":[72],"attacker":[74],"success":[75],"probabilities":[76],"evaluate":[78],"defender":[79,105],"log":[80],"distributions":[81],"via":[82],"Factor":[83],"Analysis":[84],"of":[85,170],"Information":[86],"Risk":[87],"Monte":[88],"Carlo":[89],"simulations.":[90],"Real":[91],"time":[92],"SIEM":[93],"logs":[94],"streams":[95],"modeled":[97],"as":[98,123],"Poisson":[99],"process":[100],"arrival":[101],"rates,":[102],"dynamically":[103,182],"updating":[104],"posterior":[106],"threat":[107,197],"belief":[108],"sequential":[110],"Bayesian":[111,126],"filtering.":[112],"A":[113],"closed":[114],"form":[115],"threshold":[116],"is":[117],"derived":[118],"by":[119],"framing":[120],"interaction":[122],"a":[124,189],"Stackelberg":[127],"game,":[128],"where":[129],"expected":[131],"unmitigated":[132],"exceeds":[134],"proactive":[135],"containment":[136],"cost.":[137],"Parameterized":[138],"against":[139],"empirical":[140],"data":[141],"from":[142],"2023":[144],"MGM":[145],"Resorts":[146],"Caesars":[148],"Entertainment":[149],"cyber":[150],"incident,":[151],"simulation":[152],"results":[153],"demonstrate":[154],"suppresses":[158],"transient":[159],"background":[160],"noise":[161],"while":[162],"triggering":[163],"SOAR":[165],"network":[166],"isolation":[167],"within":[168],"seconds":[169],"adversarial":[171],"probing.":[172],"Multi":[173],"parameter":[174],"sensitivity":[175],"analysis":[176],"confirms":[177],"boundary":[181],"adjusts":[183],"live":[185],"perimeter":[186],"vulnerability,":[187],"offering":[188],"control":[190],"foundation":[192],"for":[193],"sub":[194],"minute":[195],"containment.":[198]},"counts_by_year":[],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2026-10-01T00:00:00"}