{"id":"https://openalex.org/W3008131886","doi":"https://doi.org/10.1109/globecom38437.2019.9013291","title":"Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System","display_name":"Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System","publication_year":2019,"publication_date":"2019-12-01","ids":{"openalex":"https://openalex.org/W3008131886","doi":"https://doi.org/10.1109/globecom38437.2019.9013291","mag":"3008131886"},"language":"en","primary_location":{"id":"doi:10.1109/globecom38437.2019.9013291","is_oa":false,"landing_page_url":"https://doi.org/10.1109/globecom38437.2019.9013291","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Global Communications Conference (GLOBECOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5043374742","display_name":"Qiumei Cheng","orcid":"https://orcid.org/0000-0001-8972-036X"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiumei Cheng","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078198240","display_name":"Chunming Wu","orcid":"https://orcid.org/0000-0001-7958-9687"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I4210123185","display_name":"Zhejiang Lab","ror":"https://ror.org/02m2h7991","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210123185"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chunming Wu","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China","Zhejiang Lab, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]},{"raw_affiliation_string":"Zhejiang Lab, Hangzhou, China","institution_ids":["https://openalex.org/I4210123185"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028352417","display_name":"Bin Hu","orcid":"https://orcid.org/0000-0003-3286-4607"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bin Hu","raw_affiliation_strings":["College of Control Science and Engineering, Zhejiang University, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Control Science and Engineering, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054180209","display_name":"Dezhang Kong","orcid":"https://orcid.org/0000-0001-8522-6081"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dezhang Kong","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100646070","display_name":"Boyang Zhou","orcid":"https://orcid.org/0000-0003-0436-4293"},"institutions":[{"id":"https://openalex.org/I4210123185","display_name":"Zhejiang Lab","ror":"https://ror.org/02m2h7991","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210123185"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Boyang Zhou","raw_affiliation_strings":["Zhejiang Lab, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang Lab, Hangzhou, China","institution_ids":["https://openalex.org/I4210123185"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9933000206947327,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7268999218940735},{"id":"https://openalex.org/keywords/theory-of-mind","display_name":"Theory of mind","score":0.6267104148864746},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.6112249493598938},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.610322117805481},{"id":"https://openalex.org/keywords/game-theory","display_name":"Game theory","score":0.5295544266700745},{"id":"https://openalex.org/keywords/nash-equilibrium","display_name":"Nash equilibrium","score":0.4971921741962433},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4874108135700226},{"id":"https://openalex.org/keywords/order","display_name":"Order (exchange)","score":0.4622068405151367},{"id":"https://openalex.org/keywords/bayesian-game","display_name":"Bayesian game","score":0.4464013874530792},{"id":"https://openalex.org/keywords/best-response","display_name":"Best response","score":0.4357631802558899},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.43490609526634216},{"id":"https://openalex.org/keywords/fictitious-play","display_name":"Fictitious play","score":0.4237043857574463},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.418783962726593},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.33765172958374023},{"id":"https://openalex.org/keywords/cognition","display_name":"Cognition","score":0.30546846985816956},{"id":"https://openalex.org/keywords/repeated-game","display_name":"Repeated game","score":0.28515031933784485},{"id":"https://openalex.org/keywords/mathematical-economics","display_name":"Mathematical economics","score":0.23499488830566406},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.11634001135826111},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.09753045439720154}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7268999218940735},{"id":"https://openalex.org/C2779560602","wikidata":"https://www.wikidata.org/wiki/Q639219","display_name":"Theory of mind","level":3,"score":0.6267104148864746},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.6112249493598938},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.610322117805481},{"id":"https://openalex.org/C177142836","wikidata":"https://www.wikidata.org/wiki/Q44455","display_name":"Game theory","level":2,"score":0.5295544266700745},{"id":"https://openalex.org/C46814582","wikidata":"https://www.wikidata.org/wiki/Q23389","display_name":"Nash equilibrium","level":2,"score":0.4971921741962433},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4874108135700226},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.4622068405151367},{"id":"https://openalex.org/C200594392","wikidata":"https://www.wikidata.org/wiki/Q812529","display_name":"Bayesian game","level":4,"score":0.4464013874530792},{"id":"https://openalex.org/C32407928","wikidata":"https://www.wikidata.org/wiki/Q2733833","display_name":"Best response","level":3,"score":0.4357631802558899},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.43490609526634216},{"id":"https://openalex.org/C145071142","wikidata":"https://www.wikidata.org/wiki/Q1411116","display_name":"Fictitious play","level":3,"score":0.4237043857574463},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.418783962726593},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33765172958374023},{"id":"https://openalex.org/C169900460","wikidata":"https://www.wikidata.org/wiki/Q2200417","display_name":"Cognition","level":2,"score":0.30546846985816956},{"id":"https://openalex.org/C202556891","wikidata":"https://www.wikidata.org/wiki/Q1584646","display_name":"Repeated game","level":3,"score":0.28515031933784485},{"id":"https://openalex.org/C144237770","wikidata":"https://www.wikidata.org/wiki/Q747534","display_name":"Mathematical economics","level":1,"score":0.23499488830566406},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.11634001135826111},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.09753045439720154},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.0},{"id":"https://openalex.org/C169760540","wikidata":"https://www.wikidata.org/wiki/Q207011","display_name":"Neuroscience","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/globecom38437.2019.9013291","is_oa":false,"landing_page_url":"https://doi.org/10.1109/globecom38437.2019.9013291","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Global Communications Conference (GLOBECOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.8399999737739563}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W1968909445","https://openalex.org/W2021125080","https://openalex.org/W2053944475","https://openalex.org/W2069087469","https://openalex.org/W2078780684","https://openalex.org/W2131875370","https://openalex.org/W2140140369","https://openalex.org/W2157636101","https://openalex.org/W2158500619","https://openalex.org/W2765449849","https://openalex.org/W2792721951","https://openalex.org/W4232171810","https://openalex.org/W6664051019","https://openalex.org/W6670273682","https://openalex.org/W6683411045"],"related_works":["https://openalex.org/W1935632502","https://openalex.org/W2955291419","https://openalex.org/W2080682057","https://openalex.org/W3136807736","https://openalex.org/W2050089535","https://openalex.org/W3125790749","https://openalex.org/W2055504378","https://openalex.org/W2494067724","https://openalex.org/W3118593726","https://openalex.org/W4232850892"],"abstract_inverted_index":{"The":[0,22,38,50],"intrusion":[1,171],"response":[2,172],"system":[3,173],"is":[4,14,42,147],"dedicated":[5],"to":[6,9,44,96,122,138,149,154],"automatically":[7],"respond":[8],"sophisticated":[10],"network":[11],"intrusions,":[12],"which":[13],"a":[15,88,179],"sequential":[16],"decision-making":[17],"problem":[18],"for":[19],"autonomous":[20],"agents.":[21],"current":[23],"Markov":[24],"decision":[25],"process":[26],"(MDP)":[27],"or":[28],"stochastic":[29,55,93],"games":[30,56],"based":[31,40],"solutions":[32],"suffer":[33],"from":[34,151],"several":[35],"weaknesses:":[36],"(i)":[37],"MDP-":[39],"approach":[41,53,95],"unable":[43],"explicitly":[45],"model":[46,139],"the":[47,59,69,73,99,104,125,133,145,170],"opponents;":[48],"(ii)":[49],"Nash":[51],"equilibrium":[52],"of":[54,72,77,90,103],"cannot":[57],"handle":[58],"condition":[60],"with":[61,116,128,181,189],"multi":[62],"equilibria.":[63],"Existing":[64],"studies":[65],"have":[66],"not":[67],"considered":[68],"cognitive":[70],"ability":[71],"agent":[74,107,146],"and":[75,101,158],"lack":[76],"explicit":[78,117],"opponent":[79,115,118],"modeling.":[80,119],"Inspired":[81],"by":[82],"recursive":[83],"reasoning,":[84],"this":[85],"paper":[86],"introduces":[87],"theory":[89],"mind":[91],"(ToM)-based":[92],"game-theoretic":[94],"reason":[97],"about":[98],"beliefs":[100,112,157,184],"behaviors":[102],"attackers.":[105],"Each":[106],"maintains":[108],"different":[109],"order":[110,121],"ToM":[111,165,183,191],"concerning":[113],"his":[114,156],"In":[120,143],"accurately":[123],"predict":[124],"attacker's":[126],"action":[127],"nested":[129],"beliefs,":[130],"we":[131],"utilize":[132],"Bayesian":[134],"attack":[135],"graph":[136],"(BAG)":[137],"multi-step":[140],"attacks":[141],"scenarios.":[142],"addition,":[144],"allowed":[148],"learn":[150],"new":[152],"information":[153],"adjust":[155],"learning":[159],"speed.":[160],"Simulation":[161],"results":[162],"validate":[163],"that":[164],"modeling":[166],"performs":[167],"well":[168],"in":[169],"than":[174],"random":[175],"defense":[176],"actions.":[177],"Besides,":[178],"defender":[180],"first-order":[182],"always":[185],"wins":[186],"an":[187],"attacker":[188],"zero-order":[190],"beliefs.":[192]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}