{"id":"https://openalex.org/W4412610429","doi":"https://doi.org/10.1109/hpcc64274.2024.00164","title":"A Learning-Based POMDP Approach for Adaptive Cyber Defense Against Multi-Stage Attacks","display_name":"A Learning-Based POMDP Approach for Adaptive Cyber Defense Against Multi-Stage Attacks","publication_year":2024,"publication_date":"2024-12-13","ids":{"openalex":"https://openalex.org/W4412610429","doi":"https://doi.org/10.1109/hpcc64274.2024.00164"},"language":"en","primary_location":{"id":"doi:10.1109/hpcc64274.2024.00164","is_oa":false,"landing_page_url":"https://doi.org/10.1109/hpcc64274.2024.00164","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IEEE International Conference on High Performance Computing and Communications (HPCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5058067324","display_name":"Yuantian Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuantian Zhang","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101663542","display_name":"Weixia Cai","orcid":"https://orcid.org/0000-0002-6691-509X"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weixia Cai","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070908636","display_name":"Huashan Chen","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Huashan Chen","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108121313","display_name":"Zhenyu Qi","orcid":"https://orcid.org/0009-0003-1195-3771"},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhenyu Qi","raw_affiliation_strings":["University of Arizona,Tucson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona,Tucson,USA","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100420477","display_name":"Hong Chen","orcid":"https://orcid.org/0000-0003-4963-7515"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hong Chen","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100750900","display_name":"Feng Liu","orcid":"https://orcid.org/0000-0002-6903-6840"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Feng Liu","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035606153","display_name":"Sen He","orcid":"https://orcid.org/0000-0002-5204-8976"},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sen He","raw_affiliation_strings":["University of Arizona,Tucson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona,Tucson,USA","institution_ids":["https://openalex.org/I138006243"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.5585,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.69050387,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1220","last_page":"1227"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9779000282287598,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9779000282287598,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7291381359100342},{"id":"https://openalex.org/keywords/partially-observable-markov-decision-process","display_name":"Partially observable Markov decision process","score":0.6420003175735474},{"id":"https://openalex.org/keywords/stage","display_name":"Stage (stratigraphy)","score":0.4875909686088562},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.392177939414978},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.34114575386047363},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3067762851715088},{"id":"https://openalex.org/keywords/markov-chain","display_name":"Markov chain","score":0.09059882164001465},{"id":"https://openalex.org/keywords/markov-model","display_name":"Markov model","score":0.06692394614219666}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7291381359100342},{"id":"https://openalex.org/C17098449","wikidata":"https://www.wikidata.org/wiki/Q176814","display_name":"Partially observable Markov decision process","level":4,"score":0.6420003175735474},{"id":"https://openalex.org/C146357865","wikidata":"https://www.wikidata.org/wiki/Q1123245","display_name":"Stage (stratigraphy)","level":2,"score":0.4875909686088562},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.392177939414978},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.34114575386047363},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3067762851715088},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.09059882164001465},{"id":"https://openalex.org/C163836022","wikidata":"https://www.wikidata.org/wiki/Q6771326","display_name":"Markov model","level":3,"score":0.06692394614219666},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/hpcc64274.2024.00164","is_oa":false,"landing_page_url":"https://doi.org/10.1109/hpcc64274.2024.00164","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IEEE International Conference on High Performance Computing and Communications (HPCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Climate action","score":0.4099999964237213,"id":"https://metadata.un.org/sdg/13"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W433644524","https://openalex.org/W1526913711","https://openalex.org/W1629225656","https://openalex.org/W1985324839","https://openalex.org/W2054127354","https://openalex.org/W2064675550","https://openalex.org/W2065776696","https://openalex.org/W2099103357","https://openalex.org/W2104588447","https://openalex.org/W2110908300","https://openalex.org/W2121141821","https://openalex.org/W2131875370","https://openalex.org/W2166975838","https://openalex.org/W2539955859","https://openalex.org/W2603959005","https://openalex.org/W2767806373","https://openalex.org/W2792721951","https://openalex.org/W2890428069","https://openalex.org/W2946127746","https://openalex.org/W3099080616","https://openalex.org/W3194625192","https://openalex.org/W4248986893","https://openalex.org/W6741002519","https://openalex.org/W6762456871"],"related_works":["https://openalex.org/W2961085424","https://openalex.org/W4306674287","https://openalex.org/W4387369504","https://openalex.org/W4394896187","https://openalex.org/W3170094116","https://openalex.org/W4386462264","https://openalex.org/W3107602296","https://openalex.org/W4364306694","https://openalex.org/W4312192474","https://openalex.org/W4283697347"],"abstract_inverted_index":{"While":[0],"various":[1,134],"defense":[2,15,37],"mechanisms":[3,16],"have":[4,71],"been":[5],"proposed":[6],"in":[7,39,103],"cybersecurity,":[8],"it":[9],"is":[10,155],"still":[11],"unclear":[12],"how":[13],"these":[14],"should":[17],"be":[18],"dynamically":[19],"employed":[20],"to":[21,41,53,98,125,136,157],"mitigate":[22],"the":[23,33,47,55,58,61,66,69,79,92,95,110,127,138,153,158],"damage":[24],"of":[25,35,112,140],"multi-stage":[26,43],"attacks.":[27,44],"In":[28],"this":[29],"work,":[30],"we":[31,77,116],"consider":[32],"problem":[34,82,111],"generating":[36],"strategy":[38,80],"real-time":[40],"thwart":[42],"We":[45,130],"use":[46],"Bayesian":[48],"condition":[49],"dependency":[50],"graph":[51],"(BCDG)":[52],"model":[54],"interactions":[56],"between":[57],"attacker":[59,67,93],"and":[60,68,94,152],"defender.":[62],"Considering":[63],"that":[64,146],"both":[65],"defender":[70,96],"uncertainty":[72],"about":[73],"their":[74,100],"respective":[75],"observations,":[76],"formulate":[78],"selection":[81],"as":[83],"a":[84,104,118],"partially":[85,105],"observable":[86],"Markov":[87],"decision":[88],"process":[89],"(POMDP),":[90],"where":[91],"need":[97],"find":[99],"optimal":[101,128],"strategies":[102],"observation":[106],"environment.":[107,161],"To":[108],"solve":[109],"state":[113],"space":[114],"explosion,":[115],"develop":[117],"deep":[119],"reinforcement":[120],"learning":[121],"(DRL)":[122],"based":[123],"approach":[124,149,154],"seek":[126],"strategies.":[129],"conduct":[131],"experiments":[132],"with":[133],"settings":[135],"evaluate":[137],"effectiveness":[139],"our":[141,147],"approach.":[142],"Experiment":[143],"results":[144],"show":[145],"DRL-based":[148],"outperforms":[150],"baselines,":[151],"robust":[156],"uncertain":[159],"security":[160]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}