{"id":"https://openalex.org/W4414692593","doi":"https://doi.org/10.1109/tifs.2025.3616599","title":"A Non-Markovian Game Approach on Labeled Attack Graphs for Security Decision-Making in Industrial Control Systems","display_name":"A Non-Markovian Game Approach on Labeled Attack Graphs for Security Decision-Making in Industrial Control Systems","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414692593","doi":"https://doi.org/10.1109/tifs.2025.3616599"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3616599","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3616599","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053967949","display_name":"Yiqun Yue","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiqun Yue","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China","Beijing University of Posts and Telecommunications, China"],"raw_orcid":"https://orcid.org/0009-0003-4313-8157","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]},{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037190906","display_name":"Shaolin Tan","orcid":"https://orcid.org/0000-0001-6549-9760"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shaolin Tan","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6549-9760","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051099337","display_name":"Ye Tao","orcid":"https://orcid.org/0000-0003-4814-767X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ye Tao","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102779356","display_name":"Nian Liu","orcid":"https://orcid.org/0000-0002-2093-5394"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nian Liu","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2093-5394","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027725400","display_name":"Jinhu L\u00fc","orcid":"https://orcid.org/0000-0003-0275-8387"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinhu L\u00fc","raw_affiliation_strings":["School of Automation Science and Electrical Engineering, Beihang University, Beijing, China","Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-0275-8387","affiliations":[{"raw_affiliation_string":"School of Automation Science and Electrical Engineering, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]},{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":8.072,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.97346865,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"20","issue":null,"first_page":"10511","last_page":"10524"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9839000105857849,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9839000105857849,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9819999933242798,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9682000279426575,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8371999859809875},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.7215999960899353},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6097000241279602},{"id":"https://openalex.org/keywords/nash-equilibrium","display_name":"Nash equilibrium","score":0.5878999829292297},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.507099986076355},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4650999903678894},{"id":"https://openalex.org/keywords/game-theory","display_name":"Game theory","score":0.439300000667572},{"id":"https://openalex.org/keywords/security-controls","display_name":"Security controls","score":0.39660000801086426},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.3901999890804291}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8371999859809875},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8147000074386597},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.7215999960899353},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6097000241279602},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6004999876022339},{"id":"https://openalex.org/C46814582","wikidata":"https://www.wikidata.org/wiki/Q23389","display_name":"Nash equilibrium","level":2,"score":0.5878999829292297},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.507099986076355},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4650999903678894},{"id":"https://openalex.org/C177142836","wikidata":"https://www.wikidata.org/wiki/Q44455","display_name":"Game theory","level":2,"score":0.439300000667572},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.39660000801086426},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3901999890804291},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.3693000078201294},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.3400999903678894},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.3334999978542328},{"id":"https://openalex.org/C82753439","wikidata":"https://www.wikidata.org/wiki/Q1419090","display_name":"Industrial production","level":2,"score":0.3303999900817871},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.32820001244544983},{"id":"https://openalex.org/C2778348673","wikidata":"https://www.wikidata.org/wiki/Q739302","display_name":"Production (economics)","level":2,"score":0.32409998774528503},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.31949999928474426},{"id":"https://openalex.org/C73795354","wikidata":"https://www.wikidata.org/wiki/Q287618","display_name":"Sequential game","level":3,"score":0.3158000111579895},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.31279999017715454},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.30079999566078186},{"id":"https://openalex.org/C6177178","wikidata":"https://www.wikidata.org/wiki/Q10998070","display_name":"Discounting","level":2,"score":0.2946999967098236},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.288100004196167},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.28290000557899475},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.26510000228881836},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2572000026702881},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.25270000100135803}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3616599","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3616599","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2564763498","display_name":null,"funder_award_id":"T2322023","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W1617459194","https://openalex.org/W2330650066","https://openalex.org/W2460941602","https://openalex.org/W2527760048","https://openalex.org/W2884165914","https://openalex.org/W2886018600","https://openalex.org/W2888563510","https://openalex.org/W2931139464","https://openalex.org/W2937494057","https://openalex.org/W2945624265","https://openalex.org/W2990623250","https://openalex.org/W3035286387","https://openalex.org/W3045866986","https://openalex.org/W3108669277","https://openalex.org/W3128288172","https://openalex.org/W3137920819","https://openalex.org/W3160032723","https://openalex.org/W3173190309","https://openalex.org/W3175694419","https://openalex.org/W3184099553","https://openalex.org/W3198931490","https://openalex.org/W3203827585","https://openalex.org/W3211156805","https://openalex.org/W4205739822","https://openalex.org/W4220955296","https://openalex.org/W4226407107","https://openalex.org/W4283018452","https://openalex.org/W4307399145","https://openalex.org/W4312449532","https://openalex.org/W4312905669","https://openalex.org/W4377000443","https://openalex.org/W4378800456","https://openalex.org/W4384835155","https://openalex.org/W4389474195","https://openalex.org/W4391250959","https://openalex.org/W4395069647","https://openalex.org/W4396982237","https://openalex.org/W4399393121","https://openalex.org/W4411870475"],"related_works":[],"abstract_inverted_index":{"As":[0,28],"industrial":[1,43,85,148],"control":[2,26,86,149],"systems":[3],"become":[4],"increasingly":[5],"interconnected":[6],"with":[7,89,116],"information":[8],"networks,":[9],"attackers":[10],"could":[11,169],"exploit":[12,21],"vulnerabilities":[13],"across":[14],"different":[15],"system":[16,150],"layers":[17],"to":[18,23,36,57,79,131,153,181,197],"create":[19],"complex":[20],"chains":[22],"compromise":[24],"field":[25],"elements.":[27],"such,":[29],"security":[30,40,72,140],"decision-making":[31],"is":[32,99,114,129,151],"of":[33,41,52,61,95,119,136,157],"essential":[34],"importance":[35],"maintain":[37],"the":[38,50,59,81,93,111,117,133,137,155,158,165,172,176],"operational":[39],"critical":[42],"infrastructures.":[44],"In":[45,179],"this":[46,66],"paper,":[47],"we":[48,68,102],"consider":[49,103],"problem":[51],"designing":[53],"cost-effective":[54],"defense":[55,177,204],"strategies":[56],"minimize":[58],"risk":[60],"successful":[62],"attack":[63,77,173,200],"paths.":[64],"To":[65],"end,":[67],"propose":[69],"a":[70,97,104,122,146,191],"non-Markovian":[71,139,188],"game":[73],"framework":[74,196],"on":[75,145],"labeled":[76],"graphs":[78],"simulate":[80],"attack-defense":[82],"process":[83],"in":[84],"systems.":[87],"Compared":[88],"existing":[90],"methods,":[91],"where":[92,110],"cost":[94,113,168],"exploiting":[96],"vulnerability":[98],"considered":[100],"constant,":[101],"more":[105,192],"dynamic":[106],"and":[107,174,194,202],"realistic":[108,193],"case":[109,143],"exploitation":[112,167],"discounted":[115],"number":[118],"exploitations.":[120],"Moreover,":[121],"state-decomposition":[123],"based":[124],"multi-agent":[125],"reinforcement":[126],"learning":[127],"algorithm":[128],"developed":[130],"obtain":[132],"Nash":[134],"equilibrium":[135],"proposed":[138,159],"game.":[141],"A":[142],"study":[144],"simulated":[147],"presented":[152],"illustrate":[154],"feasibility":[156],"approach.":[160],"The":[161],"results":[162],"demonstrate":[163],"that":[164],"discounting":[166],"greatly":[170],"alter":[171],"subsequently":[175],"strategies.":[178],"comparison":[180],"traditional":[182],"static":[183],"intrusion":[184],"response":[185],"approaches,":[186],"our":[187],"approach":[189],"offers":[190],"adaptive":[195],"anticipate":[198],"evolving":[199],"paths":[201],"allocate":[203],"resources.":[205]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}