{"id":"https://openalex.org/W7128822016","doi":"https://doi.org/10.1109/tifs.2026.3664334","title":"Learning Sequential Deception Defense Strategy Against APT Using Stackelberg Markov Game","display_name":"Learning Sequential Deception Defense Strategy Against APT Using Stackelberg Markov Game","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7128822016","doi":"https://doi.org/10.1109/tifs.2026.3664334"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2026.3664334","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3664334","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125914513","display_name":"Xin Deng","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Deng","raw_affiliation_strings":["School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0001-4594-9469","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063743533","display_name":"Pengdeng Li","orcid":"https://orcid.org/0000-0002-5549-3864"},"institutions":[{"id":"https://openalex.org/I4210106808","display_name":"Guangzhou Institute of Advanced Technology","ror":"https://ror.org/01vcw4681","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210106808"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengdeng Li","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-5549-3864","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I4210106808"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125903103","display_name":"Rui Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210106808","display_name":"Guangzhou Institute of Advanced Technology","ror":"https://ror.org/01vcw4681","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210106808"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Wang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0007-4784-8905","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I4210106808"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070070741","display_name":"Jinglei Tan","orcid":null},"institutions":[{"id":"https://openalex.org/I4210106808","display_name":"Guangzhou Institute of Advanced Technology","ror":"https://ror.org/01vcw4681","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210106808"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinglei Tan","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-3231-6793","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I4210106808"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125927415","display_name":"Yuan Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210106808","display_name":"Guangzhou Institute of Advanced Technology","ror":"https://ror.org/01vcw4681","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210106808"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Liu","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-0246-0778","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I4210106808"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125924453","display_name":"Weihong Han","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weihong Han","raw_affiliation_strings":["Department of New Networks, Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0001-9997-1509","affiliations":[{"raw_affiliation_string":"Department of New Networks, Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077138872","display_name":"Z. F. Tian","orcid":"https://orcid.org/0000-0002-9409-5359"},"institutions":[{"id":"https://openalex.org/I4210106808","display_name":"Guangzhou Institute of Advanced Technology","ror":"https://ror.org/01vcw4681","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210106808"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhihong Tian","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-9409-5359","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security, and the Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I4210106808"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":12.9935,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.97963561,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"21","issue":null,"first_page":"2492","last_page":"2504"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3799000084400177,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3799000084400177,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.3301999866962433,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.07519999891519547,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/deception","display_name":"Deception","score":0.8999000191688538},{"id":"https://openalex.org/keywords/stackelberg-competition","display_name":"Stackelberg competition","score":0.8016999959945679},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6381999850273132},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5109000205993652},{"id":"https://openalex.org/keywords/game-theory","display_name":"Game theory","score":0.453900009393692},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.435699999332428},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.41100001335144043},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.3986000120639801}],"concepts":[{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.8999000191688538},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8503000140190125},{"id":"https://openalex.org/C199510392","wikidata":"https://www.wikidata.org/wiki/Q1184602","display_name":"Stackelberg competition","level":2,"score":0.8016999959945679},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6381999850273132},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5608999729156494},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5109000205993652},{"id":"https://openalex.org/C177142836","wikidata":"https://www.wikidata.org/wiki/Q44455","display_name":"Game theory","level":2,"score":0.453900009393692},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.435699999332428},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4226999878883362},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.41100001335144043},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.3986000120639801},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.3231000006198883},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.3158999979496002},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.3068999946117401},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2985999882221222},{"id":"https://openalex.org/C22171661","wikidata":"https://www.wikidata.org/wiki/Q1074380","display_name":"Stochastic game","level":2,"score":0.29159998893737793},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2890999913215637},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.27709999680519104},{"id":"https://openalex.org/C72434380","wikidata":"https://www.wikidata.org/wiki/Q230930","display_name":"State space","level":2,"score":0.2721000015735626},{"id":"https://openalex.org/C137836250","wikidata":"https://www.wikidata.org/wiki/Q984063","display_name":"Optimization problem","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C46814582","wikidata":"https://www.wikidata.org/wiki/Q23389","display_name":"Nash equilibrium","level":2,"score":0.2709999978542328},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C155930848","wikidata":"https://www.wikidata.org/wiki/Q1069099","display_name":"Normal-form game","level":4,"score":0.2630000114440918},{"id":"https://openalex.org/C163836022","wikidata":"https://www.wikidata.org/wiki/Q6771326","display_name":"Markov model","level":3,"score":0.2572000026702881}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2026.3664334","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3664334","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2311382213","display_name":null,"funder_award_id":"2025M771548","funder_id":"https://openalex.org/F4320321543","funder_display_name":"China Postdoctoral Science Foundation"},{"id":"https://openalex.org/G4048030252","display_name":null,"funder_award_id":"62502104","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6064493666","display_name":null,"funder_award_id":"U2436208","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8812891240","display_name":null,"funder_award_id":"62372129","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321543","display_name":"China Postdoctoral Science Foundation","ror":"https://ror.org/0426zh255"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W2404532944","https://openalex.org/W2902572901","https://openalex.org/W2965836847","https://openalex.org/W3013160592","https://openalex.org/W3135451057","https://openalex.org/W3153692137","https://openalex.org/W3163598082","https://openalex.org/W3163676048","https://openalex.org/W3186172578","https://openalex.org/W3191758786","https://openalex.org/W3203693215","https://openalex.org/W3207121925","https://openalex.org/W4210247502","https://openalex.org/W4211053892","https://openalex.org/W4283765695","https://openalex.org/W4285270847","https://openalex.org/W4286375281","https://openalex.org/W4313174306","https://openalex.org/W4386506420","https://openalex.org/W4390356040","https://openalex.org/W4390881876","https://openalex.org/W4393156444","https://openalex.org/W4396566883","https://openalex.org/W4400529966","https://openalex.org/W4401508381","https://openalex.org/W4401979983","https://openalex.org/W4402401682","https://openalex.org/W4403123573","https://openalex.org/W4409248225","https://openalex.org/W4409250936","https://openalex.org/W4409659448","https://openalex.org/W4414165892","https://openalex.org/W4415047702","https://openalex.org/W7101440898"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"have":[4,86],"become":[5],"one":[6],"of":[7,90,149,187,192,196,203],"the":[8,34,40,88,91,99,128,138,142,153,158,163,168,176,185,188,204,220],"most":[9,68],"prominent":[10],"cybersecurity":[11],"risks":[12],"globally.":[13],"The":[14],"external":[15],"network-facing":[16],"(ENF)":[17],"services":[18,150,214],"(e.g.,":[19],"e-commerce":[20],"platforms)":[21],"within":[22],"a":[23,109,147,171,194,200],"system":[24,65,92,160],"are":[25,30],"particularly":[26],"vulnerable,":[27],"as":[28,39,141,167],"they":[29],"directly":[31],"exposed":[32],"to":[33,49,151,211],"Internet":[35],"and":[36,62,81,125,133,248],"often":[37],"serve":[38],"primary":[41],"targets":[42],"for":[43,116],"attackers.":[44,135],"By":[45],"deploying":[46],"deception":[47,73,154],"resources":[48,155],"protect":[50],"these":[51,104],"ENF":[52,100,118],"services,":[53,119,197],"defenders":[54,132],"can":[55],"detect":[56],"threats":[57],"early,":[58],"block":[59],"potential":[60],"attacks,":[61],"enhance":[63],"overall":[64],"resilience.":[66],"However,":[67],"existing":[69],"studies":[70],"on":[71,98,157],"cyber":[72],"strategies":[74],"assume":[75],"simultaneous":[76],"moves":[77],"by":[78,207],"both":[79],"attacker":[80,165],"defender.":[82],"Furthermore,":[83],"few":[84],"works":[85],"considered":[87],"evolution":[89],"state":[93,123],"resulting":[94],"from":[95],"APT":[96,134,164,234],"attacks":[97],"services.":[101],"To":[102,183],"address":[103],"limitations,":[105],"this":[106],"paper":[107],"proposes":[108],"Cyber":[110],"Deception":[111],"Stackelberg":[112],"Markov":[113],"Game":[114],"(CDSMG)":[115],"protecting":[117],"which":[120,174],"dynamically":[121],"captures":[122],"transitions":[124],"accurately":[126],"characterizes":[127],"strategic":[129],"interactions":[130],"between":[131],"In":[136],"CDSMG,":[137],"defender":[139],"acts":[140],"leader,":[143],"who":[144],"proactively":[145],"selects":[146],"subset":[148,195],"deploy":[152],"based":[156],"current":[159],"state,":[161],"while":[162],"plays":[166],"follower,":[169],"making":[170],"best":[172],"response":[173],"incorporates":[175],"defender\u2019s":[177],"policy":[178],"into":[179],"its":[180],"own":[181],"strategy.":[182],"overcome":[184],"challenge":[186],"combinatorial":[189],"optimization":[190],"problem":[191],"selecting":[193],"we":[198],"propose":[199],"revised":[201],"version":[202],"PPO":[205],"algorithm":[206],"using":[208],"no-replacement":[209],"sampling":[210],"select":[212],"multiple":[213],"at":[215],"once,":[216],"thereby":[217],"significantly":[218],"reducing":[219],"action":[221],"space":[222],"size.":[223],"Finally,":[224],"experimental":[225],"results":[226],"demonstrate":[227],"that":[228],"our":[229],"approach":[230],"effectively":[231],"defends":[232],"against":[233],"attacks.":[235],"It":[236],"not":[237],"only":[238],"outperforms":[239],"several":[240],"baseline":[241],"methods":[242],"but":[243],"also":[244],"exhibits":[245],"better":[246],"scalability":[247],"robustness":[249],"under":[250],"varied":[251],"model":[252],"parameter":[253],"settings.":[254]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-08-28T12:50:07.497085","created_date":"2026-02-14T00:00:00"}