{"id":"https://openalex.org/W7138995607","doi":"https://doi.org/10.1109/tifs.2026.3675443","title":"Mitigating Insider-Facilitated Advanced Persistent Threat: A Three-Player Differential Game Approach","display_name":"Mitigating Insider-Facilitated Advanced Persistent Threat: A Three-Player Differential Game Approach","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7138995607","doi":"https://doi.org/10.1109/tifs.2026.3675443"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2026.3675443","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3675443","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Yang Qin","orcid":"https://orcid.org/0009-0006-5184-5849"},"institutions":[{"id":"https://openalex.org/I158842170","display_name":"Chongqing University","ror":"https://ror.org/023rhb549","country_code":"CN","type":"education","lineage":["https://openalex.org/I158842170"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Qin","raw_affiliation_strings":["School of Big Data and Software Engineering, Chongqing University, Chongqing, China"],"raw_orcid":"https://orcid.org/0009-0006-5184-5849","affiliations":[{"raw_affiliation_string":"School of Big Data and Software Engineering, Chongqing University, Chongqing, China","institution_ids":["https://openalex.org/I158842170"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012015574","display_name":"Lu\u2010Xing Yang","orcid":"https://orcid.org/0000-0002-9229-5787"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Lu-Xing Yang","raw_affiliation_strings":["Deakin Cyber Research and Innovation Center, School of Information Technology, Deakin University, Melbourne, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0002-9229-5787","affiliations":[{"raw_affiliation_string":"Deakin Cyber Research and Innovation Center, School of Information Technology, Deakin University, Melbourne, VIC, Australia","institution_ids":["https://openalex.org/I149704539"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xiaofan Yang","orcid":"https://orcid.org/0000-0002-3273-1233"},"institutions":[{"id":"https://openalex.org/I158842170","display_name":"Chongqing University","ror":"https://ror.org/023rhb549","country_code":"CN","type":"education","lineage":["https://openalex.org/I158842170"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaofan Yang","raw_affiliation_strings":["School of Big Data and Software Engineering, Chongqing University, Chongqing, China"],"raw_orcid":"https://orcid.org/0000-0002-3273-1233","affiliations":[{"raw_affiliation_string":"School of Big Data and Software Engineering, Chongqing University, Chongqing, China","institution_ids":["https://openalex.org/I158842170"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130011651","display_name":"Gang Li","orcid":null},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Gang Li","raw_affiliation_strings":["Deakin Cyber Research and Innovation Center, School of Information Technology, Deakin University, Melbourne, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0003-1583-641X","affiliations":[{"raw_affiliation_string":"Deakin Cyber Research and Innovation Center, School of Information Technology, Deakin University, Melbourne, VIC, Australia","institution_ids":["https://openalex.org/I149704539"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077501988","display_name":"Robin Doss","orcid":"https://orcid.org/0000-0001-6143-6850"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Robin Doss","raw_affiliation_strings":["Deakin Cyber Research and Innovation Center, School of Information Technology, Deakin University, Melbourne, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6143-6850","affiliations":[{"raw_affiliation_string":"Deakin Cyber Research and Innovation Center, School of Information Technology, Deakin University, Melbourne, VIC, Australia","institution_ids":["https://openalex.org/I149704539"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.33754432,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":null,"first_page":"3153","last_page":"3168"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5906999707221985,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5906999707221985,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11807","display_name":"Infrastructure Resilience and Vulnerability Analysis","score":0.11949999630451202,"subfield":{"id":"https://openalex.org/subfields/2205","display_name":"Civil and Structural Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.05550000071525574,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/stochastic-game","display_name":"Stochastic game","score":0.6547999978065491},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6527000069618225},{"id":"https://openalex.org/keywords/differential-game","display_name":"Differential game","score":0.6524999737739563},{"id":"https://openalex.org/keywords/game-theory","display_name":"Game theory","score":0.5619999766349792},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5511999726295471},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.5485000014305115},{"id":"https://openalex.org/keywords/differential-privacy","display_name":"Differential privacy","score":0.5347999930381775},{"id":"https://openalex.org/keywords/bridge","display_name":"Bridge (graph theory)","score":0.5338000059127808},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.5315999984741211},{"id":"https://openalex.org/keywords/compromise","display_name":"Compromise","score":0.5074999928474426}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7893000245094299},{"id":"https://openalex.org/C22171661","wikidata":"https://www.wikidata.org/wiki/Q1074380","display_name":"Stochastic game","level":2,"score":0.6547999978065491},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6527000069618225},{"id":"https://openalex.org/C2779006483","wikidata":"https://www.wikidata.org/wiki/Q1973196","display_name":"Differential game","level":2,"score":0.6524999737739563},{"id":"https://openalex.org/C177142836","wikidata":"https://www.wikidata.org/wiki/Q44455","display_name":"Game theory","level":2,"score":0.5619999766349792},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5511999726295471},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.5485000014305115},{"id":"https://openalex.org/C23130292","wikidata":"https://www.wikidata.org/wiki/Q5275358","display_name":"Differential privacy","level":2,"score":0.5347999930381775},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.5338000059127808},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5315999984741211},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.5074999928474426},{"id":"https://openalex.org/C93226319","wikidata":"https://www.wikidata.org/wiki/Q193137","display_name":"Differential (mechanical device)","level":2,"score":0.492000013589859},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4794999957084656},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.4553999900817871},{"id":"https://openalex.org/C73795354","wikidata":"https://www.wikidata.org/wiki/Q287618","display_name":"Sequential game","level":3,"score":0.44449999928474426},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.4180000126361847},{"id":"https://openalex.org/C148220186","wikidata":"https://www.wikidata.org/wiki/Q7111912","display_name":"Outcome (game theory)","level":2,"score":0.38659998774528503},{"id":"https://openalex.org/C167573328","wikidata":"https://www.wikidata.org/wiki/Q7439054","display_name":"Screening game","level":4,"score":0.35530000925064087},{"id":"https://openalex.org/C202556891","wikidata":"https://www.wikidata.org/wiki/Q1584646","display_name":"Repeated game","level":3,"score":0.3508000075817108},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.3384999930858612},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33219999074935913},{"id":"https://openalex.org/C151201525","wikidata":"https://www.wikidata.org/wiki/Q177239","display_name":"Limit (mathematics)","level":2,"score":0.32330000400543213},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.314300000667572},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.30410000681877136},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C13662910","wikidata":"https://www.wikidata.org/wiki/Q193139","display_name":"Trajectory","level":2,"score":0.2736000120639801},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2678999900817871},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2624000012874603},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.2612999975681305},{"id":"https://openalex.org/C32407928","wikidata":"https://www.wikidata.org/wiki/Q2733833","display_name":"Best response","level":3,"score":0.25600001215934753},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.2547999918460846},{"id":"https://openalex.org/C200594392","wikidata":"https://www.wikidata.org/wiki/Q812529","display_name":"Bayesian game","level":4,"score":0.2515999972820282},{"id":"https://openalex.org/C112758219","wikidata":"https://www.wikidata.org/wiki/Q16038819","display_name":"Duration (music)","level":2,"score":0.25099998712539673}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2026.3675443","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3675443","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.47389090061187744,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":50,"referenced_works":["https://openalex.org/W156783801","https://openalex.org/W1533945010","https://openalex.org/W1646742026","https://openalex.org/W1985984683","https://openalex.org/W1994736698","https://openalex.org/W2015787697","https://openalex.org/W2039427951","https://openalex.org/W2056075452","https://openalex.org/W2063917507","https://openalex.org/W2209091760","https://openalex.org/W2582259743","https://openalex.org/W2903765663","https://openalex.org/W2908954810","https://openalex.org/W2920929998","https://openalex.org/W2946917174","https://openalex.org/W2962817891","https://openalex.org/W3005127313","https://openalex.org/W3092155847","https://openalex.org/W3107652070","https://openalex.org/W3115990450","https://openalex.org/W3122620151","https://openalex.org/W3128070938","https://openalex.org/W3135578542","https://openalex.org/W3137920819","https://openalex.org/W3137950818","https://openalex.org/W3166875891","https://openalex.org/W3203127690","https://openalex.org/W3215769872","https://openalex.org/W4206342677","https://openalex.org/W4224315774","https://openalex.org/W4255086963","https://openalex.org/W4288083473","https://openalex.org/W4327860547","https://openalex.org/W4375787811","https://openalex.org/W4380032285","https://openalex.org/W4385819961","https://openalex.org/W4387092840","https://openalex.org/W4389885612","https://openalex.org/W4390871511","https://openalex.org/W4391944659","https://openalex.org/W4393034384","https://openalex.org/W4396574997","https://openalex.org/W4396667789","https://openalex.org/W4400698115","https://openalex.org/W4402661169","https://openalex.org/W4403277046","https://openalex.org/W4404095140","https://openalex.org/W4405907177","https://openalex.org/W4407110755","https://openalex.org/W4407468113"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threat":[2],"(APT)":[3],"presents":[4],"a":[5,32,37,57,139,163,171,226],"significant":[6],"challenge":[7,15],"to":[8,180,229],"the":[9,29,65,70,74,77,81,87,91,116,120,124,127,132,147,175,190,196,199,204,212,221],"cybersecurity":[10],"of":[11,28,44,60,83,90,119,123,131,150,189,198,206,215,223],"contemporary":[12],"organizations.":[13],"This":[14],"is":[16,157],"further":[17],"exacerbated":[18],"when":[19],"APT":[20,55,78],"actors":[21],"collaborate":[22],"with":[23],"malicious":[24],"insiders.":[25],"The":[26,153,167],"involvement":[27],"insider":[30],"transforms":[31],"bilateral":[33],"adversarial":[34],"scenario":[35],"into":[36],"triadic":[38],"strategic":[39,67],"interaction,":[40],"introducing":[41],"additional":[42],"layers":[43],"complexity":[45],"in":[46,99,174,220],"modeling":[47],"and":[48,76,159,193],"defense":[49,52,201],"planning.":[50],"Effective":[51],"against":[53,231],"insider-facilitated":[54,232],"necessitates":[56],"comprehensive":[58],"treatment":[59],"two":[61],"critical":[62],"aspects:":[63],"(i)":[64],"dynamic":[66,121,148],"interactions":[68,85,149],"among":[69],"three":[71],"players\u2014the":[72],"defender,":[73],"insider,":[75],"actor\u2014and":[79],"(ii)":[80],"impact":[82],"these":[84],"on":[86,126],"evolving":[88],"state":[89,111,130],"intranet.":[92,133],"However,":[93],"both":[94],"dimensions":[95],"are":[96],"insufficiently":[97],"addressed":[98],"existing":[100],"research.":[101],"To":[102,203],"bridge":[103],"this":[104,209],"gap,":[105],"we":[106,137,185],"first":[107,213],"develop":[108],"an":[109],"expected":[110,128,177],"evolution":[112],"model":[113,143],"that":[114,144],"captures":[115],"real-time":[117],"influence":[118],"strategies":[122],"players":[125],"compromise":[129],"Building":[134],"upon":[135],"this,":[136],"formulate":[138],"three-player":[140,216],"differential":[141,217],"game":[142,218],"explicitly":[145],"incorporates":[146],"all":[151],"participants.":[152],"associated":[154],"optimality":[155],"system":[156],"derived":[158],"numerically":[160],"solved":[161],"using":[162],"proposed":[164,168,191],"iterative":[165],"algorithm.":[166],"algorithm":[169],"achieves":[170],"27.5%":[172],"improvement":[173],"organization\u2019s":[176],"payoff":[178],"compared":[179],"baseline":[181],"permissible":[182],"strategies.":[183],"Subsequently,":[184],"analyze":[186],"key":[187],"properties":[188],"framework":[192],"empirically":[194],"evaluate":[195],"cost-effectiveness":[197],"resulting":[200],"strategy.":[202],"best":[205],"our":[207],"knowledge,":[208],"work":[210],"represents":[211],"application":[214],"theory":[219],"domain":[222],"cybersecurity,":[224],"offering":[225],"novel":[227],"approach":[228],"defending":[230],"APT.":[233]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2026-03-20T00:00:00"}