{"id":"https://openalex.org/W3099080616","doi":"https://doi.org/10.1145/3418897","title":"Adaptive Cyber Defense Against Multi-Stage Attacks Using Learning-Based POMDP","display_name":"Adaptive Cyber Defense Against Multi-Stage Attacks Using Learning-Based POMDP","publication_year":2020,"publication_date":"2020-11-08","ids":{"openalex":"https://openalex.org/W3099080616","doi":"https://doi.org/10.1145/3418897","mag":"3099080616"},"language":"en","primary_location":{"id":"doi:10.1145/3418897","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3418897","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3418897","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3418897","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5021769053","display_name":"Zhisheng Hu","orcid":"https://orcid.org/0000-0003-1940-9829"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhisheng Hu","raw_affiliation_strings":["Baidu Security, Sunnyvale, CA"],"raw_orcid":"https://orcid.org/0000-0003-1940-9829","affiliations":[{"raw_affiliation_string":"Baidu Security, Sunnyvale, CA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101766328","display_name":"Minghui Zhu","orcid":"https://orcid.org/0000-0003-3879-7820"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Minghui Zhu","raw_affiliation_strings":["Pennsylvania State University, PA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, PA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100346828","display_name":"Peng Liu","orcid":"https://orcid.org/0000-0002-5091-8464"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peng Liu","raw_affiliation_strings":["Pennsylvania State University, PA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, PA","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.3418,"has_fulltext":true,"cited_by_count":31,"citation_normalized_percentile":{"value":0.93730969,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"24","issue":"1","first_page":"1","last_page":"25"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.8133115768432617},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7649689316749573},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.7601804733276367},{"id":"https://openalex.org/keywords/partially-observable-markov-decision-process","display_name":"Partially observable Markov decision process","score":0.738839864730835},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.738691508769989},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.606538712978363},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5107226371765137},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4668954610824585},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4620785713195801},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.41898080706596375},{"id":"https://openalex.org/keywords/bayesian-probability","display_name":"Bayesian probability","score":0.41066741943359375},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3947005271911621},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.3880718946456909},{"id":"https://openalex.org/keywords/markov-chain","display_name":"Markov chain","score":0.3140776753425598},{"id":"https://openalex.org/keywords/markov-model","display_name":"Markov model","score":0.12494507431983948},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.07734787464141846}],"concepts":[{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.8133115768432617},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7649689316749573},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.7601804733276367},{"id":"https://openalex.org/C17098449","wikidata":"https://www.wikidata.org/wiki/Q176814","display_name":"Partially observable Markov decision process","level":4,"score":0.738839864730835},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.738691508769989},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.606538712978363},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5107226371765137},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4668954610824585},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4620785713195801},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.41898080706596375},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.41066741943359375},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3947005271911621},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.3880718946456909},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.3140776753425598},{"id":"https://openalex.org/C163836022","wikidata":"https://www.wikidata.org/wiki/Q6771326","display_name":"Markov model","level":3,"score":0.12494507431983948},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.07734787464141846},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3418897","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3418897","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3418897","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3418897","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3418897","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3418897","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.7699999809265137,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G195271523","display_name":null,"funder_award_id":"1422594","funder_id":"https://openalex.org/F4320337388","funder_display_name":"Division of Computer and Network Systems"},{"id":"https://openalex.org/G2955067590","display_name":null,"funder_award_id":"1710859","funder_id":"https://openalex.org/F4320337392","funder_display_name":"Division of Electrical, Communications and Cyber Systems"},{"id":"https://openalex.org/G4670790475","display_name":null,"funder_award_id":"H98230-15-1-0289","funder_id":"https://openalex.org/F4320311089","funder_display_name":"National Security Agency"},{"id":"https://openalex.org/G6471190695","display_name":null,"funder_award_id":"W911NF-13-1-0421","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"}],"funders":[{"id":"https://openalex.org/F4320311089","display_name":"National Security Agency","ror":"https://ror.org/0047bvr32"},{"id":"https://openalex.org/F4320337388","display_name":"Division of Computer and Network Systems","ror":"https://ror.org/02rdzmk74"},{"id":"https://openalex.org/F4320337392","display_name":"Division of Electrical, Communications and Cyber Systems","ror":"https://ror.org/01krpsy48"},{"id":"https://openalex.org/F4320338281","display_name":"Army Research Office","ror":"https://ror.org/05epdh915"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3099080616.pdf","grobid_xml":"https://content.openalex.org/works/W3099080616.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W7318248","https://openalex.org/W32403112","https://openalex.org/W151026171","https://openalex.org/W1496575973","https://openalex.org/W1964911284","https://openalex.org/W1980065740","https://openalex.org/W1995716850","https://openalex.org/W2011418219","https://openalex.org/W2030014066","https://openalex.org/W2035991175","https://openalex.org/W2039522160","https://openalex.org/W2044375425","https://openalex.org/W2046259462","https://openalex.org/W2048287263","https://openalex.org/W2053944475","https://openalex.org/W2055921164","https://openalex.org/W2067601737","https://openalex.org/W2081105932","https://openalex.org/W2131875370","https://openalex.org/W2138089556","https://openalex.org/W2163468230","https://openalex.org/W2226329006","https://openalex.org/W2241431175","https://openalex.org/W2241862190","https://openalex.org/W2294009246","https://openalex.org/W2560674852","https://openalex.org/W2561675875","https://openalex.org/W2608239929","https://openalex.org/W2745868649","https://openalex.org/W2765449849","https://openalex.org/W2765659133","https://openalex.org/W2792721951","https://openalex.org/W2804073276","https://openalex.org/W2805486427","https://openalex.org/W2963020939","https://openalex.org/W2964000194","https://openalex.org/W3100789280","https://openalex.org/W3143304050","https://openalex.org/W4206109607","https://openalex.org/W6751899208"],"related_works":["https://openalex.org/W3123911006","https://openalex.org/W4400868993","https://openalex.org/W2096013579","https://openalex.org/W52153049","https://openalex.org/W1760611253","https://openalex.org/W1515117609","https://openalex.org/W3096874164","https://openalex.org/W1589140671","https://openalex.org/W2768698792","https://openalex.org/W1985560493"],"abstract_inverted_index":{"Growing":[0],"multi-stage":[1],"attacks":[2],"in":[3],"computer":[4],"networks":[5],"impose":[6],"significant":[7],"security":[8],"risks":[9],"and":[10,39,82,117],"necessitate":[11],"the":[12,30,61,65,77,80,87,101],"development":[13],"of":[14,42,90],"effective":[15],"defense":[16,58,88,124],"schemes":[17],"that":[18],"are":[19],"able":[20],"to":[21,24,52,59,64,75,106,113,121],"autonomously":[22],"respond":[23],"intrusions":[25],"during":[26],"vulnerability":[27],"windows.":[28],"However,":[29],"defender":[31,102],"faces":[32],"several":[33],"real-world":[34,140],"challenges,":[35],"e.g.,":[36],"unknown":[37,40],"likelihoods":[38],"impacts":[41],"successful":[43],"exploits.":[44],"In":[45,68],"this":[46],"article,":[47],"we":[48,70,85],"leverage":[49],"reinforcement":[50,119],"learning":[51,120],"develop":[53],"an":[54],"innovative":[55],"adaptive":[56],"cyber":[57],"maximize":[60],"cost-effectiveness":[62],"subject":[63],"aforementioned":[66],"challenges.":[67],"particular,":[69],"use":[71],"Bayesian":[72],"attack":[73],"graphs":[74],"model":[76],"interactions":[78],"between":[79],"attacker":[81],"networks.":[83],"Then":[84],"formulate":[86],"problem":[89,99],"interest":[91],"as":[92],"a":[93],"partially":[94],"observable":[95],"Markov":[96],"decision":[97],"process":[98],"where":[100],"maintains":[103],"belief":[104],"states":[105],"estimate":[107,114],"system":[108],"states,":[109],"leverages":[110],"Thompson":[111],"sampling":[112],"transition":[115],"probabilities,":[116],"utilizes":[118],"choose":[122],"optimal":[123],"actions":[125],"using":[126],"measured":[127],"utility":[128],"values.":[129],"The":[130],"algorithm":[131],"performance":[132],"is":[133],"verified":[134],"via":[135],"numerical":[136],"simulations":[137],"based":[138],"on":[139],"attacks.":[141]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}