Simulation-Informed Bayesian Stackelberg Defense for Multi-Stage Cyber Attacks
Year: 2026
Type: article
Abstract: Proactive cyber defense requires defenders to anticipate attacker behavior and respond before breaches occur. However, existing game-theoretic models rarely integrate attack behavior simulation with temporal-aware payoff structures. This paper proposes a Stackelberg game framework for proactive cyber defense that combines Monte Carlo-based attack behavior simulation with a multi-stage, time-discounted payoff function. The defender, modeled as the Stackelberg leader, commits to an optimal mixed strategy by leveraging simulation-derived attack path predictions across five Cyber Kill Chain (CKC) stages over a 5-action defense space (|A_D| = 5) against five attacker actions (|A_A| = 5). A simulation confidence factor S quantifies prediction accuracy and is embedded directly into the defender payoff function, creating incentive-compatible alignment between simulation quality and strategic gain. Bayesian belief updates—augmented with simulation evidence—enable real-time attacker type inference under incomplete information. A fictitious play algorithm with provable convergence computes the Strong Stackelberg Equilibrium (SSE). Experimental results on a 10-node network demonstrate that the proposed framework reduces response latency by 22.9% and achieves a 4.9% payoff gain compared to Bayesian Nash Equilibrium (BNE) baselines, with convergence at 199 iterations versus 354 for BNE—a 43.8% reduction.
Source: Computers
Authors: Zhao Shen, Rulong He, Xiao Zhang
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,172
OpenAlex ID: W7203840314