AI 中文总结
本文提出量化斯塔克尔伯格均衡（QSE）作为防御者模型误设的保险，在网络安全案例研究中，其防御者效用较斯塔克尔伯格解提升46%-175%，展现出显著优势。
AI 中文摘要
斯塔克尔伯格安全博弈（Stackelberg Security Games, SSG）假设攻击者能完美观测防御者策略并选择最大化自身期望效用的目标，但在多数现实场景中这并不合理；而网络欺骗（如使用诱饵）的博弈目的正是诱导攻击者产生不确定性与决策失误。量化响应是表征决策中噪声与失误的常用方式，本文用其替代完美最优响应，引入带理性参数λ的logit选择，得到广义量化斯塔克尔伯格均衡（Quantal Stackelberg Equilibrium, QSE）；当λ趋近于无穷大时，QSE可完全退化为经典解。本文深入分析QSE如何作为广义保险，应对各类模型误设/不确定性；分析表明，QSE能从理论与实践角度，有效解决SSG中平局决胜规则与模型不确定性的重要作用。本文开展网络安全案例研究的实证评估，使用两个网络、源自通用漏洞披露（Common Vulnerabilities and Exposures, CVE）的真实漏洞，并采用通用漏洞评分系统（Common Vulnerability Scoring System, CVSS）评分；在含模型误设的144种场景与25种参数配置下，QSE的防御者实际效用优于斯塔克尔伯格解，增益达46%至175%，在各类现实场景中展现出显著优势。
英文摘要
Stackelberg Security Games (SSG) assume that an attacker observes the defender's strategy and chooses the target that maximizes their expected utility perfectly. In most realistic applications this is not plausible, and in the case of cyber deception (e.g., using decoys) the purpose of the game is to induce uncertainty and mistakes. Quantal response is a common way to represent noise and mistakes in decision-making; here it replaces perfect best-response with a logit choice with rationality parameter $λ$ and results in a generalized Quantal Stackelberg Equilibrium (QSE), which recovers the classical solution exactly as $λ\rightarrow \infty$. We conduct a deeper analysis of how QSE can function as a generalized form of insurance against a variety of forms of model specification error/uncertainty; our analysis shows that QSE provides a practical way to address the important role of tie-breaking rules and model uncertainty in SSG from both a theoretical and practical perspective. We conduct an empirical evaluation in a cybersecurity case study with two networks and real vulnerabilities drawn from CVE and scored using the Common Vulnerability Scoring System (CVSS). QSE beats Stackelberg in realized defender utility spanning 144 scenarios with specification errors and 25 parameter configurations, with gains of 46\% to 175\% showing a substantial advantage in a wide variety of realistic cases.
CommentsAccepted at Gamesec 2026
