发表机构
DSO National Laboratories（DSO国家实验室）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究针对串并联攻击图的安全博弈，提出自适应攻击者的最优索引策略，开发高效算法计算攻击者效用与防御者次梯度，所得方法扩展性优于朴素显式状态方法，可生成有效防御分配。
AI 中文摘要
我们研究攻击图上的安全博弈，其中自适应攻击者试图通过沿当前攻击前沿依次尝试随机控制来达到目标，而防御者则在各控制间分配有限资源以延缓入侵。攻击者可在指数级多的攻击路径中选择，并在观察到成功或失败时自由在路径间切换，形成指数级大的或有攻击策略空间。对于任意固定的防御者资源分配，我们证明双终端串并联攻击图上的最优攻击者策略为索引策略：每一步攻击者选择具有经典吉丁斯（Gittins）指数扩展值最大的可用控制。该指数及攻击者最优响应可在多项式时间内计算，无需显式枚举攻击路径或或有策略。据我们所知，这是首次对一般串并联攻击图安全博弈中的自适应攻击者给出最优索引刻画。我们进一步开发高效算法以计算攻击者的精确效用和防御者的精确次梯度，支持对防御性资源分配进行无攻击轨迹采样的确定性一阶优化。我们的框架严格推广了先前仅适用于并行链和出树的方法，同时利用串并联图的组合结构，支持可解释的攻击者策略及跨独立子图的并行计算。实验表明，所提方法的扩展性远优于朴素显式状态方法，且能生成有效的防御资源分配。
英文摘要
We study security games on attack graphs, where an adaptive attacker seeks to reach a target by sequentially attempting stochastic controls along the current attack frontier, while a defender allocates limited resources across controls to delay compromise. The attacker may choose among exponentially many attack routes and freely pivot between them as successes and failures are observed, yielding an exponentially large space of contingent attack policies. For any fixed defender allocation, we show that an optimal attacker policy on a two-terminal series-parallel attack graph is an index policy: at each step, the attacker selects an available control with the largest value of an extension of the classical Gittins index. The indices and the resulting attacker best response can be computed in polynomial time, without explicitly enumerating attack paths or contingent policies. To the best of our knowledge, this is the first optimal index characterization for adaptive attackers in security games on general series-parallel attack graphs. We further develop efficient algorithms for computing the attacker's exact utility and an exact defender subgradient, enabling deterministic first-order optimization of defensive resource allocations without sampling attack trajectories. Our framework strictly generalizes prior approaches restricted to parallel chains and out-trees, while exploiting the compositional structure of series-parallel graphs to support interpretable attacker policies and parallel computation across independent subgraphs. Experiments demonstrate that the resulting methods scale substantially better than naive explicit-state approaches while producing effective defensive allocations.
Comments68 pages, 10 figures. Added examples and updated acknowledgements
