{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T16:46:12Z","timestamp":1791996372834,"version":"4.4.0"},"reference-count":108,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Project Agency (DARPA) through the CASTLE Program","doi-asserted-by":"publisher","award":["W912CG23C0029"],"award-info":[{"award-number":["W912CG23C0029"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Wallenberg Artificial Intelligence (AI), Autonomous Systems and Software Program"},{"DOI":"10.13039\/501100004063","name":"Knut och Alice Wallenbergs Stiftelse","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004063","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3558600","type":"journal-article","created":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T17:18:56Z","timestamp":1744132736000},"page":"4055-4070","source":"Crossref","is-referenced-by-count":18,"title":["Adaptive Security Response Strategies Through Conjectural Online Learning"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1773-8354","authenticated-orcid":false,"given":"Kim","family":"Hammar","sequence":"first","affiliation":[{"name":"Division of Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8966-7239","authenticated-orcid":false,"given":"Tao","family":"Li","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, New York University, New York, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6039-8493","authenticated-orcid":false,"given":"Rolf","family":"Stadler","sequence":"additional","affiliation":[{"name":"Division of Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0008-2953","authenticated-orcid":false,"given":"Quanyan","family":"Zhu","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, New York University, New York, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2480741.2480742"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-012-9134-5"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101660"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.arcontrol.2022.03.003"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1002\/9781119723950"},{"key":"ref6","first-page":"526","article-title":"Optimal network security hardening using attack graph games","volume-title":"Proc. 24th Int. Conf. Artif. Intell.","author":"Durkota"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101579"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2023.3293413"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-50670-3_9"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2020.106878"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2911112"},{"key":"ref12","volume-title":"Six Russian Gru Officers Charged in Connection With Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace, U. D. Justice","year":"2020"},{"key":"ref13","volume-title":"Notpetya","author":"Corporation","year":"2024"},{"key":"ref14","volume-title":"Rollout, Policy Iteration, and Distributed Reinforcement Learning","author":"Bertsekas","year":"2021"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.3982\/ECTA12609"},{"issue":"5","key":"ref16","first-page":"894","article-title":"The winner\u2019s curse and public information in common value auctions","volume":"76","author":"Kagel","year":"1986","journal-title":"The Amer. Econ. Rev."},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1162\/003355302760193896"},{"key":"ref18","first-page":"161","article-title":"Theories of bounded rationality","author":"Simon","year":"1972","journal-title":"Decision and Organization"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/S1062-9769(96)90006-X"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/BF01254292"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TCOMM.2020.3010289"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-26369-9_2"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CISS.2018.8362263"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/775"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3117698"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/LCSYS.2019.2925681"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TCNS.2020.2988007"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.ifacol.2023.10.851"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-64793-3_17"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.23919\/CNSM50824.2020.9269092"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2021.3052090"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511760778"},{"key":"ref33","volume-title":"The Theory of Learning in Games","author":"Fudenberg","year":"1998"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1093\/acprof:oso\/9780199269181.001.0001"},{"key":"ref35","first-page":"1039","article-title":"Nash q-learning for general-sum stochastic games","volume":"4","author":"Hu","year":"2003","journal-title":"J. Mach. Learn. Res."},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-55860-335-6.50027-1"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOMWKSHPS57453.2023.10225816"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2022.3176781"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2021.3067896"},{"key":"ref40","first-page":"229","article-title":"Snort-lightweight intrusion detection for networks","volume-title":"Proc. 13th USENIX Conf. Syst. Admin.","author":"Roesch"},{"key":"ref41","volume-title":"Cyber Security Learning Environment","author":"Hammar","year":"2023"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2007.25"},{"key":"ref43","volume-title":"Cybersecurity Incident & Vulnerability Response Playbooks","year":"2021"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3605066"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.artint.2022.103838"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1515\/9781400881970-012"},{"key":"ref47","volume-title":"Stochastic Systems: Estimation, Identification and Adaptive Control","author":"Kumar","year":"1986"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.2307\/1969529"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/BF01448847"},{"key":"ref50","article-title":"Scalable algorithms for solving stochastic games with limited partial observability","author":"Hor\u00e1k","year":"2019"},{"key":"ref51","volume-title":"Game Theory","author":"Fudenberg","year":"1991"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.2307\/1885060"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9781316471104"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.4064\/fm-3-1-133-181"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CDC.2001.980562"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.10597"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1002\/SERIES1345"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2020.2978451"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177729694"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177699597"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.3982\/TE3843"},{"key":"ref62","volume-title":"CVE Database","author":"Corporation","year":"2022"},{"key":"ref63","volume-title":"CWE List","author":"Corporation","year":"2023"},{"issue":"239","key":"ref64","first-page":"2","article-title":"Docker: Lightweight Linux containers for consistent development and deployment","volume":"2014","author":"Merkel","year":"2014","journal-title":"Linux J."},{"key":"ref65","first-page":"1","article-title":"Network emulation with netem","volume-title":"Proc. Linux Conf","author":"Hemminger"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCSW.2002.1030775"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/90.779192"},{"key":"ref68","article-title":"Mitre att&ck: Design and philosophy","author":"Strom","year":"2018"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/NCS.2018.00007"},{"key":"ref70","volume-title":"Companies Using Snort","year":"2025"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/WSC.1995.478761"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2705629"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3675741.3675748"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1609\/icaps.v31i1.16006"},{"key":"ref75","first-page":"61","article-title":"Availability in globally distributed storage systems","volume-title":"Proc. 9th USENIX Symp. Operating Syst. Design Implement.","author":"Ford"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010091220143"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511800481"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CIG.2019.8848006"},{"issue":"1","key":"ref79","first-page":"374","article-title":"Iterative solution of games by fictitious play","volume":"13","author":"Brown","year":"1951","journal-title":"Act. Anal. Prod. Allocation"},{"key":"ref80","article-title":"Proximal policy optimization algorithms","author":"Schulman","year":"2017","journal-title":"arXiv:1707.06347"},{"key":"ref81","article-title":"Reinforcement learning from self-play in imperfect-information games","author":"Heinrich","year":"2017"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511973031"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2023.100544"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3121870"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2020.2976040"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2885251"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3284564"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2022.3211866"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-72709-5_1"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2020.3046688"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3232537"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/GAMENETS.2009.5137463"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/CDC.2009.5399894"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.2995713"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2009.5270307"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1155\/2019\/3038586"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109635"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1155\/2019\/1362964"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/2764468.2764478"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v30i1.10051"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.14.3.159"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.2307\/1884852"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2885530"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ojcoms.2025.3552277"},{"key":"ref105","first-page":"1705","article-title":"Enabling refinable cross-host attack investigation with efficient data flow tagging and tracking","volume-title":"Proc. USENIX Conf. Secur. Symp. (SEC)","author":"Ji"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i6.16678"},{"key":"ref107","volume-title":"Reinforcement Learning and Optimal Control","author":"Bertsekas","year":"2019"},{"key":"ref108","article-title":"Automated security response through online learning with adaptive conjectures","author":"Hammar","year":"2024","journal-title":"arXiv:2402.12499"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/10955193.pdf?arnumber=10955193","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,24]],"date-time":"2025-04-24T17:04:28Z","timestamp":1745514268000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10955193\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":108,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3558600","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}