{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T22:13:33Z","timestamp":1792793613735,"version":"4.5.0"},"reference-count":101,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Swedish armed forces and was conducted at KTH Center for Cyber Defense and Information Security"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Serv. Manage."],"published-print":{"date-parts":[[2022,9]]},"DOI":"10.1109\/tnsm.2022.3176781","type":"journal-article","created":{"date-parts":[[2022,5,20]],"date-time":"2022-05-20T15:32:33Z","timestamp":1653060753000},"page":"2333-2348","source":"Crossref","is-referenced-by-count":30,"title":["Intrusion Prevention Through Optimal Stopping"],"prefix":"10.1109","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1773-8354","authenticated-orcid":false,"given":"Kim","family":"Hammar","sequence":"first","affiliation":[{"name":"Division of Network and Systems Engineering and the KTH Center for Cyber Defense and Information Security, KTH Royal Institute of Technology, Stockholm, Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6039-8493","authenticated-orcid":false,"given":"Rolf","family":"Stadler","sequence":"additional","affiliation":[{"name":"Division of Network and Systems Engineering and the KTH Center for Cyber Defense and Information Security, KTH Royal Institute of Technology, Stockholm, Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1287\/moor.12.3.441"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2018.2878570"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.automatica.2018.06.013"},{"key":"ref32","first-page":"630","article-title":"A multiple-choice secretary algorithm with applications to online auctions","author":"kleinberg","year":"2005","journal-title":"Proc 16th Annu ACM-SIAM Symp Discr Algorithms"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-9965.2007.00331.x"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1239\/jap\/1152413734"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.stamet.2005.05.003"},{"key":"ref36","article-title":"Online reinforcement learning of optimal threshold policies for Markov decision processes","author":"roy","year":"2019","journal-title":"arxiv 1912 10325"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1214\/08-AAP566"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/BF00938445"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CAMAD.2018.8514971"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS47738.2020.9110426"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2022.3158468"},{"key":"ref20","article-title":"Modeling penetration testing with reinforcement learning using capture-the-flag challenges and tabular Q-learning","author":"zennaro","year":"2020","journal-title":"arXiv 2005 12632"},{"key":"ref22","first-page":"1","article-title":"Machine learning for autonomous cyber defense","volume":"22","author":"ridley","year":"2018","journal-title":"The Next Wave"},{"key":"ref21","author":"blum","year":"2021","journal-title":"Gamifying machine learning for stronger security and AI models"},{"key":"ref24","article-title":"Deep hierarchical reinforcement agents for automated penetration testing","author":"tran","year":"2021","journal-title":"arXiv 2109 06449"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3100706"},{"key":"ref101","article-title":"Network environment design for autonomous cyberdefense","author":"molina-markham","year":"2021","journal-title":"arxiv 2103 07583"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3418897"},{"key":"ref100","article-title":"CybORG: A gym for the development of autonomous cyber agents","author":"standen","year":"2021","journal-title":"arXiv 2108 09118"},{"key":"ref25","article-title":"Using cyber terrain in reinforcement learning for penetration testing","author":"gangupantulu","year":"2021","journal-title":"arxiv 2108 07124"},{"key":"ref50","article-title":"Learning from delayed rewards","author":"watkins","year":"1989"},{"key":"ref51","article-title":"Proximal policy optimization algorithms","author":"schulman","year":"2017","journal-title":"arXiv 1707 06347"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511754678"},{"key":"ref58","author":"bather","year":"2000","journal-title":"Decision Theory An Introduction to Dynamic Programming and Sequential Decisions"},{"key":"ref57","author":"ross","year":"1983","journal-title":"Introduction to Stochastic Dynamic Programming Probability and Mathematical"},{"key":"ref56","author":"chow","year":"1971","journal-title":"Great Expectations The Theory of Optimal Stopping"},{"key":"ref55","author":"peskir","year":"2006","journal-title":"Optimal stopping and free-boundary problems"},{"key":"ref54","author":"shirayev","year":"2007","journal-title":"Optimal Stopping Rules"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177729586"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1994.6.6.1185"},{"key":"ref40","author":"hammar","year":"2022","journal-title":"A Software Framework for Building Self-Learning Security Systems"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3232799"},{"key":"ref3","article-title":"Artificially intelligent cyberattacks","author":"zouave","year":"2020"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30719-6_2"},{"key":"ref5","first-page":"99","article-title":"A supervisory control approach to dynamic cyber-security","author":"rasouli","year":"2014","journal-title":"Decision and Game Theory for Security"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI.2016.7849908"},{"key":"ref49","volume":"1","author":"bertsekas","year":"2005","journal-title":"Dynamic Programming and Optimal Control"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.23919\/TMA.2018.8506545"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/2994539.2994542"},{"key":"ref46","author":"sutton","year":"1998","journal-title":"Introduction to Reinforcement Learning"},{"key":"ref45","author":"bertsekas","year":"1996","journal-title":"Neuro-Dynamic Programming"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1287\/opre.26.2.282"},{"key":"ref47","author":"bellman","year":"1957","journal-title":"Dynamic Programming"},{"key":"ref42","author":"howard","year":"1960","journal-title":"Dynamic Programming and Markov Processes"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/2663474.2663481"},{"key":"ref44","doi-asserted-by":"crossref","first-page":"174","DOI":"10.1016\/0022-247X(65)90154-X","article-title":"Optimal control of Markov processes with incomplete state information","volume":"10","author":"\u00e5str\u00f6m","year":"1965","journal-title":"J Math Anal Appl"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/S0004-3702(98)00023-X"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2016.2627340"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0038-7"},{"key":"ref71","first-page":"229","article-title":"Snort—Lightweight intrusion detection for networks","author":"roesch","year":"1999","journal-title":"Proc 13th USENIX Conf Syst Admin"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1137\/1108002"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.3034647"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511973031"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2012.051712.110124"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2011.050311.100028"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1201\/b16048"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511815102"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.4108\/ICST.WICON2008.4996"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9947-1964-0168010-2"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9947-1952-0050209-9"},{"key":"ref63","article-title":"Policy gradient methods for reinforcement learning with function approximation","author":"sutton","year":"1999","journal-title":"Advances in neural information processing systems"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/9.119632"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/7.705889"},{"key":"ref66","author":"hammar","year":"2021","journal-title":"gym-optimal-intrusion-response"},{"key":"ref67","first-page":"2","article-title":"Docker: lightweight linux containers for consistent development and deployment","volume":"2014","author":"merkel","year":"2014","journal-title":"Linux J"},{"key":"ref68","first-page":"1","article-title":"Network emulation with NetEm","author":"hemminger","year":"2005","journal-title":"Proc Linux Conf"},{"key":"ref69","first-page":"520","article-title":"Heuristic search value iteration for POMDPs","author":"smith","year":"2004","journal-title":"Proc 20th Conf Uncertainty Artif Intell"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.08.004"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.istr.2005.08.001"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3120804"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/CDC42340.2020.9303818"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.3031843"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.102479"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-32430-8_13"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.23919\/CCC52363.2021.9549271"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1093\/biomet\/41.1-2.100"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/1868447.1868466"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24486"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2607701"},{"key":"ref10","author":"alpcan","year":"2010","journal-title":"Network Security A Decision and Game-Theoretic Approach"},{"key":"ref11","first-page":"439","article-title":"Adversarial attacks on continuous authentication security: A dynamic game approach","author":"sar?ta?","year":"2019","journal-title":"Decision and Game Theory for Security"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.23919\/CNSM50824.2020.9269092"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.23919\/CNSM52442.2021.9615542"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1512\/iumj.1957.6.56038"},{"key":"ref15","author":"wald","year":"1947","journal-title":"Sequential Analysis"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.arcontrol.2022.01.001"},{"key":"ref16","doi-asserted-by":"crossref","DOI":"10.1002\/9780470316887","author":"puterman","year":"1994","journal-title":"Markov Decision Processes Discrete Stochastic Dynamic Programming"},{"key":"ref81","article-title":"Deep reinforcement learning for cyber security","author":"nguyen","year":"2019","journal-title":"arXiv 1906 05799"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9781316471104"},{"key":"ref84","first-page":"1","article-title":"Next generation intrusion detection: Autonomous reinforcement learning of network attacks","author":"georgia","year":"2000","journal-title":"Proc 23rd Nat Inf Syst Secuity Conf"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.5220\/0006197105590566"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2819967"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1609\/icaps.v30i1.6666"},{"key":"ref80","article-title":"Prospective artificial intelligence approaches for active cyber defence","author":"dhir","year":"2021","journal-title":"arxiv 2104 09981"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2019.2960202"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/11538059_103"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-77949-0_15"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/JCN.2020.000015"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v27i2.19000"}],"container-title":["IEEE Transactions on Network and Service Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4275028\/9917435\/09779345.pdf?arnumber=9779345","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,10,14]],"date-time":"2022-10-14T13:41:06Z","timestamp":1665754866000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9779345\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9]]},"references-count":101,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tnsm.2022.3176781","relation":{},"ISSN":["1932-4537","2373-7379"],"issn-type":[{"value":"1932-4537","type":"electronic"},{"value":"2373-7379","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,9]]}}}