{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,27]],"date-time":"2026-03-27T02:50:54Z","timestamp":1774579854530,"version":"3.50.1"},"reference-count":57,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2020,8,15]],"date-time":"2020-08-15T00:00:00Z","timestamp":1597449600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["71571186"],"award-info":[{"award-number":["71571186"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Stealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Light-weight countermeasures, on the other hand, can help retard the spread of stealth malwares, but the ensuing side effects might violate the primary safety requirement of CPS. Hence, defenders need to find a balance between the gain and loss of deploying light-weight countermeasures, which normally is a challenging task. To address this challenge, we model the persistent anti-malware process as a shortest-path tree interdiction (SPTI) Stackelberg game with both static version (SSPTI) and multi-stage dynamic version (DSPTI), and safety requirements of CPS are introduced as constraints in the defender\u2019s decision model. The attacker aims to stealthily penetrate the CPS at the lowest cost (e.g., time, effort) by selecting optimal network links to spread, while the defender aims to retard the malware epidemic as much as possible. Both games are modeled as bi-level integer programs and proved to be NP-hard. We then develop a Benders decomposition algorithm to achieve the Stackelberg equilibrium of SSPTI, and design a Model Predictive Control strategy to solve DSPTI approximately by sequentially solving an 1+\u03b4 approximation of SSPTI. Extensive experiments have been conducted by comparing proposed algorithms and strategies with existing ones on both static and dynamic performance metrics. The evaluation results demonstrate the efficiency of proposed algorithms and strategies on both simulated and real-case-based CPS networks. Furthermore, the proposed dynamic defense framework shows its advantage of achieving a balance between fail-secure ability and fail-safe ability while retarding the stealth malware propagation in CPS.<\/jats:p>","DOI":"10.3390\/e22080894","type":"journal-article","created":{"date-parts":[[2020,8,17]],"date-time":"2020-08-17T04:35:51Z","timestamp":1597638951000},"page":"894","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework"],"prefix":"10.3390","volume":"22","author":[{"given":"Kaiming","family":"Xiao","sequence":"first","affiliation":[{"name":"Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cheng","family":"Zhu","sequence":"additional","affiliation":[{"name":"Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Junjie","family":"Xie","sequence":"additional","affiliation":[{"name":"Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7328-0275","authenticated-orcid":false,"given":"Yun","family":"Zhou","sequence":"additional","affiliation":[{"name":"Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xianqiang","family":"Zhu","sequence":"additional","affiliation":[{"name":"Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Weiming","family":"Zhang","sequence":"additional","affiliation":[{"name":"Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2020,8,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Xiao, K., Zhu, C., Xie, J., Zhou, Y., Zhu, X., and Zhang, W. (2018, January 15\u201319). Dynamic Defense Strategy against Stealth Malware Propagation in Cyber-Physical Systems. Proceedings of the IEEE INFOCOM, Honolulu, HI, USA.","DOI":"10.1109\/INFOCOM.2018.8485952"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"40","DOI":"10.1038\/nphys2180","article-title":"Networks formed from interdependent networks","volume":"8","author":"Gao","year":"2012","journal-title":"Nat. Phys."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1025","DOI":"10.1038\/nature08932","article-title":"Catastrophic cascade of failures in interdependent networks","volume":"464","author":"Buldyrev","year":"2010","journal-title":"Nature"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1007\/s11768-016-5123-9","article-title":"A survey on the security of cyber-physical systems","volume":"14","author":"Wu","year":"2016","journal-title":"Control Theory Technol."},{"key":"ref_5","first-page":"1","article-title":"A comprehensive study on apt attacks and countermeasures for future networks and communications: Challenges and solutions","volume":"75","author":"Singh","year":"2016","journal-title":"J. Supercomput."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Chen, P., Desmet, L., and Huygens, C. (2014). A study on advanced persistent threats. IFIP International Conference on Communications and Multimedia Security, Springer.","DOI":"10.1007\/978-3-662-44885-4_5"},{"key":"ref_7","first-page":"857","article-title":"The Reality and Response of Cyber Threats to Critical Infrastructure: A Case Study of the Cyber-terror Attack on the Korea Hydro & Nuclear Power Co., Ltd","volume":"10","author":"Lee","year":"2016","journal-title":"KSII Trans. Internet Inf. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Karnouskos, S. (2011). Stuxnet worm impact on industrial cyber-physical system security. IECON 2011\u201437th Annual Conference on IEEE Industrial Electronics Society, IEEE.","DOI":"10.1109\/IECON.2011.6120048"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"971","DOI":"10.3390\/fi4040971","article-title":"The cousins of stuxnet: Duqu, flame, and gauss","volume":"4","author":"Felegyhazi","year":"2012","journal-title":"Fut. Internet"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Hu, P., Li, H., Fu, H., Cansever, D., and Mohapatra, P. (May, January 26). Dynamic defense strategy against advanced persistent threat with insiders. Proceedings of the 2015 IEEE Conference on Computer Communications (INFOCOM), Hong Kong, China.","DOI":"10.1109\/INFOCOM.2015.7218444"},{"key":"ref_11","unstructured":"Ryan, J. (2014). Leading Issues in Information Warfare Research, Academic Conferences Limited."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1145","DOI":"10.1109\/COMST.2016.2636078","article-title":"A survey of stealth malware attacks, mitigation measures, and steps toward autonomous open world solutions","volume":"19","author":"Rudd","year":"2017","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Li, M., Huang, W., Wang, Y., Fan, W., and Li, J. (2016, January 26\u201329). The study of apt attack stage model. Proceedings of the 2016 IEEE\/ACIS 15th International Conference on Computer and Information Science (ICIS), Okayama, Japan.","DOI":"10.1109\/ICIS.2016.7550947"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"1708","DOI":"10.1109\/TPDS.2012.62","article-title":"Optimal allocation of interconnecting links in cyber-physical systems: Interdependence, cascading failures, and robustness","volume":"Volume 23","author":"Li","year":"2012","journal-title":"IEEE Transactions on Parallel and Distributed Systems"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1109\/TNET.2004.842221","article-title":"Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles","volume":"13","author":"Yau","year":"2005","journal-title":"IEEE\/ACM Trans. Netw. TON"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1007\/s10586-009-0116-9","article-title":"Cooperative detection and protection against network attacks using decentralized information sharing","volume":"13","author":"Zhang","year":"2010","journal-title":"Clust. Comput."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Sabaliauskaite, G., and Mathur, A.P. (2015). Aligning Cyber-Physical System Safety and Security, Springer.","DOI":"10.1007\/978-3-319-12544-2_4"},{"key":"ref_18","unstructured":"Chun, B.N., Lee, J., and Weatherspoon, H. (2003). Netbait: A Distributed Worm Detection Service, Intel Corporation. Intel Research Berkeley Technical Report IRB-TR-03."},{"key":"ref_19","unstructured":"Yegneswaran, V., Barford, P., and Jha, S. (2020, July 28). Global Intrusion Detection in the DOMINO Overlay System. Available online: https:\/\/minds.wisconsin.edu\/handle\/1793\/60340."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1016\/j.ijcip.2015.02.002","article-title":"A survey of cyber security management in industrial control systems","volume":"9","author":"Knowles","year":"2015","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"255","DOI":"10.3233\/ICA-160518","article-title":"A method for malware propagation in industrial critical infrastructures","volume":"23","author":"Encinas","year":"2016","journal-title":"Integr. Comput.-Aided Eng."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Zeng, C., Ren, B., Liu, H., and Chen, J. (2019). Applying the bayesian stackelberg active deception game for securing infrastructure networks. Entropy, 21.","DOI":"10.3390\/e21090909"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1109\/TNET.2014.2364034","article-title":"Optimal patching in clustered malware epidemics","volume":"24","author":"Eshghi","year":"2016","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"271","DOI":"10.1109\/TNSE.2016.2600029","article-title":"Suppressing epidemics in networks using priority planning","volume":"3","author":"Scaman","year":"2016","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"525","DOI":"10.1016\/j.conengprac.2008.10.007","article-title":"Optimal and robust epidemic response for multiple networks","volume":"17","author":"Bloem","year":"2009","journal-title":"Control Eng. Pract."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Par\u00e9, P.E., Beck, C.L., and Nedi\u0107, A. (2015, January 15\u201318). Stability analysis and control of virus spread over time-varying networks. Proceedings of the 2015 54th IEEE Conference on Decision and Control (CDC), Osaka, Japan.","DOI":"10.1109\/CDC.2015.7402769"},{"key":"ref_27","first-page":"834","article-title":"A light-weight countermeasure to forwarding misbehavior in wireless sensor networks: Design, analysis, and evaluation","volume":"17","author":"Pu","year":"2016","journal-title":"IEEE Syst. J."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"487","DOI":"10.1109\/TNSM.2017.2701549","article-title":"Slicots: An sdn-based lightweight countermeasure for tcp syn flooding attacks","volume":"14","author":"Mohammadi","year":"2017","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Shang, G., Zhe, P., Bin, X., Aiqun, H., and Kui, R. (2017, January 1\u20134). FloodDefender: Protecting data and control plane resources under sdn-aimed dos attacks. Proceedings of the 2017 IEEE Conference on Computer Communications (INFOCOM), Atlanta, GA, USA.","DOI":"10.1109\/INFOCOM.2017.8057009"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1080\/07408170500488956","article-title":"Models for nuclear smuggling interdiction","volume":"39","author":"Morton","year":"2007","journal-title":"IIE Trans."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"527","DOI":"10.1017\/S0003055407070244","article-title":"Defending against terrorist attacks with limited resources","volume":"101","author":"Powell","year":"2007","journal-title":"Am. Pol. Sci. Rev."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"835","DOI":"10.1111\/itor.12669","article-title":"The r-interdiction selective multi-depot vehicle routing problem","volume":"27","author":"Sadati","year":"2020","journal-title":"Int. Trans. Oper. Res."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1002\/net.20458","article-title":"Deception Tactics for Network Interdiction: A Multiobjective Approach","volume":"60","author":"Department","year":"2012","journal-title":"Networks"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"116","DOI":"10.1007\/BF01584329","article-title":"Maximizing the minimum source-sink path subject to a budget constraint","volume":"13","author":"Fulkerson","year":"1977","journal-title":"Math. Prog."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"97","DOI":"10.1002\/net.10039","article-title":"Shortest-path network interdiction","volume":"40","author":"Israeli","year":"2002","journal-title":"Networks"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1002\/net.20236","article-title":"Shortest path network interdiction with asymmetric information","volume":"52","author":"Bayrak","year":"2008","journal-title":"Networks"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"154","DOI":"10.1016\/j.ress.2018.04.011","article-title":"A bi-objective formulation for robust defense strategies in multi-commodity networks","volume":"176","author":"McCarter","year":"2018","journal-title":"Reliab. Eng. Syst. Saf."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"72","DOI":"10.1287\/opre.2018.1773","article-title":"Sequential interdiction with incomplete information and learning","volume":"67","author":"Borrero","year":"2019","journal-title":"Oper. Res."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Xu, K., Xiao, K., Yin, Q., Zha, Y., and Zhu, C. (2017, January 19\u201325). Bridging the gap between observation and decision-making: Goal recognition and flexible resource allocation in dynamic network interdiction. Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence (IJCAI-17), Melbourne, Australia.","DOI":"10.24963\/ijcai.2017\/625"},{"key":"ref_40","unstructured":"Zhu, M., and Martinez, S. (July, January 29). Stackelberg-game analysis of correlated attacks in cyber-physical systems. Proceedings of the 2011 American Control Conference, San Francisco, CA, USA."},{"key":"ref_41","first-page":"266","article-title":"Cybersecurity Games and Investments: A Decision Support Approach","volume":"8840","author":"Panaousis","year":"2014","journal-title":"Decis. Game Theory Secur."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"118","DOI":"10.1016\/j.cor.2016.05.005","article-title":"Interdicting attack graphs to protect organizations from cyber attacks: A bi-level defender\u2013attacker model","volume":"75","author":"Nandi","year":"2016","journal-title":"Comput. Oper. Res."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1109\/MIS.2016.74","article-title":"Case studies of network defense with attack graph games","volume":"31","author":"Durkota","year":"2016","journal-title":"IEEE Intell. Syst."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"126","DOI":"10.1007\/978-3-642-28537-0_13","article-title":"Difficulties in modeling SCADA traffic: A comparative analysis","volume":"Volume 7192","author":"Barbosa","year":"2012","journal-title":"International Conference on Passive and Active Network Measurement"},{"key":"ref_45","unstructured":"Barbosa, R.R.R. (2014). Anomaly Detection in Scada Systems: A Network Based Approach, University of Twente."},{"key":"ref_46","first-page":"340","article-title":"Computers and intractability: A guide to the theory of np-completeness","volume":"44","author":"Garey","year":"1979","journal-title":"Revista Da Escola De Enfermagem Da USP"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"797","DOI":"10.1016\/j.ejor.2019.06.024","article-title":"A survey of network interdiction models and algorithms","volume":"283","author":"Smith","year":"2020","journal-title":"Eur. J. Oper. Res."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"734","DOI":"10.1109\/90.893870","article-title":"New dynamic algorithms for shortest path tree computation","volume":"8","author":"Siu","year":"2000","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"315","DOI":"10.1002\/net.21712","article-title":"Dynamic shortest-path interdiction","volume":"68","author":"Sefair","year":"2016","journal-title":"Networks"},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"415","DOI":"10.1007\/s12555-011-0300-6","article-title":"Model predictive control: Review of the three decades of development","volume":"9","author":"Lee","year":"2011","journal-title":"Int. J. Control Autom. Syst."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"167","DOI":"10.1137\/S003614450342480","article-title":"The structure and function of complex networks","volume":"45","author":"Newman","year":"2003","journal-title":"SIAM Rev."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"509","DOI":"10.1126\/science.286.5439.509","article-title":"Emergence of scaling in random networks","volume":"286","author":"Albert","year":"1999","journal-title":"Science"},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"251","DOI":"10.1145\/316194.316229","article-title":"On power-law relationships of the internet topology","volume":"29","author":"Faloutsos","year":"1999","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"7332","DOI":"10.1073\/pnas.0610245104","article-title":"Structure and tie strengths in mobile communication networks","volume":"104","author":"Onnela","year":"2007","journal-title":"Proc. Natl. Acad. Sci. USA"},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"2015","DOI":"10.1073\/pnas.0510525103","article-title":"Prediction and predictability of global epidemics: The role of the airline transportation network","volume":"103","author":"Colizza","year":"2005","journal-title":"Proc. Natl. Acad. Sci. USA"},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Parandehgheibi, M., and Modiano, E. (2013). Robustness of interdependent networks: The case of communication networks and the power grid. 2013 IEEE Global Communications Conference (GLOBECOM), IEEE.","DOI":"10.1109\/GLOCOM.2013.6831395"},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Lofberg, J. (2004). Yalmip: A toolbox for modeling and optimization in matlab. 2004 IEEE International Conference on Robotics and Automation (IEEE Cat. No.04CH37508), IEEE.","DOI":"10.1109\/CACSD.2004.1393890"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/22\/8\/894\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:01:18Z","timestamp":1760176878000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/22\/8\/894"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,8,15]]},"references-count":57,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2020,8]]}},"alternative-id":["e22080894"],"URL":"https:\/\/doi.org\/10.3390\/e22080894","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,15]]}}}