{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,6]],"date-time":"2024-07-06T06:09:38Z","timestamp":1720246178959},"reference-count":43,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2024,10,30]],"date-time":"2024-10-30T00:00:00Z","timestamp":1730246400000},"content-version":"am","delay-in-days":303,"URL":"http:\/\/www.elsevier.com\/open-access\/userlicense\/1.0\/"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100000180","name":"U.S. Department of Homeland Security","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000180","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["2229876","FA8650-15-C-7556"],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100004316","name":"International Business Machines Corporation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100004316","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["N00014-16-1-2710 P00002"],"id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Automatica"],"published-print":{"date-parts":[[2024,1]]},"DOI":"10.1016\/j.automatica.2023.111353","type":"journal-article","created":{"date-parts":[[2023,10,30]],"date-time":"2023-10-30T11:01:37Z","timestamp":1698663697000},"page":"111353","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Stochastic Dynamic Information Flow Tracking game using supervised learning for detecting advanced persistent threats"],"prefix":"10.1016","volume":"159","author":[{"given":"Shana","family":"Moothedath","sequence":"first","affiliation":[]},{"given":"Dinuka","family":"Sahabandu","sequence":"additional","affiliation":[]},{"given":"Joey","family":"Allen","sequence":"additional","affiliation":[]},{"given":"Linda","family":"Bushnell","sequence":"additional","affiliation":[]},{"given":"Wenke","family":"Lee","sequence":"additional","affiliation":[]},{"given":"Radha","family":"Poovendran","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.automatica.2023.111353_b1","series-title":"The partially observable games we play for cyber deception","author":"Ahmadi","year":"2018"},{"key":"10.1016\/j.automatica.2023.111353_b2","doi-asserted-by":"crossref","unstructured":"Ahmadi,\u00a0M., Viswanathan,\u00a0A. A., Ingham,\u00a0M. D., Tan,\u00a0K., & Ames,\u00a0A. D. (2020). Partially Observable Games for Secure Autonomy. In 2020 IEEE security and privacy workshops (SPW) (pp. 185\u2013188).","DOI":"10.1109\/SPW50608.2020.00046"},{"key":"10.1016\/j.automatica.2023.111353_b3","doi-asserted-by":"crossref","first-page":"455","DOI":"10.1007\/978-94-010-0189-2_30","article-title":"Stochastic games in economics and related fields: An overview","author":"Amir","year":"2003","journal-title":"Stochastic Games and Applications"},{"issue":"4","key":"10.1016\/j.automatica.2023.111353_b4","doi-asserted-by":"crossref","first-page":"971","DOI":"10.3390\/fi4040971","article-title":"The cousins of stuxnet: Duqu, flame, and Gauss","volume":"4","author":"Bencs\u00e1th","year":"2012","journal-title":"Future Internet"},{"key":"10.1016\/j.automatica.2023.111353_b5","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1613\/jair.575","article-title":"Decision-theoretic planning: Structural assumptions and computational leverage","volume":"11","author":"Boutilier","year":"1999","journal-title":"Journal of Artificial Intelligence Research"},{"key":"10.1016\/j.automatica.2023.111353_b6","series-title":"Cyberthreats: the emerging fault lines of the nation state","author":"Brenner","year":"2009"},{"key":"10.1016\/j.automatica.2023.111353_b7","doi-asserted-by":"crossref","unstructured":"Clause,\u00a0J., Li,\u00a0W., & Orso,\u00a0A. (2007). Dytan: a generic dynamic taint analysis framework. In International symposium on software testing and analysis (pp. 196\u2013206).","DOI":"10.1145\/1273463.1273490"},{"issue":"48","key":"10.1016\/j.automatica.2023.111353_b8","first-page":"7","article-title":"Approximation with artificial neural networks","volume":"24","author":"Cs\u00e1ji","year":"2001","journal-title":"Faculty of Sciences, Etvs Lornd University, Hungary"},{"issue":"2","key":"10.1016\/j.automatica.2023.111353_b9","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1145\/2619091","article-title":"TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones","volume":"32","author":"Enck","year":"2014","journal-title":"ACM Transactions on Computer Systems"},{"key":"10.1016\/j.automatica.2023.111353_b10","unstructured":"Hossain,\u00a0M. N., Wang,\u00a0J., Sekar,\u00a0R., & Stoller,\u00a0S. D. (2018). Dependence-preserving data compaction for scalable forensic analysis. In USENIX security symposium (pp. 1723\u20131740)."},{"key":"10.1016\/j.automatica.2023.111353_b11","first-page":"242","article-title":"Multiagent reinforcement learning: Theoretical framework and an algorithm.","volume":"98","author":"Hu","year":"1998","journal-title":"International Conference on Machine Learning"},{"key":"10.1016\/j.automatica.2023.111353_b12","first-page":"1039","article-title":"Nash Q-learning for general-sum stochastic games","volume":"4","author":"Hu","year":"2003","journal-title":"Journal of Machine Learning Research"},{"issue":"2","key":"10.1016\/j.automatica.2023.111353_b13","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1145\/3305218.3305239","article-title":"Adaptive strategic cyber defense for advanced persistent threats in critical infrastructure networks","volume":"46","author":"Huang","year":"2019","journal-title":"ACM SIGMETRICS Performance Evaluation Review"},{"key":"10.1016\/j.automatica.2023.111353_b14","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2019.101660","article-title":"A dynamic games approach to proactive defense strategies against advanced persistent threats in cyber-physical systems","volume":"89","author":"Huang","year":"2020","journal-title":"Computers & Security"},{"issue":"5","key":"10.1016\/j.automatica.2023.111353_b15","doi-asserted-by":"crossref","first-page":"973","DOI":"10.1016\/j.jcss.2014.02.005","article-title":"A survey of emerging threats in cybersecurity","volume":"80","author":"Jang-Jaccard","year":"2014","journal-title":"Journal of Computer and System Sciences"},{"key":"10.1016\/j.automatica.2023.111353_b16","doi-asserted-by":"crossref","unstructured":"Ji,\u00a0Y., Lee,\u00a0S., Downing,\u00a0E., Wang,\u00a0W., Fazzini,\u00a0M., Kim,\u00a0T., et al. (2017). RAIN: Refinable Attack Investigation with On-demand Inter-Process Information Flow Tracking. In ACM SIGSAC conference on computer and communications security (pp. 377\u2013390).","DOI":"10.1145\/3133956.3134045"},{"issue":"11","key":"10.1016\/j.automatica.2023.111353_b17","doi-asserted-by":"crossref","first-page":"558","DOI":"10.1145\/368996.369025","article-title":"Topological sorting of large networks","volume":"5","author":"Kahn","year":"1962","journal-title":"Communications of the ACM"},{"key":"10.1016\/j.automatica.2023.111353_b18","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1016\/j.future.2019.01.056","article-title":"A semantic-based correlation approach for detecting hybrid and low-level APTs","volume":"96","author":"Lajevardi","year":"2019","journal-title":"Future Generation Computer Systems"},{"issue":"1","key":"10.1016\/j.automatica.2023.111353_b19","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1016\/S1389-0417(01)00015-8","article-title":"Value-function reinforcement learning in Markov games","volume":"2","author":"Littman","year":"2001","journal-title":"Cognitive Systems Research"},{"issue":"1\u20132","key":"10.1016\/j.automatica.2023.111353_b20","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1007\/s10207-004-0060-x","article-title":"Game strategies in network security","volume":"4","author":"Lye","year":"2005","journal-title":"International Journal of Information Security"},{"key":"10.1016\/j.automatica.2023.111353_b21","first-page":"4053","article-title":"Learning equilibria in stochastic information flow tracking games with partial knowledge","author":"Misra","year":"2019","journal-title":"IEEE Conference on Decision and Control"},{"key":"10.1016\/j.automatica.2023.111353_b22","series-title":"Machine learning","author":"Mitchell","year":"1997"},{"issue":"5","key":"10.1016\/j.automatica.2023.111353_b23","article-title":"A brief study of wannacry threat: Ransomware attack 2017","volume":"8","author":"Mohurle","year":"2017","journal-title":"International Journal of Advanced Research in Computer Science"},{"issue":"12","key":"10.1016\/j.automatica.2023.111353_b24","doi-asserted-by":"crossref","first-page":"5248","DOI":"10.1109\/TAC.2020.2976040","article-title":"A game-theoretic approach for dynamic information flow tracking to detect multi-stage advanced persistent threats","volume":"65","author":"Moothedath","year":"2020","journal-title":"IEEE Transactions on Automatic Control"},{"key":"10.1016\/j.automatica.2023.111353_b25","doi-asserted-by":"crossref","DOI":"10.1109\/TAC.2020.2976040","article-title":"Dynamic information flow tracking for detection of advanced persistent threats: A stochastic game approach","author":"Moothedath","year":"2020","journal-title":"IEEE Transactions on Automatic Control"},{"issue":"7","key":"10.1016\/j.automatica.2023.111353_b26","doi-asserted-by":"crossref","first-page":"1007","DOI":"10.1016\/S0005-1098(01)00050-4","article-title":"Adaptive policy for two finite Markov chains zero-sum stochastic game with unknown transition matrices and average payoffs","volume":"37","author":"Najim","year":"2001","journal-title":"Automatica"},{"key":"10.1016\/j.automatica.2023.111353_b27","unstructured":"Prasad,\u00a0H. L., Prashanth,\u00a0L. A., & Bhatnagar,\u00a0S. (2015). Two-timescale algorithms for learning Nash equilibria in general-sum stochastic games. In International conference on autonomous agents and multiagent systems (pp. 1371\u20131379)."},{"issue":"1","key":"10.1016\/j.automatica.2023.111353_b28","first-page":"1","article-title":"Defending against advanced persistent threats using game-theory","volume":"12","author":"Rass","year":"2020","journal-title":"PLoS One, Public Library of Science"},{"key":"10.1016\/j.automatica.2023.111353_b29","series-title":"Real analysis","author":"Royden","year":"2010"},{"key":"10.1016\/j.automatica.2023.111353_b30","doi-asserted-by":"crossref","unstructured":"Sahabandu,\u00a0D., Moothedath,\u00a0S., Allen,\u00a0J., Bushnell,\u00a0L., Lee,\u00a0W., & Poovendran,\u00a0R. (2019a). Stochastic Dynamic Information Flow Tracking Game with Reinforcement Learning. In International conference on decision and game theory for security (pp. 417\u2013438).","DOI":"10.1007\/978-3-030-32430-8_25"},{"key":"10.1016\/j.automatica.2023.111353_b31","article-title":"RL-ARNE: A reinforcement learning algorithm for computing average reward nash equilibrium of nonzero-sum stochastic games","author":"Sahabandu","year":"2020","journal-title":"IEEE Transactions on Automatic Control"},{"key":"10.1016\/j.automatica.2023.111353_b32","doi-asserted-by":"crossref","unstructured":"Sahabandu,\u00a0D., Moothedath,\u00a0S., Allen,\u00a0J., Clark,\u00a0A., Bushnell,\u00a0L., Lee,\u00a0W., et al. (2019b). A Game Theoretic Approach for Dynamic Information Flow Tracking with Conditional Branching. In American control conference (pp. 2289\u20132296).","DOI":"10.23919\/ACC.2019.8814596"},{"key":"10.1016\/j.automatica.2023.111353_b33","doi-asserted-by":"crossref","unstructured":"Sahabandu,\u00a0D., Moothedath,\u00a0S., Allen,\u00a0J., Clark,\u00a0A., Bushnell,\u00a0L., Lee,\u00a0W., et al. (2019c). Dynamic Information Flow Tracking Games for Simultaneous Detection of Multiple Attackers. In IEEE conference on decision and control (pp. 567\u2013574).","DOI":"10.1109\/CDC40024.2019.9029836"},{"issue":"10","key":"10.1016\/j.automatica.2023.111353_b34","doi-asserted-by":"crossref","first-page":"1095","DOI":"10.1073\/pnas.39.10.1095","article-title":"Stochastic games","volume":"39","author":"Shapley","year":"1953","journal-title":"Proceedings of the National Academy of Sciences"},{"key":"10.1016\/j.automatica.2023.111353_b35","doi-asserted-by":"crossref","unstructured":"Siddiqui,\u00a0S., Khan,\u00a0M. S., Ferens,\u00a0K., & Kinsner,\u00a0W. (2016). Detecting advanced persistent threats using fractal dimension based machine learning classification. In Proceedings of the 2016 ACM on international workshop on security and privacy analytics (pp. 64\u201369).","DOI":"10.1145\/2875475.2875484"},{"issue":"11","key":"10.1016\/j.automatica.2023.111353_b36","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1145\/1037187.1024404","article-title":"Secure program execution via dynamic information flow tracking","volume":"39","author":"Suh","year":"2004","journal-title":"ACM SIGPLAN Notices"},{"issue":"5","key":"10.1016\/j.automatica.2023.111353_b37","doi-asserted-by":"crossref","first-page":"585","DOI":"10.4218\/etrij.2019-0152","article-title":"Honeypot game-theoretical model for defending against APT attacks with limited resources in cyber-physical systems","volume":"41","author":"Tian","year":"2019","journal-title":"ETRI Journal"},{"key":"10.1016\/j.automatica.2023.111353_b38","doi-asserted-by":"crossref","unstructured":"Vance,\u00a0A. (2014). Flow based analysis of Advanced Persistent Threats detecting targeted attacks in cloud computing. In 2014 first international scientific-practical conference problems of infocommunications science and technology (pp. 173\u2013176).","DOI":"10.1109\/INFOCOMMST.2014.6992342"},{"key":"10.1016\/j.automatica.2023.111353_b39","unstructured":"Vorobeychik,\u00a0Y., An,\u00a0B., & Tambe,\u00a0M. (2012). Adversarial patrolling games. In 2012 AAAI spring symposium series."},{"key":"10.1016\/j.automatica.2023.111353_b40","series-title":"AAMAS","first-page":"1449","article-title":"Scalable game-focused learning of adversary models: Data-to-decisions in network security games","author":"Wang","year":"2020"},{"key":"10.1016\/j.automatica.2023.111353_b41","first-page":"1","article-title":"The impact of cyber attacks on the private sector","volume":"12","author":"Watkins","year":"2014","journal-title":"Briefing Paper, Association for International Affair"},{"key":"10.1016\/j.automatica.2023.111353_b42","doi-asserted-by":"crossref","unstructured":"Zhang,\u00a0Y., Guo,\u00a0Q., An,\u00a0B., Tran-Thanh,\u00a0L., & Jennings,\u00a0N. R. (2019). Optimal interdiction of urban criminals with the aid of real-time information. In Proceedings of the AAAI conference on artificial intelligence, Vol. 33 (pp. 1262\u20131269).","DOI":"10.1609\/aaai.v33i01.33011262"},{"key":"10.1016\/j.automatica.2023.111353_b43","doi-asserted-by":"crossref","unstructured":"Zhu,\u00a0Q., & Ba\u015far,\u00a0T. (2011). Robust and resilient control design for cyber-physical systems with an application to power systems. In IEEE decision and control and European control conference (pp. 4066\u20134071).","DOI":"10.1109\/CDC.2011.6161031"}],"container-title":["Automatica"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0005109823005198?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0005109823005198?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T08:39:40Z","timestamp":1701419980000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0005109823005198"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1]]},"references-count":43,"alternative-id":["S0005109823005198"],"URL":"https:\/\/doi.org\/10.1016\/j.automatica.2023.111353","relation":{},"ISSN":["0005-1098"],"issn-type":[{"value":"0005-1098","type":"print"}],"subject":[],"published":{"date-parts":[[2024,1]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Stochastic Dynamic Information Flow Tracking game using supervised learning for detecting advanced persistent threats","name":"articletitle","label":"Article Title"},{"value":"Automatica","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.automatica.2023.111353","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2023 Elsevier Ltd. All rights reserved.","name":"copyright","label":"Copyright"}],"article-number":"111353"}}