## 1 Introduction  
Heterogeneous networks, a significant research direction in the field of networking, have demonstrated a vigorous development momentum. These networks are composed of various types of devices, communication technologies, and network structures [1]. The research scope is broad, encompassing mobile edge networks [2, 3], satellite networks [4, 5], self-organized networks [6, 7], and the wired Internet [8, 9]. The objective of constructing heterogeneous networks is to integrate diverse network resources to provide users with more flexible, efficient, and reliable communication services, thereby meeting increasingly diverse and complex communication needs. Despite the significant advantages of heterogeneous networks, their security still faces serious challenges. For instance, replay attacks,distributed denial-of-service (DDoS) attacks, and privacy breaches can lead to network disruptions, transmission failures, or even more severe consequences. Therefore, security management in heterogeneous networks remains a critical research area, with the secure transmission of network information being a primary focus. To address security issues in heterogeneous networks, researchers have proposed various approaches, including strategies such as mobile target defense, privacy protection, and malicious traffic detection to counter complex network threats. Data encryption techniques are most commonly employed to secure data transmission. According to a Google report, encrypted data accounted for more than 80% of total network traffic as of 2024. Despite this high percentage, data breaches have become more frequent, primarily due to security vulnerabilities in network data transmission [10]. The main reasons for these vulnerabilities include the following: encryption and decryption algorithms typically require substantial computational resources, leading to high computational complexity and significant operational costs for nodes [11]; the rise of intelligent algorithms, such as semantic recognition, enables attackers to infer the overall content by obtaining only part of the data [12]. Clearly, avoiding malicious nodes during transmission is an effective method to prevent data leakage. Thus, there is a need to develop secure, resilient, and efficient detection techniques to manage malicious nodes within the network to defend against network attacks [13]. However, existing detection solutions are not yet adequate for defending against the latest internal and external threats. These models typically require monitoring both potential internal and external attacks [14; 15; 16] and heavily rely on the accuracy of malicious node detection. Existing studies indicate that the best malicious node detection methods achieve an accuracy of up to 80%, leaving a 20% uncertainty [17]. While it is feasible to develop algorithms that compute secure transmission routing paths to avoid data eavesdropping or interception by malicious nodes, these paths often require significantly more hops than optimal routes, reducing transmission efficiency and increasing costs. Additionally, the destination node must collect all transmitted packets to reconstruct the original data, which imposes very high reliability requirements on the network [18]. Over time, there has been a growing interest in the introduction of dynamic parameters in cyber adversarial environments, an approach that has allowed cybersecurity protection techniques to evolve from static protection to dynamic active defense. For example, Moving Target Defense (MTD) serves as a defense paradigm aimed at minimizing the inherent advantages of attackers over defenders [19; 20]. MTD protocols increase the cost of an attack, limit the exposure of susceptible components, and deceive adversaries by developing mechanisms to continuously and unpredictably change system parameters [21; 22]. However, even active defense techniques such as MTD still face significant challenges [23].