# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
## 6 Related Work  
We divide related work on the network attack-defense game modeling into three aspects, using traditional game theoretic approaches, using stochastic games and partially observable stochastic games, and other similar game models. **Traditional game theoretic approaches. ** Due to the importance of network intrusion defense problems, researchers have proposed different network attack-defense game models based on various game theoretic approaches, such as differential games, dynamic games, and other game theoretic approaches. [PERSON] et al. [4] proposed the \"FlipIt\" game based on the differential game (SG), which modeled the network attack-defense game as a process of \"stealthy takeover\" for the network asset. Due to the simple design of attack and defense actions (each player has only one action to control resources through \"flipping\" at a certain time.) in this model and the ability to depict the characteristics of both sides being invisible to each other, this model has been investigated and adapted extensively [27; 28; 29]. Figure 9: Winnings rates of the defense agent with different defense lag time. [PERSON] [30] designed a \"Cyber Hide-and-Seek Game\" as a two-sided search problem. In the proposed game, one player hides \(k\) hosts with a certain strategy in the \(n\)-host network topology. [PERSON] et al. [31] modeled the network attack-defense game as the Colonel Blotto game [32], where multiple attackers and defenders compete for multiple distributed resources. Similar problem descriptions have also appeared in the literature [29; 33; 34; 35]. Since the traditional game-theoretic models do not set up elements such as the state and observation, it often assumes that the tasks and actions of both players are consistent, which makes it difficult to analyze in depth the complex interaction process between the attacker and defender. **Stochastic games and partially observable stochastic games. ** Stochastic games (SGs), also known as Markov games, describe a game in which players compete or cooperate with each other in a sequential decision-making manner. [PERSON] et al. [6] used Stochastic Petri Nets (SPN) to build a network attack-defense simulation environment based on the stochastic game. [PERSON] et al. [7] proposed a simplified network attack-defense game based on the stochastic game. [PERSON] et al. [8] also modeled the adversarial attacker-defense game. The attacker aims to reach the target host by taking actions of different values, and the defender needs to prevent the attacker by allocating different defense values. Both players cannot see the actions and utilities of the opponent. Results show that when two agents try to adapt to each other, no one can ensure a long-term victory. Although the stochastic game approach can reflect complex interactions between the attack and defense agents, its assumption that the agent receives the real state of the system is clearly inconsistent with reality. A partially observable stochastic game models a problem in that agents have no access to the exact environmental state but only an observation of the true state through an observation function [12]. [PERSON] et al. [36] proposed an incomplete information stochastic game to model a network attack-defense game. In the proposed game, the attacker and defender choose an action from a given behavior, and get rewards. [PERSON] et al. [5] used the partially observable stochastic game (POSG) to model the network attack-defense game. The author uses a Bernoulli process to model the defender's impact on the attacker's task, and distinguishes the defender's behavior into detection and response behavior, where the detection behavior can change the network environment and the response behavior does not change the network environment. [PERSON] et al. [37] used a one-sided POSG to address the issue of honeypot reallocation against the attacker's lateral movement.