# Unveiling the Shadows--A Framework for APT's Defense AI and Game Theory Strategy
## 5 Conceptual Framework
### Game Strategy (Stackelberg Game Model for Cyber Defense)
\begin{table}
\begin{tabular}{l} \hline \hline
**Algorithm for cyber defense in Stackelberg model** \\ \hline \# Solve the Stackelberg game using linear programming \\
**optimal_defense \(<\)** - lp(direction = “min”, \\ objective.in = **costs**, \\ const.mat = **constraints**, \\ const.dir = “=”, \\ const.rhs = **bounds**, \\ all.int = FALSE) \\
**\# Extract defense strategy** \\ \(\text{defense\_strategy}<\text{optimal\_defense\_solution}\) \\
**\# Compute Expected Impact** \\ impact \(<\)** sum(defense\_strategy \({}^{*}\)**c(-10, -5)) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Algorithm for cyber defense in Stackelberg model; (**a**) designed defense strategy and expect impact; (**b**) designed APT_Defense algorithm in R.  
the algorithm constructs \(t\) isolation trees:  
\[T_{1},\ldots,T_{t} \tag{3}\]  
and each tree splits the data randomly along a uniformly chosen axis \(j\). The expected depth \(h(x)\) of a point \(x\) is given by  
\[E(h(x))=\frac{c(n)}{2}-\sum_{i=1}^{n-1}\frac{1}{i} \tag{4}\]  
where \(c(n)\) is the normalization constant, and the anomaly score is defined as  
\[s(x,n)=2^{-\frac{E(h(x))}{c(n)}} \tag{5}\]  
if \(s(x,n)\) is high, it could be \(x\)-anomalous and may be part of an APT. Detecting an APT is not sufficient; a strategic response model is required. Here, we use a Stackelberg game between an attacker (A) and a defender (D). We define a bimatrix game where the attacker (A) selects a strategy \(a_{i}\) (e.g., vulnerability exploitation, or lateral movement) and the defender (D) selects \(d_{j}\) (e.g., detection, isolation, or mitigation). In Equation (5), the anomaly score \(s(x,n)\) represents the probability that point \(x\) is anomalous given the tree depth in the isolation forest. The higher the score, the more likely the traffic corresponds to APT behavior. The defender's payoff is given by  
\[U_{D}\big{(}d_{j},a_{i}\big{)}=V_{D}\big{(}d_{j},a_{i}\big{)}-C_{D}\big{(}d_{ j}\big{)} \tag{6}\]  
where \(V_{D}(d_{j},a_{i})\) represents the defender's utility based on mitigated impact, and \(C_{D}(d_{j})\) denotes the cost of implementing the defense. The objective is to find an optimal strategy \(d^{*}\) that maximizes the defender's reward (RData_algorithm). \[d^{*}=\operatorname*{argmax}_{d_{j}}U_{D}\big{(}d_{j},a_{i}\big{)} \tag{7}\]  
The Stackelberg game is formalized as a bilevel optimization problem, where the defender acts as the leader and the attacker as the follower. Formally, let \(D=\{d_{1},d_{2},\ldots,\)\(d_{n}\}\) be the set of defense strategies and \(A=\{a_{1},a_{2},\ldots,a_{m}\}\) the set of attack strategies. The utility of the defender is given by \(U_{D}(d_{i};a_{j})=V_{D}(d_{i};a_{j})-C_{D}(d_{i})\), where \(V_{D}\) represents the effectiveness of the defense against the specific attack, and \(C_{D}\) is the associated cost. The defender's goal is to find the optimal mixed strategy \(\mathbf{p}\in\Delta_{\mathrm{n}}\) that maximizes the expected utility:  
\[\max_{p}\min_{a_{j}\in A_{i}=1}^{n}p_{i}\cdot U_{D}\big{(}d_{i},a_{j}\big{)} \tag{8}\]  
subject to  
\[\sum_{i=1}^{n}p_{i}=1,\quad p_{i}\geq 0\ \forall i \tag{9}\]  
This linear program ensures that the selected strategy \(\mathbf{p}\) minimizes the worst-case loss. The optimization was solved using the simplex method, and the results yielded a stable mixed strategy with low variance across repeated simulations, indicating the robustness of the proposed model under adversarial conditions. The game can be modeled as a linear programming problem with constraints:  
\[\max\sum_{j}p_{j}U_{D}\big{(}d_{j},a_{i}\big{)} \tag{10}\]subject to \[\sum_{j}p_{j}=1\text{ and }p_{j}\geq 0\] (11) We use simplex optimization to solve this problem. The algorithm follows three phases:  
* Phase 1--detection phase, when the isolation forest computes \(s(x,n)\).