# Unveiling the Shadows--A Framework for APT's Defense AI and Game Theory Strategy
## 6 Results and Discussion  
Most samples are classified as normal (green bar; Figure 5), and a small fraction of samples are classified as APT (red bar). The isolation forest anomaly detection correctly identifies APTs as rare events (which is expected in real-world network traffic). The balance looks well-calibrated (not too many false positives), meaning the threshold selection (95 th percentile) is working well. Compared to existing approaches, such as those proposed by [PERSON] et al. [11] and [PERSON] et al. [13], our framework differs in integrating anomaly detection with a game-theoretic defense layer. Most related work focuses on detection only, whereas our model also incorporates strategic response planning. Furthermore, the use of Stackelberg games enhances adaptability against dynamic APT tactics. The histogram (Figure 6) describes centers around \(-5.0\); therefore, the defense impact is stable, meaning that across multiple simulations, the defense system consistently reduces the attack's impact to approximately \(-5.0\). Across multiple simulation runs (Figure 7), the Stackelberg optimization consistently generated stable defense policies, as evidenced by the low variance in impact scores and anomaly detection thresholds. Low variance across simulation runs suggests that the model maintains consistent performance under different conditions, indicating its potential for deployment in adaptive defense systems. Figure 5: Distribution of detection results (normal vs. APT)/number of samples. Figure 6: Variability of defense impact over multiple runs/defense system impact. The anomaly detection system's APT detection rate is very stable, and the APT detection score remains consistent (0.2%) across multiple runs. Therefore, the isolation forest model performs reliably across different runs, for which a low variance means robustness, meaning the system does not overfit specific data samples. The anomaly score distribution plot (Figure 8) suggests that most of the network traffic is normal (blue bars), with anomaly scores concentrated below 0.5. Anomalous traffic (red bars) tends to score above 0.6, creating a right-skewed distribution. This pattern is consistent with the expected behavior of rare APT activities within the dataset. The isolation forest algorithm successfully distinguished anomalies (red) from normal traffic (blue). Thresholding at the 95% percentile effectively captures anomalies while reducing false positives. Figure 8: Anomaly score distribution. Figure 7: Variability of defense impact over multiple runs/defense policies impact. The experimental results demonstrate the framework's efficacy in detecting APT-like behaviors with high reliability. The isolation forest algorithm, calibrated at a 95 th percentile threshold, consistently identified APT traffic as outliers with minimal false positives. The anomaly detection precision averaged 94.3%, while recall remained above 91%, indicating robust sensitivity to stealthy patterns. In terms of strategic mitigation, the Stackelberg game model provided a dynamic layer of defense planning. Across 50 simulation runs, the defense impact consistently converged around a utility score of \(-5.0\), reflecting a significant reduction in adversarial success. These metrics were benchmarked against recent methods that focus primarily on anomaly detection without integrating adaptive strategic responses [3; 4]. Our framework's dual-layered approach surpasses these methods in both detection accuracy and adaptability. The results support the hypothesis that incorporating adversarial modeling into AI-based detection frameworks enhances both precision and strategic resilience [30; 34; 35]. This highlights the key advantages of our approach on dynamic strategy adaptation vs. static rule-based defenses, behavioral anomaly modeling vs. pattern matching, and integrated mitigation planning vs. detection-only models. Using AI in cybersecurity introduces ethical concerns such as false positives, affecting user access and the potential misuse of automated response mechanisms.