Stealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Light-weight countermeasures, on the other hand, can help retard the spread of stealth malwares, but the ensuing side effects might violate the primary safety requirement of CPS. Hence, defenders need to find a balance between the gain and loss of deploying light-weight countermeasures, which normally is a challenging task. To address this challenge, we model the persistent anti-malware process as a shortest-path tree interdiction (SPTI) Stackelberg game with both static version (SSPTI) and multi-stage dynamic version (DSPTI), and safety requirements of CPS are introduced as constraints in the defender’s decision model. The attacker aims to stealthily penetrate the CPS at the lowest cost (e.g., time, effort) by selecting optimal network links to spread, while the defender aims to retard the malware epidemic as much as possible. Both games are modeled as bi-level integer programs and proved to be NP-hard. We then develop a Benders decomposition algorithm to achieve the Stackelberg equilibrium of SSPTI, and design a Model Predictive Control strategy to solve DSPTI approximately by sequentially solving an $1+\delta$ approximation of SSPTI. Extensive experiments have been conducted by comparing proposed algorithms and strategies with existing ones on both static and dynamic performance metrics. The evaluation results demonstrate the efficiency of proposed algorithms and strategies on both simulated and real-case-based CPS networks. Furthermore, the proposed dynamic defense framework shows its advantage of achieving a balance between fail-secure ability and fail-safe ability while retarding the stealth malware propagation in CPS.

Causal structure learning plays a crucial role in the current field of artificial intelligence, yet existing causal structure learning methods are susceptible to interference from data sample noise and often become trapped in local optima. To address these challenges, this paper introduces a continuous optimization algorithm based on the curriculum learning framework: CL-NOTEARS. The model utilizes the curriculum loss function during training as a priority evaluation metric for curriculum selection and formulates the sample learning sequence of the model through task-level curricula, thereby enhancing the model’s learning performance. A curriculum-based sample prioritization strategy is employed that dynamically adjusts the training sequence based on variations in loss function values across different samples throughout the training process. The results demonstrate a significant reduction in the impact of sample noise in the data, leading to improved model training performance.

Critical network defense and attack problems, usually modeled as network interdiction, is of great significance. It is of great interest from the interdictor’s view to study saturation property of resource allocations. This paper presents a bi-objective shortest path network interdiction model with node interdiction, in which the interdictor seeks to interdict a set of nodes in the network that is Pareto-optimal with respect to two objectives, i.e., maximization of shortest path length and minimization of resources cost. A novel subgraph sequence algorithm is developed to identify the efficient frontier through a sequence of single-objective problems. Novel subgraph decomposition algorithms are proposed to solve single-objective problems. Features and time complexity of those problems and algorithms are analyzed. Moreover, to make a trade-off between the resource investment and the interdiction performance, the definition and the computing method of saturation point are introduced in this paper. Both simulated grid network and real-world transportation network data are used to evaluate the performance of algorithms in numerical experiments. The results show that the subgraph sequence algorithm can achieve the optimal Pareto-frontier of this bi-objective problem effectively.

Unmanned Aerial Vehicles (UAVs) have been widely used in localized data collection and information search. However, there are still many practical challenges in real-world operations of UAV search, such as unknown search environments. Specifically, the payoff and cost at each search point are unknown for the planner in advance, which poses a great challenge to decision making. That is, UAV search decisions should be made sequentially in an online manner thereby adapting to the unknown search environment. To this end, this paper initiates the problem of online decision making in UAV search planning, where the drone has limited energy supply as a constraint and has to make an irrevocable decision to search this area or route to the next in an online manner. To overcome the challenge of unknown search environment, a joint-planning approach is proposed, where both route selection and search decision are made in an integrated online manner. The integrated online decision is made through an online linear programming which is proved to be near-optimal, resulting in high information search revenue. Furthermore, this joint-planning approach can be favorably applied to multi-round online UAV search planning scenarios, showing a great superiority in first-mover dominance of gathering information. The effectiveness of the proposed approach is validated in a widely applied dataset, and experimental results show the superior performance of online search decision making.

Network security is a crucial challenge facing Internet-of-Things (IoT) systems worldwide, which leads to serious safety alarms and great economic loss. This paper studies the problem of malicious interdicting network exploitation of IoT systems that are modeled as a bi-layer logical–physical network. In this problem, a virtual attack takes place at the logical layer (the layer of Things), while the physical layer (the layer of Internet) provides concrete support for the attack. In the interdiction problem, the attacker attempts to access a target node on the logical layer with minimal communication cost, but the defender can strategically interdict some key edges on the physical layer given a certain budget of interdiction resources. This setting generalizes the classic single-layer shortest-path network interdiction problem, but brings in nonlinear objective functions, which are notoriously challenging to optimize. We reformulate the model and apply Benders decomposition process to solve this problem. A layer-mapping module is introduced to improve the decomposition algorithm and a random-search process is proposed to accelerate the convergence. Extensive numerical experiments demonstrate the computational efficiency of our methods.