Practical Graph Optimisation and AI-Driven Models for Active Directory Security Hardening

Huy Q. Ngo

REVIEW 5 major objections 5 minor 25 references

The thesis claims that practical AD hardening can be both intractable and near-optimal at scale, across static, temporal, and human-in-the-loop settings.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 06:05 UTC pith:HUWD7QFO

load-bearing objection Genuinely new problem formulations and strong scaling results, but Chapter 3's all-shortest-path restriction undercuts the competent-attacker claims and the human-decision models are unvalidated. the 5 major comments →

arxiv 2607.22009 v1 pith:HUWD7QFO submitted 2026-07-24 cs.CR cs.AI

Practical Graph Optimisation and AI-Driven Models for Active Directory Security Hardening

Huy Q. Ngo This is my paper

classification cs.CR cs.AI

keywords Active Directoryattack graph hardeninghoneypot placementtemporal attack graphsadaptive query policyhuman-in-the-loopcomputational intractabilityreinforcement learning

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This thesis tries to establish that the main practical obstacles to hardening Microsoft Active Directory attack graphs can be overcome with a suite of optimisation and AI models, and that the core optimisation problems behind all of them are computationally intractable. It targets three gaps: static-graph assumptions, defence limited to edge removal, and no administrator feedback. It claims near-optimal honeypot and decoy placement is achievable on very large static and time-varying graphs, and that adaptive policies that query an administrator can minimise expected effort while guaranteeing all attack paths to high-privilege targets are cut. A sympathetic reader would care because these are the two steps—prioritisation and remediation—that security teams actually perform, and the models are evaluated on graphs with hundreds of thousands of nodes and millions of edges.

Core claim

The central claim is that all four contributed decision problems—honeypot placement against observable and non-observable attackers, temporal decoy placement maximising worst-case response time, adaptive path-removal wizardry, and feature-based adaptive connectivity testing—are intractable (NP-hard, W[1]-hard, or #P-hard), yet each admits a practical solver that exploits AD-specific structure. For static honeypot placement, a mixed-integer program scales to graphs of roughly 137,000 nodes and 1.5 million edges and returns optimal placements quickly because AD graphs are tree-like. For time-varying graphs, solving the MIP on representative snapshots (chosen by clustering or by voting across b

What carries the argument

The load-bearing formal objects are the AD attack graph (a directed graph whose nodes are accounts, computers and groups, and whose edges are permissions an attacker can chain); the Stackelberg-game framing for decoy placement, where the attacker sees the defender’s plan and picks a worst-case path; the response-time metric, defined as the duration from the attacker’s first contact with a decoy to compromise of the Domain Admin; and an adaptive query model in which a wizard proposes either a whole attack path (Chapter 5) or a feature-annotated edge (Chapter 6), and the administrator’s choice—modelled by a Bradley–Terry rule proportional to confidence scores—determines the next query. The sim

Load-bearing premise

The load-bearing premise is that an IT administrator’s removal choice on a proposed attack path is governed by known confidence scores (Bradley–Terry), and in Chapter 6 that a single decision transfers to every edge with the same risk features; the thesis offers no observed admin-decision data to validate that model.

What would settle it

Take a real AD change-approval log (or run a user study with network administrators on a set of proposed attack paths) and compare the empirical removal-choice distribution to the Bradley–Terry prediction in Eq. 5.1. If the distributions differ materially, the 'minimize expected queries' policies minimise the wrong objective; likewise, an audit of historical removals that finds the same-feature edges treated differently would falsify the F-ACT generalisation.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

Defenders can obtain lower-bound-verified, near-optimal honeypot plans on graphs of realistic AD scale (about 137k nodes and 1.5M edges) in minutes rather than days.
Static plans degrade on dynamic graphs; building one plan from representative snapshots (voting or clustering) keeps the attacker’s success rate close to the optimal dynamic baseline and comes with a Monte-Carlo lower bound.
Placing decoys to maximise worst-case response time is NP-hard, but the surrogate-assisted evolutionary approach converges to feasible cuts about 108 times faster than the vanilla version and yields roughly 23% better average response time than the ILP-repair variant in the reported settings.
The adaptive wizard guarantees all s–t paths are cut when budget allows—a stronger guarantee than earlier edge-by-edge adaptive models—and its best heuristic (DPR) scales beyond the exact algorithm while beating the approximate algorithm on all tested graphs.
All four underlying problems are provably intractable, so no polynomial-time optimal algorithm should be expected; heuristic and anytime solvers are the appropriate target.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

If real administrators’ removal choices do not follow the confidence-proportional Bradley–Terry distribution, the expected-query objectives in Chapters 5–6 are mis-specified; collecting admin decision logs and recalibrating the choice model would be a direct extension.
The Chapter 6 assumption that one decision transfers to every edge with the same features could be tested against historical permission-change approvals; edges sharing features are often treated differently for operational reasons, so the transfer rule may need confidence weights rather than a binary generalisation.
The tree-like structure that makes the MIP fast suggests a formal fixed-parameter-tractable algorithm for honeypot placement; the thesis observes the structure but does not prove an FPT result.
The response-time metric is one plausible security-operations objective; integrating detection probability or alert fatigue into the decoy-placement objective would change placements and is a natural next step.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Genuinely new problem formulations and strong scaling results, but Chapter 3's all-shortest-path restriction undercuts the competent-attacker claims and the human-decision models are unvalidated.

read the letter

Here's what you should know about arXiv:2607.22009. It's a PhD thesis with four real contributions: AD-scale honeypot placement on static and dynamic graphs, temporal decoy placement maximizing response time, a path-based adaptive wizard, and a feature-based adaptive connectivity test with RL. The hardness proofs (NP/W[1]/#P) are standard but the formulations are new, and the empirical scaling is impressive — MIP on ~1.5M-edge graphs, EST converging ~108x faster than vanilla EDO. The evaluations are against independent baselines, and the Monte-Carlo lower bounds with Hoeffding sample sizes are the right kind of evidence. The thesis positions itself accurately against Guo, Goel, Zhang, and others. The algorithms are thoughtfully designed, especially the Dijkstra-based earliest-arrival computation that exploits static infrastructure.

But there's a load-bearing issue in Chapter 3. The MIP restricts to the all-shortest-path DAG. That's WLOG for the simple attacker, but not for the competent attacker, who is defined as able to detect honeypots and alternate to other paths. Disconnecting a node in the shortest-path subgraph doesn't mean it's disconnected in the original graph. So sMIP-C/dyMIP-C may report CSR values that are too optimistic, and the honeypot placements may not actually cut all competent-attacker paths. This affects Tables 3.2–3.4 and the dynamic lower-bound comparisons. This is a real gap, not a nitpick.

Also, Proposition 1's proof is a corrupted copy-paste of Theorem 2's proof, and Theorem 7's convergence relies on an unproven disjointness assertion. The Bradley-Terry/feature-generalization model of admin decisions in Chapters 5-6 is sensible but completely unvalidated — no logs, no user study, no deployment. If real admins don't behave that way, the policies minimize the wrong quantity.

These are addressable rather than fatal. The central algorithmic claims and the new problem definitions are solid enough that the thesis deserves a serious referee. I'd send it to peer review, but ask the authors to address the all-shortest-path restriction for the competent attacker and to make code/data available. The chapter-based structure means each part can be reviewed separately; Chapter 3 needs the most work.

Referee Report

5 major / 5 minor

Summary. This PhD thesis presents four game-theoretic/optimization models for hardening Active Directory attack graphs. Chapter 3 formulates honeypot placement as a bi-objective problem against simple and competent attackers, gives NP-hardness/W[1]-hardness results, and proposes a MIP (sMIP) plus voting/clustering heuristics for dynamic graphs (dyMIP). Chapter 4 models decoy placement on temporal attack graphs with a new response-time metric, proves NP-hardness, and develops an EDO algorithm with an ILP repair operator and a surrogate-assisted fitness function (EST). Chapter 5 introduces the Adaptive Path Removal (APR) wizard, proves #P-hardness, and proposes exact, approximate, and DPR heuristics. Chapter 6 introduces the feature-based F-ACT adaptive connectivity test, proves #P-hardness, and presents an RL algorithm (RL4FT) with self-improvement and reward shaping. The thesis claims that the underlying problems are computationally intractable and that the proposed methods scale to large AD graphs while outperforming baselines such as ZDO, vanilla EDO, and LQGCT.

Significance. If the technical claims are correct, the thesis addresses three genuinely practical gaps in AD hardening: active defences (honeypots), time-varying graphs, and human-in-the-loop remediation. The strengths of the submission include complete MIP/ILP formulations, implementable pseudocode, experiments on graphs up to 137K nodes and 1.49M edges, and benchmarking against independent baselines and Monte-Carlo lower bounds. I do not see a circularity problem: the empirical claims are not defined in terms of the fitted constants. However, the current manuscript contains several load-bearing correctness issues and one verbatim duplicated proof, so the central claims are not yet established as written.

major comments (5)

[§3.4.1, Eqs. (3.5e)–(3.5f); §3.4.2, Eqs. (3.7e)–(3.7f)] The competent-attacker reachability objective is not correctly defined if the MIP is solved on the all-shortest-path DAG. The WLOG argument in §3.4.1 is valid for the simple attacker's shortest-path count, but a competent attacker who detects honeypots and alternates to other paths can take longer paths. A node can be disconnected in the all-shortest-path subgraph while an s→DA path still exists in the original graph. If the MIP input is restricted to that subgraph, constraints (3.5e)–(3.5f) and (3.7e)–(3.7f) minimize reachability on the wrong graph, making the CSR results in Tables 3.2–3.4 optimistic. If, instead, the MIP evaluates R variables on the full graph while only the y variables use the DAG, this must be stated explicitly and the evaluation protocol clarified. Either way, the text is ambiguous on a point that is load-bearing for the chapter's static and dynamic claims.
[§3.4.2, Proposition 1 and its proof] The proof of Proposition 1 is a verbatim copy of the Theorem 2 clique-reduction proof. It has no connection to the batching lower-bound statement. The proposition itself is true by a simple argument: the left-hand side allows different blocking plans per batch, while the right-hand side forces a single plan over all samples. As printed, however, the proof is absent and the lower-bound estimates used in §3.5.3 and §3.5.4 rest on unproved support. The duplicated passage must be replaced with a correct proof, and the surrounding text should be checked for similar editorial errors.
[§4.2.2, Theorem 3 proof] The NP-hardness reduction from the strict temporal (s,d)-separator problem is not valid as written. After placing the strict-TS separator of size |minC_ts| and one additional honeypot on y2, the temporal path s2→y1→DA remains with no honeypot, giving response time 0 and violating the feasibility condition that C form a temporal (S,DA)-cut. If the proof intends to block y1 rather than y2, then the extra budget is not one but two, unless y1 is declared non-blockable, which is not stated. The construction and budget accounting must be corrected before the NP-hardness claim for max-RT is established.
[§4.4.4, Theorem 7 proof] The surrogate-convergence proof contains an unsupported assertion: it claims that every random path added to Φ in line 12 of Algorithm 7 is vertex-disjoint from every path already in Φ. This does not follow from the definition of G'=(V\c,E), since a path avoiding c may still use nodes that appear in earlier Φ paths. The subsequent O(|V|) bound depends entirely on this disjointness property. Because the guarantee that the surrogate evaluation converges to global feasibility is one of the chapter's stated contributions, the proof needs to be repaired or explicitly replaced by a weaker, correct statement.
[§5.2, Eq. (5.1); §6.3 and §6.6.7] The human-decision model is the quantity being optimized, but it is not validated. Eq. (5.1) postulates that the IT admin chooses an edge according to a Bradley–Terry model with known confidence scores, and Chapter 6 assumes that a decision transfers to all edges with the same feature pattern. The experiments use simulated decision functions (e.g., linear/quad/rbf in §6.6.7) and random baselines, but no real administrator decision logs, user study, or deployment data are presented. The thesis-level claim of a 'practical end-to-end model' is therefore not supported by the evidence. At minimum, the human-decision assumption should be clearly framed as a stylized model, and the practical claims should be softened or accompanied by a validation/calibration discussion.

minor comments (5)

[§3.3.1] The notation y_i is introduced as the 'total number of clean paths' but is later used as the number of shortest paths. Please define y_i as the number of shortest s→DA paths for the simple attacker and keep the terminology consistent.
[§3.5.2 / Table 3.4] The budget is stated as b=10 in Table 3.2 and the experiment setup, but Table 3.4 reports results 'with a budget of 20'. Clarify whether the dynamic experiments use a different budget and why.
[§4.4.2, Theorem 4] The proof of Lemma 5 is given as 'Admit proof from Lemma 6 of (Wu et al., 2014)'. For a standalone thesis chapter, either provide a self-contained proof or state the lemma as external and give the precise conditions under which prefix-subpaths of earliest-arrival paths are earliest-arrival paths.
[§4.2.2] The proof gadget is referenced as 'Figure 3.b'; it should be Figure 4.2(b). There are also several typographical errors in the temporal-graph definitions (e.g., inconsistent use of t_i and t_max).
[General] The thesis is an aggregation of five published/submitted papers. Some notation and terminology differ between chapters (e.g., 'system admin' vs 'IT admin', 'honeypot' vs 'decoy'). A unified notation table and a pass to normalize terminology would improve readability.

Circularity Check

0 steps flagged

No circularity: central claims are benchmarked against independent baselines and external hardness targets; the all-shortest-path restriction and human-decision assumptions are validity/modeling concerns, not reductions of the target to its inputs.

full rationale

No circular step can be exhibited. The empirical claims are measured against independent baselines (GREEDY, ZDO, vanilla EDO from Goel et al., ILP repair, LQGCT) and Monte-Carlo lower bounds sized by Hoeffding's inequality; no fitted parameter is later renamed as a prediction. Hardness proofs reduce from Vertex Cover, Clique, and the strict temporal separator problem (Zschoche et al., 2020), which are external. The thesis's self-citations are structural—chapters build on the author's own published formulations—but none is load-bearing: the tree-like-structure remark (Guo et al., 2022) is explanatory, and scalability/optimality claims rest on direct experiments. The main concerns are validity/correctness rather than circularity: (i) in Section 3.4.1, "it is without loss of generality to consider only all-shortest path graphs" is justified for the simple attacker but is silently applied to the competent-attacker reachability constraints (3.5e)-(3.5f), so sMIP-C/dyMIP-C optimize a surrogate graph; (ii) Section 5.2's Bradley-Terry model (Eq. 5.1) and Chapter 6's feature-transfer rule ("That decision is then applied to all edges that share the same feature pattern") define the admin model rather than validate it against real decisions; (iii) Proposition 1's proof in Section 3.4.2 is a copy-paste of the clique reduction and does not prove the stated lower-bound inequality (which is elementary anyway). None of these makes a claimed prediction equal to its input by construction, so the circularity score is 0.

Axiom & Free-Parameter Ledger

5 free parameters · 8 axioms · 4 invented entities

The thesis's central claims rest on plausible domain simplifications (shortest-path attackers, static node sets, unit edge durations, full-visibility attackers) and one unvalidated human-behavior model (Bradley–Terry/F-ACT generalization). The algorithmic constructs (response-time metric, wizard, Φ surrogate) are internally defined and lack external handles. No physics-style invented entities are involved; the free parameters are experimental knobs (φ, m, k, bf) and the assumed confidence scores conf(e).

free parameters (5)

φ (fraction of competent attackers) = 0.5
Ch3 sets φ=0.5 in experiments to weight the two attacker objectives; the thesis asserts the method works for any φ, so this is a hand choice, not fitted to data.
m (number of graph samples in dyMIP(m)) = 10–100
Ch3 sweeps m=1,10,50,100; runtime grows with m, so m is a hand-tuned quality/cost knob.
k (number of clusters in clustering heuristic) = not reported in visible text
Ch3 Algorithm 2 takes k as input; its value in the experiments is not stated in the text provided.
bf (budget factor for temporal decoy budget) = 1.5
Ch4 sets b = bf × |minC| with bf=1.5; the feasibility of the defender's problem depends on this hand-chosen multiplier.
conf(e) (Bradley–Terry confidence scores) = generation not described
Ch5 Eq. 5.1 treats admin removal probabilities as known inputs; how conf(e) is set in experiments is not visible, so the probabilities are effectively assumed or given.

axioms (8)

domain assumption Simple attacker chooses uniformly among shortest paths; WLOG the relevant subgraph is the all-shortest-path DAG (acyclic).
Ch3 §3.3.1–§3.4.1: “it is without loss of generality to consider only all-shortest path graphs, which is naturally acyclic.” This behavioral assumption defines the simple-attacker objective.
domain assumption Only edge sets change across snapshots; the node set is static.
Ch3 §3.3.2: “We assume only the edge set E^x changes across snapshots while the node set V remains the same.” This keeps the dynamic MIP tractable.
domain assumption Every temporal edge has duration 1.
Ch4 §4.2.1: “we assume that every edge has a duration of 1... all our algorithms remain effective in more general settings in which the duration of every edge is larger or equal 1.”
domain assumption The attacker has full visibility of the temporal graph and the decoy placement.
Ch4 §4.1: worst-case Stackelberg assumption; response time is 0 if the decoys do not form a temporal (S,DA)-cut.
ad hoc to paper IT admin choices follow the Bradley–Terry model with known confidence scores.
Ch5 §5.2 Eq. 5.1: admin removes edge e from path p with probability conf(e)/Σconf(e′); no empirical validation of this behavioral model is provided.
ad hoc to paper Admin decisions generalize to all edges sharing similar risk features.
Ch6 abstract/F-ACT: one query decision is applied to every feature-identical edge; no admin-behavior dataset supports the generalization.
standard math Standard hardness results: Vertex Cover is NP-hard; Clique is W[1]-hard w.r.t. size; Strict-TS is NP-complete (Zschoche et al. 2020); counting s-t paths/cuts is #P-hard.
Used in Theorems 1–3 and the #P-hardness claims of Ch5–6.
domain assumption Realistic AD graphs have tree-like structure that MIP solvers exploit.
Ch3 §3.5.2: empirical observation used to explain why staticMIP runs fast despite NP-hardness.

invented entities (4)

Response-time metric (RT) no independent evidence
purpose: Ch4 objective: duration from first decoy trigger to DA compromise, maximized by the defender; a new evaluation/objective construct.
No real incident-response measurement validates that maximizing RT corresponds to earlier detection in practice; the metric is argued from the delay model, not measured.
Adaptive wizard (APR) no independent evidence
purpose: Ch5 interaction model: proposes attack paths as multiple-choice edge queries to the IT admin; the paper's new human-in-the-loop construct.
No user study or deployment shows admins can or will answer path queries as modeled; the construct is validated only in simulation.
Feature-generalized admin decision (F-ACT) no independent evidence
purpose: Ch6: one admin decision is applied to all edges with identical risk features, reducing query count.
The generalization is an untested assumption about human behavior; no admin-decision dataset or field evidence is presented.
Important-path surrogate set Φ no independent evidence
purpose: Ch4 §4.4.4: lightweight fitness evaluation on a growing set of “important” temporal paths; Algorithm 7's key device.
Internal algorithmic construct; the convergence theorem (Thm 7) as printed relies on an unproven disjointness claim.

pith-pipeline@v1.3.0-alltime-deepseek · 51930 in / 24391 out tokens · 216204 ms · 2026-08-01T06:05:16.050111+00:00 · methodology

0 comments

read the original abstract

Microsoft's Active Directory (AD) is a directory service that enables the IT admin to manage security permissions and control access within a Windows domain network. As a core management system in many of organisation, AD has become a primary target for adversaries. While many solutions for hardening attack graphs exist, these efforts fall short in addressing several key practical challenges specific to the AD attack graph. First, existing models often assume the graph is static, whereas a real-world AD environment is highly dynamic. Second, most proposed solutions are limited to the defensive measure of revoking vulnerabilities (edge removal), while more active defence mechanisms are largely unstudied. Third, because not all remediations are implementable, a practical end-to-end model must incorporate system admin feedback into the prioritisation process. This thesis aims to address these limitations by studying and proposing a number of game-theoretic and optimisation-based decision-making models. First, we propose a honeypot/decoy placement model based on the principle of minimising the number of shortest paths and the number of Domain Admin-reachable nodes. Second, building on this model, we introduce a defence strategy that considers the dynamic/temporal nature of the AD graph, where the objective is to find the location to deploy decoys that maximises the worst-case incident response time. Third, we introduce an adaptive prioritisation model that queries each high-risk attack path to the IT administrator for mediation. Finally, we introduce an end-to-end adaptive prioritisation model that minimises the approval effort of the system admin by finding a general adaptive edge-removal policy that generalises the system admin's decisions to edges with similar risk features. We show that the problems underlying all of the contributed models are computationally intractable.

Figures

Figures reproduced from arXiv: 2607.22009 by Huy Q. Ngo.

**Figure 1.1.** Figure 1.1: Misconfigurations in AD tiering model. (a) Secured AD follows best practice with only “downstream” edges. (b) Insecure AD with an “upstream” edge caused by a privileged admin signing in to a low-privileged computer. (c) Insecure AD caused by granting multitier permissions to an accounts (red nodes). 1.1.2 Insecure Drift and Violations In practice, especially in large or complex enterprises, AD environme… view at source ↗

**Figure 1.2.** Figure 1.2: Simplified BloodHound attack graph with only Account (Ux), Computer (Cpx) and Groups (Grx) nodes. The attack graph visualize attack paths from a low-privilege/compromise-prone source (sx) to the Domain Admin (DA) node. is intended to be isolated from other network segments. Ultimately, as defenders, we seek to eliminate or minimise attack paths to Tier Zero and any nodes in this zone. 1.1.4 Defending AD … view at source ↗

**Figure 1.3.** Figure 1.3: Vulnerability management lifecycle for Active Directory The process begins with Discovery phase, where enumeration tools like SharpHound (Vazarkar, n.d.) scan the whole network to list potential security weaknesses, and BloodHound maps the network into the attack graph. However, in enterprise networks, the scan typically reveals thousands of vulnerabilities, so fixing every single one is impractical and… view at source ↗

**Figure 3.1.** Figure 3.1: An attack graph with dynamic HasSession edges. The DA uses the edge 2 → DA (straight) regularly but only use 1 → DA (dash) when needed [PITH_FULL_IMAGE:figures/full_fig_p038_3_1.png] view at source ↗

**Figure 3.2.** Figure 3.2: Proof gadget for Theorem 1. Light nodes are blockable nodes. Thick edge is multiple edges (M of them) and thin edge are single edge. Proof. To prove the hardness of our problem, we use the reduction from clique problem to our. Clique problem is know to be W[1] − hard with respect to clique size (Fellows et al., 2009). Let define undirected graph Gc = (Vc, Ec) is the clique instance. We construct attack … view at source ↗

**Figure 3.3.** Figure 3.3: An example all-shortest path AD attack graph. Nodes 5, 6, 7 are entry nodes. Nodes 0 is the DA. Bold nodes 2, 10, 11 are not blockable nodes Constraints (3.5e) and (3.5f) presented the problem of defending against a competent attacker. These constraints solve the problem based on the idea that if any of the successor nodes of node i can reach DA, then DA is also reachable via node i. We assume that DA is… view at source ↗

**Figure 3.4.** Figure 3.4: (a) Number of online sessions and newly established session sampling every 1 hour (b) Histogram of a number of edges which are highly correlated (in terms of logon/off session pattern) with others. we run it sequentially, which is infeasible without parallel computing. The reported time for Voting is the sum of the time of 10 parallel processes. As Random and Kmean only require running MIP(m) once, we ru… view at source ↗

**Figure 3.5.** Figure 3.5: (a) Number of online sessions and the accumulation of newly established session sampling every 1 hour (b)Voting with m = 10. The red dash-dotted lines are the optimal MSR of b = 6, 8, 10, listed from top to bottom. dataset. Upon analyzing the AuthOrg data, we find that the random authentication scheme in Section 3.5.3 significantly diverges from realistic session patterns. Our analysis reveals that the … view at source ↗

**Figure 4.1.** Figure 4.1: Example of an Active Directory graph sampled over a period of 10 time units. The timestamps on each edge indicates its appearance time. Black labels represent static edges, while orange labels denote dynamic edges (HasSession). In this chapter, we study a method for defending temporal AD attack graph by using active defense with cyber decoys. Decoys or honeypots (Markinzon, 2023; Daniely, 2021) are fake… view at source ↗

**Figure 4.2.** Figure 4.2: Proof gadget for Theorem 3. a) Proof gadget for StrictTS problem. b) Proof gadget for max-RT problem With a defensive budget of b = |minCts| + 1, the optimal allocation involves locating the solution for the strict-TS instance and blocking vertices y2. As the optimal [PITH_FULL_IMAGE:figures/full_fig_p062_4_2.png] view at source ↗

**Figure 4.3.** Figure 4.3: Performance comparison of all 6 algorithms. The EST approaches exhibit significantly faster convergence to the best result compared to the other methods. 5 out of 12 graphs due to Out-of-Memory errors. Among the graphs, R2000+C and R4000+C are the only two where VAN can find any feasible solution. When we record the time to find the feasible solution (R2000+C and R4000+C), while vanilla takes about 21,72… view at source ↗

**Figure 5.1.** Figure 5.1: The wizard is a software step-by-step guide to assist the user in performing correction actions without requiring extensive technical knowledge. This chapter contributions can be summarized as follows: • We introduce a new theoretical combinatorial optimization model called Adaptive Path Removal, motivated by the network security use case in AD systems. This is the first adaptive graph-focused model to … view at source ↗

**Figure 6.1.** Figure 6.1: Example of F-ACT instance. ⊥p means found a path of ON edges, ⊥c means found a cut of OFF edges. • We introduce a new theoretical combinatorial optimization model called Featurebased Adaptive Connectivity Test. This is the first adaptive AD-focused model that incorporates security-context features to model an IT admin decisionmaking process. • We prove that the F-ACT problem is #P-hard and develop RL4F… view at source ↗

**Figure 6.2.** Figure 6.2: Distribution of trajectory lengths comparing our Heuristic-Guided mechanism against Standard SAC across AD network graphs. 0 20 40 Trajectory Length 0.0 0.2 0.4 0.6 0.8 Density Heuristic-guided Standard SAC (a) AS1 0 20 40 60 80 100 Trajectory Length 0.0 0.1 0.2 0.3 0.4 Density Heuristic-guided Standard SAC (b) AS2 0 20 40 60 80 100 Trajectory Length 0.0 0.2 0.4 0.6 0.8 Density Heuristic-guided Standard… view at source ↗

**Figure 6.3.** Figure 6.3: Expected query cost versus self-improvement iterations for the RL4FT-I agent. The RL4FT-I agent outperforms the H1 reference policy from the very first iteration and keep improving their policy over iteration. 1 2 3 4 5 6 7 8 9 10 Self-improved Iteration 3.5 4.0 4.5 5.0 Expected Query Cost RL4FT-I(SAC) RL4FT-I(PPO) ¼ ref = H1 (a) AS1 1 2 3 4 5 6 7 8 Self-improved Iteration 4.5 5.0 5.5 6.0 Expected Query… view at source ↗

**Figure 6.4.** Figure 6.4: Expected query cost with different decision function linear, quad, rbf 6.7 Conclusion In this work, we introduced the F-ACT model, a novel security model motivated by practical challenges faced by security teams. The key novelty of our model is its ability to generalize a adaptive security policy from a few queries and modeling IT admin decisions as a function of an edge’s security features. We first pro… view at source ↗

discussion (0)

Reference graph

Works this paper leans on

25 extracted references · 5 linked inside Pith

[1]

Adalo Team (2025).Legacy System Security Vulnerabilities Stats – Critical Data Points Every IT Leader Should Know in

2025
[2]

Cyber maintenance policy optimization via adap- tive learning

IEEE, pp. 307–321. Tambe,Milind(2011).Security and game theory: algorithms, deployed systems, lessons learned. Cambridge university press. Tan, Yue and Cathy H Xia (2016). “Cyber maintenance policy optimization via adap- tive learning”. In:IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communications. IEEE, pp. 1–9. The MITRE ...

2011
[7]

Adaptive submodular maximization in bandit setting

Gabillon, Victor, Branislav Kveton, Zheng Wen, Brian Eriksson, and Shanmugave- layutham Muthukrishnan (2013). “Adaptive submodular maximization in bandit setting”. In:Advances in Neural Information Processing Systems26. Gan, Jiarui, Bo An, and Yevgeniy Vorobeychik (2015). “Security games with protec- tion externalities”. In:Proceedings of the AAAI Confere...

2013
[8]

Optimal surveillance of covert net- works by minimizing inverse geodesic length

Gaspers, Serge and Kamran Najeebullah (2019). “Optimal surveillance of covert net- works by minimizing inverse geodesic length”. In:Proceedings of the AAAI Con- ference on Artificial Intelligence. Vol

2019
[10]

Limited Query Graph Connectivity Test

AAAI Press, pp. 9360–9367. Guo, Mingyu, Jialiang Li, Aneta Neumann, Frank Neumann, and Hung Nguyen (2024). “Limited Query Graph Connectivity Test”. In:Proceedings of the AAAI Conference on Artificial Intelligence. Vol

2024
[11]

Coalitional security games

AAAI Press, pp. 14620–14628. Guo, Qingyu, Bo An, Yevgeniy Vorobeychik, Long Tran-Thanh, Jiarui Gan, and Chunyan Miao (2016a). “Coalitional security games”. In:Proceedings of the 2016 International Conference on Autonomous Agents & Multiagent Systems, pp. 159–

2016
[12]

A Formal Model for Credential Hopping Attacks

Albanese, Massimiliano, Karin L Johnsgard, and Vipin Swarup (2022). “A Formal Model for Credential Hopping Attacks”. In:European Symposium on Research in Computer Security. Springer, pp. 367–386. Allen, Sarah R, Lisa Hellerstein, Devorah Kletenik, and Tonguç Ünlüyurt (2017). “Evaluation of monotone DNF formulas”. In:Algorithmica77, pp. 661–685. Ammann, Pa...

2022
[15]

Ranking attack graphs

Tech. rep. 16th annual edition. Google Cloud.url: https : / / services . google . com / fh / files / misc / m - trends - 2025 - en . pdf (visited on 09/04/2025). Mar-Elia, Darren (2021).Organizations Increasing Investment in Active Directory Se- curity, Survey Shows. Semperis Blog.url:https://www.semperis.com/blog/ organizations- increasing- investment- a...

arXiv 2025
[20]

Hop-constrained st Simple Path Enumeration: Towards Bridging Theory and Practice

Baltimore, MD, pp. 113–128. Peng, You, Ying Zhang, Xuemin Lin, Wenjie Zhang, Lu Qin, and Jingren Zhou (2019). “Hop-constrained st Simple Path Enumeration: Towards Bridging Theory and Practice.” In:Proc. VLDB Endow.13.4, pp. 463–476. Phillips,CynthiaandLauraPaintonSwiler(1998).“Agraph-basedsystemfornetwork- vulnerability analysis”. In:Proceedings of the 19...

Pith/arXiv arXiv 2019
[24]

Jump- start reinforcement learning

1, pp. 881–886. Uchendu, Ikechukwu, Ted Xiao, Yao Lu, Banghua Zhu, Mengyuan Yan, Joséphine Si- mon, Matthew Bennice, Chuyuan Fu, Cong Ma, Jiantao Jiao, et al. (2023). “Jump- start reinforcement learning”. In:International Conference on Machine Learning. PMLR, pp. 34556–34583. 116Bibliography Ulrich,Tamara,JohannesBader,andEckartZitzler(2010).“Integratingd...

2023
[25]

Submodularity in data subset selec- tionandactivelearning

Wei, Kai, Rishabh Iyer, and Jeff Bilmes (2015). “Submodularity in data subset selec- tionandactivelearning”.In:International conference on machine learning.PMLR, pp. 1954–1963. Weng, Jiayi, Huayu Chen, Dong Yan, Kaichao You, Alexis Duburcq, Minghao Zhang, Yi Su, Hang Su, and Jun Zhu (2022). “Tianshou: A highly modularized deep reinforcement learning libra...

Pith/arXiv arXiv 2015
[26]

Urban security: Game-theoretic resource allocation in networked domains

1, pp. 1464–1470. Tsai, Jason, Zhengyu Yin, Jun-young Kwak, David Kempe, Christopher Kiekintveld, and Milind Tambe (2010). “Urban security: Game-theoretic resource allocation in networked domains”. In:Proceedings of the AAAI Conference on Artificial Intelli- gence. Vol

2010
[33]

Optimizing cyber defense in dynamic active directories through reinforcement learning

01, pp. 533–540. Goel, Diksha, Kristen Moore, Mingyu Guo, Derui Wang, Minjune Kim, and Seyit Camtepe (2024). “Optimizing cyber defense in dynamic active directories through reinforcement learning”. In:European Symposium on Research in Computer Secu- rity. Springer, pp. 332–352. 110Bibliography Goel, Diksha, Aneta Neumann, Frank Neumann, Hung Nguyen, and M...

2024
[34]

Self-improving reactive agents based on reinforcement learning, planning and teaching

02, pp. 2111–2118. Lin, Long-Ji (1992). “Self-improving reactive agents based on reinforcement learning, planning and teaching”. In:Machine learning8, pp. 293–321. Lukas, Ondrej and Sebastian Garcia (2021).Deep generative models to extend Active Directory graphs with honeypot users. arXiv:2109.06180 [cs.CR]. Mandiant (2025).M-Trends

Pith/arXiv arXiv 1992
[35]

Curriculum learning for multilevel bud- geted combinatorial problems

6, pp. 5603–5610. Nabli, Adel and Margarida Carvalho (2020). “Curriculum learning for multilevel bud- geted combinatorial problems”. In:Advances in Neural Information Processing Systems33, pp. 7044–7056. Ng, Andrew Y, Daishi Harada, and Stuart Russell (1999). “Policy invariance un- der reward transformations: Theory and application to reward shaping”. In:...

2020
[99]

Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys

Citeseer, pp. 278–287. Ngo, Huy, Mingyu Guo, and Hung Nguyen (2024a). “Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys”. In:Proceedings of the Genetic and Evolutionary Computation Conference, pp. 1309–1317. Ngo, Huy Q, Mingyu Guo, and Hung Nguyen (2023). “Near optimal strategies for hon- eypots placement in dynamic and la...

2023
[167]

Optimal interdiction of illegal network flow

Guo, Qingyu, Yair Zick, Chunyan Miao, and Bo An (2016b). “Optimal interdiction of illegal network flow”. In:IJCAI. Haarnoja,Tuomas,AurickZhou,PieterAbbeel,andSergeyLevine(2018).“Softactor- critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor”. In:International conference on machine learning. Pmlr, pp. 1861–1870. Hamed, Ha...

Pith/arXiv arXiv 2018
[345]

Radial basis functions

Buhmann, Martin Dietrich (2000). “Radial basis functions”. In:Acta numerica9, pp. 1–38. Christodoulou, Petros (2019). “Soft actor-critic for discrete action settings”. In:arXiv preprint arXiv:1910.07207. Conitzer, Vincent and Tuomas Sandholm (2006). “Computing the optimal strategy to commit to”. In:Proceedings of the 7th ACM conference on Electronic comme...

Pith/arXiv arXiv 2000
[608]

Optimal ids sensor placement and alert pri- oritization using attack graphs

Noel, Steven and Sushil Jajodia (2008). “Optimal ids sensor placement and alert pri- oritization using attack graphs”. In:Journal of Network and Systems Management 16.3, pp. 259–275. Ou, Xinming, Sudhakar Govindavajhala, Andrew W Appel, et al. (2005). “MulVAL: A logic-based network security analyzer.” In:USENIX security symposium. Vol

2008
[690]

Cybersecurity Data Sources for Dynamic Network Re- search

Kent, Alexander D. (2015). “Cybersecurity Data Sources for Dynamic Network Re- search”. In:Dynamic Networks in Cybersecurity. Imperial College Press. Khan, Arijit, Yuan Ye, and Lei Chen (2018).On uncertain graphs. Morgan & Claypool Publishers. Khouzani, MHR, Zhengliang Liu, and Pasquale Malacaria (2019). “Scalable min-max multi-objective cyber-security op...

2015
[1750]

Robust curriculum learning: from clean label detection to noisy label self-correction

Zhou, Tianyi, Shengjie Wang, and Jeff Bilmes (2020). “Robust curriculum learning: from clean label detection to noisy label self-correction”. In:International confer- ence on learning representations. Zhou, Tianyi, Shengjie Wang, and Jeff Bilmes (2021). “Curriculum learning by opti- mizing learning dynamics”. In:International Conference on Artificial Inte...

2020
[2022]

Harnessing the power of deception in attack graph-based security games

Tech. rep. Microsoft Cor- poration.url:https : / / query . prod . cms . rt . microsoft . com / cms / api / am / binary/RE54L3X. Microsoft (2023).Microsoft Digital Defense Report.https://www.microsoft.com/ en/security/security-insider/microsoft-digital-defense-report-2023/. Microsoft (2024a).Best Practice Guide for Securing Active Directory Installations. ...

2023
[2025]

To delay or not: temporal vaccinationgamesonnetworks

Adalo Blog. Updated August 25, 2025; accessed August 27, 2025.url:https : / / www . adalo . com / posts / b2b - legacy-system-security-vulnerabilities-stats. Adiga, Abhijin, Srini Venkat, and Anil Vullikanti (2016). “To delay or not: temporal vaccinationgamesonnetworks”.In:IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communi...

2025
[3252]

Beyond adaptive submodularity: Approxi- mation guarantees of greedy policy with adaptive submodularity ratio

Fujii, Kaito and Shinsaku Sakaue (2019). “Beyond adaptive submodularity: Approxi- mation guarantees of greedy policy with adaptive submodularity ratio”. In:Inter- national conference on machine learning. PMLR, pp. 2042–2051. Gabillon, Victor, Branislav Kveton, Zheng Wen, Brian Eriksson, and S Muthukrishnan (2014). “Large-scale optimistic adaptive submodul...

2019
[5142]

Resource-Limited Network Security Games with General Contagious Attacks

Bai, Rufan, Chao Xu, Chenyang Xu, and Ruilong Zhang (2024). “Resource-Limited Network Security Games with General Contagious Attacks”. In:International Computing and Combinatorics Conference. Springer, pp. 79–91. Ball, Michael O (1986). “Computational complexity of network reliability analysis: An overview”. In:Ieee transactions on reliability35.3, pp. 23...

2024

[1] [1]

Adalo Team (2025).Legacy System Security Vulnerabilities Stats – Critical Data Points Every IT Leader Should Know in

2025

[2] [2]

Cyber maintenance policy optimization via adap- tive learning

IEEE, pp. 307–321. Tambe,Milind(2011).Security and game theory: algorithms, deployed systems, lessons learned. Cambridge university press. Tan, Yue and Cathy H Xia (2016). “Cyber maintenance policy optimization via adap- tive learning”. In:IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communications. IEEE, pp. 1–9. The MITRE ...

2011

[3] [7]

Adaptive submodular maximization in bandit setting

Gabillon, Victor, Branislav Kveton, Zheng Wen, Brian Eriksson, and Shanmugave- layutham Muthukrishnan (2013). “Adaptive submodular maximization in bandit setting”. In:Advances in Neural Information Processing Systems26. Gan, Jiarui, Bo An, and Yevgeniy Vorobeychik (2015). “Security games with protec- tion externalities”. In:Proceedings of the AAAI Confere...

2013

[4] [8]

Optimal surveillance of covert net- works by minimizing inverse geodesic length

Gaspers, Serge and Kamran Najeebullah (2019). “Optimal surveillance of covert net- works by minimizing inverse geodesic length”. In:Proceedings of the AAAI Con- ference on Artificial Intelligence. Vol

2019

[5] [10]

Limited Query Graph Connectivity Test

AAAI Press, pp. 9360–9367. Guo, Mingyu, Jialiang Li, Aneta Neumann, Frank Neumann, and Hung Nguyen (2024). “Limited Query Graph Connectivity Test”. In:Proceedings of the AAAI Conference on Artificial Intelligence. Vol

2024

[6] [11]

Coalitional security games

AAAI Press, pp. 14620–14628. Guo, Qingyu, Bo An, Yevgeniy Vorobeychik, Long Tran-Thanh, Jiarui Gan, and Chunyan Miao (2016a). “Coalitional security games”. In:Proceedings of the 2016 International Conference on Autonomous Agents & Multiagent Systems, pp. 159–

2016

[7] [12]

A Formal Model for Credential Hopping Attacks

Albanese, Massimiliano, Karin L Johnsgard, and Vipin Swarup (2022). “A Formal Model for Credential Hopping Attacks”. In:European Symposium on Research in Computer Security. Springer, pp. 367–386. Allen, Sarah R, Lisa Hellerstein, Devorah Kletenik, and Tonguç Ünlüyurt (2017). “Evaluation of monotone DNF formulas”. In:Algorithmica77, pp. 661–685. Ammann, Pa...

2022

[8] [15]

Ranking attack graphs

Tech. rep. 16th annual edition. Google Cloud.url: https : / / services . google . com / fh / files / misc / m - trends - 2025 - en . pdf (visited on 09/04/2025). Mar-Elia, Darren (2021).Organizations Increasing Investment in Active Directory Se- curity, Survey Shows. Semperis Blog.url:https://www.semperis.com/blog/ organizations- increasing- investment- a...

arXiv 2025

[9] [20]

Hop-constrained st Simple Path Enumeration: Towards Bridging Theory and Practice

Baltimore, MD, pp. 113–128. Peng, You, Ying Zhang, Xuemin Lin, Wenjie Zhang, Lu Qin, and Jingren Zhou (2019). “Hop-constrained st Simple Path Enumeration: Towards Bridging Theory and Practice.” In:Proc. VLDB Endow.13.4, pp. 463–476. Phillips,CynthiaandLauraPaintonSwiler(1998).“Agraph-basedsystemfornetwork- vulnerability analysis”. In:Proceedings of the 19...

Pith/arXiv arXiv 2019

[10] [24]

Jump- start reinforcement learning

1, pp. 881–886. Uchendu, Ikechukwu, Ted Xiao, Yao Lu, Banghua Zhu, Mengyuan Yan, Joséphine Si- mon, Matthew Bennice, Chuyuan Fu, Cong Ma, Jiantao Jiao, et al. (2023). “Jump- start reinforcement learning”. In:International Conference on Machine Learning. PMLR, pp. 34556–34583. 116Bibliography Ulrich,Tamara,JohannesBader,andEckartZitzler(2010).“Integratingd...

2023

[11] [25]

Submodularity in data subset selec- tionandactivelearning

Wei, Kai, Rishabh Iyer, and Jeff Bilmes (2015). “Submodularity in data subset selec- tionandactivelearning”.In:International conference on machine learning.PMLR, pp. 1954–1963. Weng, Jiayi, Huayu Chen, Dong Yan, Kaichao You, Alexis Duburcq, Minghao Zhang, Yi Su, Hang Su, and Jun Zhu (2022). “Tianshou: A highly modularized deep reinforcement learning libra...

Pith/arXiv arXiv 2015

[12] [26]

Urban security: Game-theoretic resource allocation in networked domains

1, pp. 1464–1470. Tsai, Jason, Zhengyu Yin, Jun-young Kwak, David Kempe, Christopher Kiekintveld, and Milind Tambe (2010). “Urban security: Game-theoretic resource allocation in networked domains”. In:Proceedings of the AAAI Conference on Artificial Intelli- gence. Vol

2010

[13] [33]

Optimizing cyber defense in dynamic active directories through reinforcement learning

01, pp. 533–540. Goel, Diksha, Kristen Moore, Mingyu Guo, Derui Wang, Minjune Kim, and Seyit Camtepe (2024). “Optimizing cyber defense in dynamic active directories through reinforcement learning”. In:European Symposium on Research in Computer Secu- rity. Springer, pp. 332–352. 110Bibliography Goel, Diksha, Aneta Neumann, Frank Neumann, Hung Nguyen, and M...

2024

[14] [34]

Self-improving reactive agents based on reinforcement learning, planning and teaching

02, pp. 2111–2118. Lin, Long-Ji (1992). “Self-improving reactive agents based on reinforcement learning, planning and teaching”. In:Machine learning8, pp. 293–321. Lukas, Ondrej and Sebastian Garcia (2021).Deep generative models to extend Active Directory graphs with honeypot users. arXiv:2109.06180 [cs.CR]. Mandiant (2025).M-Trends

Pith/arXiv arXiv 1992

[15] [35]

Curriculum learning for multilevel bud- geted combinatorial problems

6, pp. 5603–5610. Nabli, Adel and Margarida Carvalho (2020). “Curriculum learning for multilevel bud- geted combinatorial problems”. In:Advances in Neural Information Processing Systems33, pp. 7044–7056. Ng, Andrew Y, Daishi Harada, and Stuart Russell (1999). “Policy invariance un- der reward transformations: Theory and application to reward shaping”. In:...

2020

[16] [99]

Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys

Citeseer, pp. 278–287. Ngo, Huy, Mingyu Guo, and Hung Nguyen (2024a). “Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys”. In:Proceedings of the Genetic and Evolutionary Computation Conference, pp. 1309–1317. Ngo, Huy Q, Mingyu Guo, and Hung Nguyen (2023). “Near optimal strategies for hon- eypots placement in dynamic and la...

2023

[17] [167]

Optimal interdiction of illegal network flow

Guo, Qingyu, Yair Zick, Chunyan Miao, and Bo An (2016b). “Optimal interdiction of illegal network flow”. In:IJCAI. Haarnoja,Tuomas,AurickZhou,PieterAbbeel,andSergeyLevine(2018).“Softactor- critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor”. In:International conference on machine learning. Pmlr, pp. 1861–1870. Hamed, Ha...

Pith/arXiv arXiv 2018

[18] [345]

Radial basis functions

Buhmann, Martin Dietrich (2000). “Radial basis functions”. In:Acta numerica9, pp. 1–38. Christodoulou, Petros (2019). “Soft actor-critic for discrete action settings”. In:arXiv preprint arXiv:1910.07207. Conitzer, Vincent and Tuomas Sandholm (2006). “Computing the optimal strategy to commit to”. In:Proceedings of the 7th ACM conference on Electronic comme...

Pith/arXiv arXiv 2000

[19] [608]

Optimal ids sensor placement and alert pri- oritization using attack graphs

Noel, Steven and Sushil Jajodia (2008). “Optimal ids sensor placement and alert pri- oritization using attack graphs”. In:Journal of Network and Systems Management 16.3, pp. 259–275. Ou, Xinming, Sudhakar Govindavajhala, Andrew W Appel, et al. (2005). “MulVAL: A logic-based network security analyzer.” In:USENIX security symposium. Vol

2008

[20] [690]

Cybersecurity Data Sources for Dynamic Network Re- search

Kent, Alexander D. (2015). “Cybersecurity Data Sources for Dynamic Network Re- search”. In:Dynamic Networks in Cybersecurity. Imperial College Press. Khan, Arijit, Yuan Ye, and Lei Chen (2018).On uncertain graphs. Morgan & Claypool Publishers. Khouzani, MHR, Zhengliang Liu, and Pasquale Malacaria (2019). “Scalable min-max multi-objective cyber-security op...

2015

[21] [1750]

Robust curriculum learning: from clean label detection to noisy label self-correction

Zhou, Tianyi, Shengjie Wang, and Jeff Bilmes (2020). “Robust curriculum learning: from clean label detection to noisy label self-correction”. In:International confer- ence on learning representations. Zhou, Tianyi, Shengjie Wang, and Jeff Bilmes (2021). “Curriculum learning by opti- mizing learning dynamics”. In:International Conference on Artificial Inte...

2020

[22] [2022]

Harnessing the power of deception in attack graph-based security games

Tech. rep. Microsoft Cor- poration.url:https : / / query . prod . cms . rt . microsoft . com / cms / api / am / binary/RE54L3X. Microsoft (2023).Microsoft Digital Defense Report.https://www.microsoft.com/ en/security/security-insider/microsoft-digital-defense-report-2023/. Microsoft (2024a).Best Practice Guide for Securing Active Directory Installations. ...

2023

[23] [2025]

To delay or not: temporal vaccinationgamesonnetworks

Adalo Blog. Updated August 25, 2025; accessed August 27, 2025.url:https : / / www . adalo . com / posts / b2b - legacy-system-security-vulnerabilities-stats. Adiga, Abhijin, Srini Venkat, and Anil Vullikanti (2016). “To delay or not: temporal vaccinationgamesonnetworks”.In:IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communi...

2025

[24] [3252]

Beyond adaptive submodularity: Approxi- mation guarantees of greedy policy with adaptive submodularity ratio

Fujii, Kaito and Shinsaku Sakaue (2019). “Beyond adaptive submodularity: Approxi- mation guarantees of greedy policy with adaptive submodularity ratio”. In:Inter- national conference on machine learning. PMLR, pp. 2042–2051. Gabillon, Victor, Branislav Kveton, Zheng Wen, Brian Eriksson, and S Muthukrishnan (2014). “Large-scale optimistic adaptive submodul...

2019

[25] [5142]

Resource-Limited Network Security Games with General Contagious Attacks

Bai, Rufan, Chao Xu, Chenyang Xu, and Ruilong Zhang (2024). “Resource-Limited Network Security Games with General Contagious Attacks”. In:International Computing and Combinatorics Conference. Springer, pp. 79–91. Ball, Michael O (1986). “Computational complexity of network reliability analysis: An overview”. In:Ieee transactions on reliability35.3, pp. 23...

2024