cs.CRApr 12, 2026

A Queueing-Theoretic Framework for Dynamic Attack Surfaces: Data-Integrated Risk Analysis and Adaptive Defense

Authors: Jihyeon Yun, Abdullah Yasin Etcibasi, Ming Shi, C. Emre Koksal

Organizations: University at Buffalo (SUNY), USA.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

We develop a queueing-theoretic framework to model the temporal evolution of cyber-attack surfaces, where the number of active vulnerabilities is represented as the backlog of a queue. Vulnerabilities arrive as they are discovered or created, and leave the system when they are patched or successfully exploited. Building on this model, we study how automation affects attack and defense dynamics by introducing an AI amplification factor that scales arrival, exploit, and patching rates. Our analysis shows that even symmetric automation can increase the rate of successful exploits. We validate the model using vulnerability data collected from an open source software supply chain and show that it closely matches real-world attack surface dynamics. Empirical results reveal heavy-tailed patching times, which we prove induce long-range dependence in vulnerability backlog and help explain persistent cyber risk. Utilizing our queueing abstraction for the attack surface, we develop a systematic approach for cyber risk mitigation. We formulate the dynamic defense problem as a constrained Markov decision process with resource-budget and switching-cost constraints, and develop a reinforcement learning (RL) algorithm that achieves provably near-optimal regret. Numerical experiments validate the approach and demonstrate that our adaptive RL-based defense policies significantly reduce successful exploits and mitigate heavy-tail queue events. Using trace-driven experiments on the ARVO dataset, we show that the proposed RL-based defense policy reduces the average number of active vulnerabilities in a software supply chain by over 90% compared to existing defense practices, without increasing the overall maintenance budget. Our results allow defenders to quantify cumulative exposure risk under long-range dependent attack dynamics and to design adaptive defense strategies with provable efficiency.

Figures & tables

Fig. 1: Attack surface modeled as a queueing system. Vulnerabilities arrive via V(t)V(t) and depart through competing defense (patching) and exploit processes.
Fig. 2: Steady-state distribution of the normalized attack surface size under different defense rates. Lower defense rates shift the distribution toward larger attack surfaces, increasing exposure risk. The surface size is normalized to the range [0,100]%[0,100]\% for visualization.
Fig. 3: Steady-state distribution of the normalized attack surface size under different AI usage scenarios. Symmetric AI scaling leaves the distribution unchanged, whereas AI applied only on the attack side (no AI on defense) shifts the distribution toward larger attack surfaces, increasing exposure risk.
Fig. 4: Temporal evolution of the attack surface size, N(t)N(t) , in the ARVO dataset, showing bursty discovery, delayed patching, and non-stationary behavior.
Fig. 5: KL divergence versus the number of Gaussian mixture components. Fit quality improves rapidly up to about ten components, after which additional components yield diminishing returns.
Fig. 6: IA and ST distributions for Component 1 (weeks 0–64). Loglogistic-general Pareto fits IA (KL ≈\approx 0.77); Gamma–InverseGaussian fits ST (KL ≈\approx 0.42).
Fig. 7: Final integrated model: empirical QLD compared with segmented, bootstrap, and 10-component GMM fits. In the segmented G/G/mG/G/m – bb model, bb denotes the mean available defensive resource rather than the maximum capacity used in the global formulation.
Fig. 8: Successful exploit rate vs. per-step defense budget (patches per unit time) under stochastic arrivals.
Fig. 9: Successful exploit rate vs. per-step defense budget (patches per unit time) under adversarial arrivals.
Fig. 10: Trace-driven comparison of queue-length probability densities on the ARVO dataset (RL vs. baseline) for per-step budget b=1.0b=1.0 patches per unit time.
Fig. 11: Queue-length histogram under the empirical aggregate baseline budget and the RL-reallocated policy. Statistics are reported in the text.
Policy / Budget (patches per unit time)MeanVariance
Baseline (data)219.930,930
RL (b=0.5)59.41,602
RL (b=1.0)13.0219
RL (b=1.5)4.756
RL (b=2.0)1.26
RL (b=2.5)0.10.4
TABLE I: Trace-driven comparison statistics: queue-length mean & variance (ARVO, RL vs. baseline).
More in this topic

Long-Range Dependency Modeling

See all 27 papers

Explore similar work

CardsList
Apr 20, 2026

Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining

While attack graphs are useful for identifying major cybersecurity threats affecting a system, they do not provide operational support for determining the likelihood of having a known vulnerability exploited, or that critical system nodes are likely to be compromised. In this paper, we perform dynamic risk assessment by combining Bayesian Attack Graphs (BAGs) and online monitoring of system behavior through process mining. Specifically, the proposed approach applies process mining techniques to characterize malicious network traffic and derive evidence regarding the probability of having a vulnerability actively exploited. This evidence is then provided to a BAG, which updates its conditional probability tables accordingly, enabling dynamic assessment of vulnerability exploitation. We apply our method to a cybersecurity testbed instantiating several machines deployed on different subnets and affected by several CVE vulnerabilities. The testbed is stimulated with both benign traffic and malicious behavior, which simulates network attack patterns aimed at exploiting the CVE vulnerabilities. The results indicate that our proposal effectively detects whether vulnerabilities are being actively exploited, allowing for an updated assessment of the probability of system compromise.

Francesco Vitale, Simone Guarino, Stefano Perone +2

DIETI, University of Naples Federico II, Naples, Italy · Department of Engineering, University Campus Bio-Medico of Rome, Rome, Italy

Process MiningCybersecurity
AskPDF
Aug 12, 2026

Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation

With the increasing complexity of cyber assaults in cloud environments, adaptable security solutions are needed that can support real-time detection and autonomous response. In this paper, we propose a reinforcement learning-based dynamic cyber defense framework. We deploy a Deep Q-Network (DQN) to train effective defensive strategies to counteract the evolving cyberattacks. We leverage the CICIDS2017 dataset for model creation and the UNSW-NB15 dataset for external validation, involving preprocessing of data, feature engineering, and adaptive policy learning. We compare the proposed DQN with decision tree, support vector machine, random forest, XGBoost, and multilayer perceptron models. The proposed DQN achieves an accuracy of 99.72%, a precision of 99.68%, a recall of 99.65%, an F1-score of 99.66%, and an ROC-AUC of 0.999, while the false positive rate is 0.31%, the false negative rate is 0.35%, and the detection latency is 15 ms. The framework achieved 99.54% attack mitigation rate, demonstrating strong adaptive and real-time defensive capabilities. These results demonstrate the potential of reinforcement learning as a powerful and scalable approach for autonomous cybersecurity in modern cloud environments.

Md Yassir Mottalib, Md Yousuf, Eklachur Rahman Bhuiyan +5

Master of Science in Information System Technology, Wilmington University, USA · Master's of Science in Data Analytics, College of Sciences and Technology, University of Houston- Downtown, USA · Master of Science in Information Technology, Washington University of Science and Technology, USA +4

Autonomous Cyber DefenseDeep Q-LearningNetwork Intrusion DetectionCybersecurity
AskPDF
Oct 7, 2026

Defensive Sufficiency in a Stackelberg Model of AI Security

Feedback from automated testing, human red teaming, and incident response can strengthen an AI system's defenses when discovered failures lead to effective repairs. We study when this feedback process provides sufficient protection and when investing in it is economically worthwhile. We begin by showing that an attack surface composed of finite number of inputs is defended with probability 1 if every unresolved attack has a persistent chance of discovery, repairs are effective, and subsequent updates preserve earlier protection. We derive completion-time bounds and extend the analysis to growing attack surfaces, repairs that generalize across related attacks, and multiple discovery mechanisms. These results distinguish eventual protection against each fixed attack from complete protection at a single time. We then formulate a defender-led Stackelberg game in which the defender invests in proactive discovery and reactive repair, anticipating the attacker's choice of search effort. We characterize the least-cost allocation that deters attack and the equilibrium regimes in which the defender funds neither capability, one capability, or both. Numerical experiments illustrate these regimes and show how faster repair can reduce compromise duration without reducing compromise probability.

Subhabrata Majumdar, Rajlakshmi Chavan

Indian Institute of Management Bangalore

CybersecurityStackelberg Games
AskPDF