cs.CRApr 12, 2026

A Queueing-Theoretic Framework for Dynamic Attack Surfaces: Data-Integrated Risk Analysis and Adaptive Defense

Authors: Jihyeon Yun, Abdullah Yasin Etcibasi, Ming Shi, C. Emre Koksal

Organizations: University at Buffalo (SUNY), USA.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

We develop a queueing-theoretic framework to model the temporal evolution of cyber-attack surfaces, where the number of active vulnerabilities is represented as the backlog of a queue. Vulnerabilities arrive as they are discovered or created, and leave the system when they are patched or successfully exploited. Building on this model, we study how automation affects attack and defense dynamics by introducing an AI amplification factor that scales arrival, exploit, and patching rates. Our analysis shows that even symmetric automation can increase the rate of successful exploits. We validate the model using vulnerability data collected from an open source software supply chain and show that it closely matches real-world attack surface dynamics. Empirical results reveal heavy-tailed patching times, which we prove induce long-range dependence in vulnerability backlog and help explain persistent cyber risk. Utilizing our queueing abstraction for the attack surface, we develop a systematic approach for cyber risk mitigation. We formulate the dynamic defense problem as a constrained Markov decision process with resource-budget and switching-cost constraints, and develop a reinforcement learning (RL) algorithm that achieves provably near-optimal regret. Numerical experiments validate the approach and demonstrate that our adaptive RL-based defense policies significantly reduce successful exploits and mitigate heavy-tail queue events. Using trace-driven experiments on the ARVO dataset, we show that the proposed RL-based defense policy reduces the average number of active vulnerabilities in a software supply chain by over 90% compared to existing defense practices, without increasing the overall maintenance budget. Our results allow defenders to quantify cumulative exposure risk under long-range dependent attack dynamics and to design adaptive defense strategies with provable efficiency.

Figures & tables

Fig. 1: Attack surface modeled as a queueing system. Vulnerabilities arrive via V(t)V(t) and depart through competing defense (patching) and exploit processes.
Fig. 2: Steady-state distribution of the normalized attack surface size under different defense rates. Lower defense rates shift the distribution toward larger attack surfaces, increasing exposure risk. The surface size is normalized to the range [0,100]%[0,100]\% for visualization.
Fig. 3: Steady-state distribution of the normalized attack surface size under different AI usage scenarios. Symmetric AI scaling leaves the distribution unchanged, whereas AI applied only on the attack side (no AI on defense) shifts the distribution toward larger attack surfaces, increasing exposure risk.
Fig. 4: Temporal evolution of the attack surface size, N(t)N(t) , in the ARVO dataset, showing bursty discovery, delayed patching, and non-stationary behavior.
Fig. 5: KL divergence versus the number of Gaussian mixture components. Fit quality improves rapidly up to about ten components, after which additional components yield diminishing returns.
Fig. 6: IA and ST distributions for Component 1 (weeks 0–64). Loglogistic-general Pareto fits IA (KL ≈\approx 0.77); Gamma–InverseGaussian fits ST (KL ≈\approx 0.42).
Fig. 7: Final integrated model: empirical QLD compared with segmented, bootstrap, and 10-component GMM fits. In the segmented G/G/mG/G/m – bb model, bb denotes the mean available defensive resource rather than the maximum capacity used in the global formulation.
Fig. 8: Successful exploit rate vs. per-step defense budget (patches per unit time) under stochastic arrivals.
Fig. 9: Successful exploit rate vs. per-step defense budget (patches per unit time) under adversarial arrivals.
Fig. 10: Trace-driven comparison of queue-length probability densities on the ARVO dataset (RL vs. baseline) for per-step budget b=1.0b=1.0 patches per unit time.
Fig. 11: Queue-length histogram under the empirical aggregate baseline budget and the RL-reallocated policy. Statistics are reported in the text.
Policy / Budget (patches per unit time)MeanVariance
Baseline (data)219.930,930
RL (b=0.5)59.41,602
RL (b=1.0)13.0219
RL (b=1.5)4.756
RL (b=2.0)1.26
RL (b=2.5)0.10.4
TABLE I: Trace-driven comparison statistics: queue-length mean & variance (ARVO, RL vs. baseline).
More in this topic

Long-Range Dependency Modeling

See all 27 papers

Explore similar work

CardsList

  1. Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining

    Apr 20, 2026Francesco Vitale, Simone Guarino, Stefano Perone +2Process MiningCybersecurity

    DIETI, University of Naples Federico II, Naples, Italy · Department of Engineering, University Campus Bio-Medico of Rome, Rome, Italy

  2. Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation

    Aug 12, 2026Md Yassir Mottalib, Md Yousuf, Eklachur Rahman Bhuiyan +5Autonomous Cyber DefenseDeep Q-Learning

    Master of Science in Information System Technology, Wilmington University, USA · Master's of Science in Data Analytics, College of Sciences and Technology, University of Houston- Downtown, USA · Master of Science in Information Technology, Washington University of Science and Technology, USA +4

  3. Defensive Sufficiency in a Stackelberg Model of AI Security

    Oct 7, 2026Subhabrata Majumdar, Rajlakshmi ChavanCybersecurityStackelberg Games

    Indian Institute of Management Bangalore