标题： CyGATE：用于补丁策略优化的博弈论网络攻击防御引擎 显示英文标题

标题： CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization

摘要： 现代网络攻击通过多个阶段展开，要求防御者在不确定性下动态优先处理缓解措施。 虽然博弈论模型能够捕捉攻击者与防御者的互动，但现有方法通常依赖静态假设，并缺乏与实时威胁情报的整合，限制了其适应性。 本文提出了CyGATE，这是一个博弈论框架，通过大型语言模型（LLMs）结合检索增强生成（RAG）来建模攻击者与防御者的互动，以增强战术选择和补丁优先级排序。 应用于双智能体场景，CyGATE将网络冲突建模为跨网络杀伤链阶段的部分可观测随机游戏（POSG）。 两个智能体都使用信念状态来应对不确定性，攻击者根据不断变化的风险和观察到的对手行为调整战术，防御者重新优先处理补丁。 该框架的灵活架构可扩展至涉及协作攻击者、协作防御者或包含多个利益相关者的复杂企业环境的多智能体场景。 在动态补丁调度场景中评估，CyGATE有效优先处理高风险漏洞，通过动态威胁整合提高适应性，在不确定性下通过预判攻击者行动实现战略远见，并通过优化资源使用提高效率。 显示英文摘要

摘要： Modern cyber attacks unfold through multiple stages, requiring defenders to dynamically prioritize mitigations under uncertainty. While game-theoretic models capture attacker-defender interactions, existing approaches often rely on static assumptions and lack integration with real-time threat intelligence, limiting their adaptability. This paper presents CyGATE, a game-theoretic framework modeling attacker-defender interactions, using large language models (LLMs) with retrieval-augmented generation (RAG) to enhance tactic selection and patch prioritization. Applied to a two-agent scenario, CyGATE frames cyber conflicts as a partially observable stochastic game (POSG) across Cyber Kill Chain stages. Both agents use belief states to navigate uncertainty, with the attacker adapting tactics and the defender re-prioritizing patches based on evolving risks and observed adversary behavior. The framework's flexible architecture enables extension to multi-agent scenarios involving coordinated attackers, collaborative defenders, or complex enterprise environments with multiple stakeholders. Evaluated in a dynamic patch scheduling scenario, CyGATE effectively prioritizes high-risk vulnerabilities, enhancing adaptability through dynamic threat integration, strategic foresight by anticipating attacker moves under uncertainty, and efficiency by optimizing resource use.