Characterizing anti-forensic attackers in cybersecurity domains with Stackelberg planning
type: CreativeWork
description: The rapid advancement of artificial intelligence has enabled large-scale, automated cyberattacks capable of targeting critical infrastructure with unprecedented speed. Since a perfect defense is often unattainable in complex networks, defenders must strategically force attackers into either objective failure or leaving a detectable footprint. This research addresses this defensive gap by applying Automated Planning to model a self-cleaning adversary within a state-based environment. Utilizing a Stackelberg planning framework, our methodology simulates a game-theoretic dynamic where a defender proactively modifies the environment and the attacker computes an optimal intrusion path in response. This adversarial interaction is evaluated across a simulated, segmented network, ultimately enabling the formal verification of security invariants and providing a framework to strengthen both network architecture and forensic audit trails.
abstract: The rapid advancement of artificial intelligence has enabled large-scale, automated cyberattacks capable of targeting critical infrastructure with unprecedented speed. Since a perfect defense is often unattainable in complex networks, defenders must strategically force attackers into either objective failure or leaving a detectable footprint. This research addresses this defensive gap by applying Automated Planning to model a self-cleaning adversary within a state-based environment. Utilizing a Stackelberg planning framework, our methodology simulates a game-theoretic dynamic where a defender proactively modifies the environment and the attacker computes an optimal intrusion path in response. This adversarial interaction is evaluated across a simulated, segmented network, ultimately enabling the formal verification of security invariants and providing a framework to strengthen both network architecture and forensic audit trails.
author: Curcio, Jason, author
author: Sreedharan, Sarath, advisor
author: Ray, Indrajit, committee member
author: Daily, Jeremy, committee member
language: eng
language: English
keywords: forensics, Stackelberg, planning, cybersecurity
date published: 2026
date modified: 2026-07-27T19:13:00Z
provider: Colorado State University
publisher: Networked Digital Library of Theses and Dissertations
type: WebPage
source organization: Colorado State University. Libraries

PropertyValue
property ID: Handle
value: https://hdl.handle.net/10217/244800

PropertyValue
property ID: DOI
value: 10.25675/3.027160