Characterizing anti-forensic attackers in cybersecurity domains with Stackelberg planning

The rapid advancement of artificial intelligence has enabled large-scale, automated cyberattacks capable of targeting critical infrastructure with unprecedented speed. Since a perfect defense is often unattainable in complex networks, defenders must strategically force attackers into either objective failure or leaving a detectable footprint. This research addresses this defensive gap by applying Automated Planning to model a self-cleaning adversary within a state-based environment. Utilizing a Stackelberg planning framework, our methodology simulates a game-theoretic dynamic where a defender proactively modifies the environment and the attacker computes an optimal intrusion path in response. This adversarial interaction is evaluated across a simulated, segmented network, ultimately enabling the formal verification of security invariants and providing a framework to strengthen both network architecture and forensic audit trails.

Name thesis:degree_name

Master of Science (M.S.)

Level thesis:degree_level

Masters

Discipline thesis:degree_discipline

Computer Science

Grantor dc:publisher

Colorado State University. Libraries

Year dc:date.issued

2026

Authors dc:creator

• Curcio, Jason, author
• Sreedharan, Sarath, advisor
• Ray, Indrajit, committee member
• Daily, Jeremy, committee member

• forensics
• Stackelberg
• planning
• cybersecurity

Statement dc:rights

• Copyright and other restrictions may apply. User is responsible for compliance with all applicable laws. For information about copyright law, please see https://libguides.colostate.edu/copyright.

Language dc:language.iso

eng, English

Identifier URI

https://doi.org/10.25675/3.027160

OAI identifier oai:identifier

oai:mountainscholar.org:10217/244800