🧬 biology

A Two-Population Delayed Evolutionary Game with Bayesian Learning for Cyber Defense

This paper proposes a two-population delayed evolutionary game model incorporating Bayesian learning to analyze how detection and remediation delays, sensor coverage, and learning speeds interact to induce Hopf bifurcations and recurrent cyber-attack cycles, with empirical calibration on Microsoft's GUIDE dataset demonstrating that pooled telemetry and moderate remediation lags can significantly extend the admissible detection delay threshold.

Original authors: Sina Keyhanian

Published 2026-10-16

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Sina Keyhanian

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ⚕️ This is an AI-generated explanation of a preprint that has not been peer-reviewed. It is not medical advice. Do not make health decisions based on this content. Read full disclaimer

In the high-stakes world of cybersecurity, time is the most valuable currency, yet it is also the most elusive. Defenders operate under a constant pressure to detect intrusions and respond before damage is done, but the reality of modern cyberattacks is defined by a frustrating lag. Attackers, often working as sophisticated, persistent groups, can hide inside a network for months, moving slowly and quietly. Meanwhile, the defenders' own systems are often clogged with false alarms and overwhelmed by the sheer volume of data they must sift through. This creates a dangerous gap between when an attack happens and when the defenders finally understand what is going on and can act to stop it. For decades, computer scientists have tried to model this cat-and-mouse game using mathematics, but many of these models assumed that both sides could react instantly, as if time did not exist. This assumption ignored the messy, slow reality of how information actually travels through a security team and how attackers adapt their tactics over days or weeks.

A new study by Sina Keyhanian challenges this simplified view by building a more realistic model of the cyber conflict. Instead of assuming instant reactions, the research treats the battle as a slow-moving evolutionary struggle between two populations: the defenders, who must decide whether to actively hunt for threats or passively monitor their systems, and the attackers, who choose between aggressive, fast-moving tactics or stealthy, slow-burning ones. The core of the model focuses on the delay in information. Defenders do not see the attackers directly; they only see a stream of alerts that arrive late and are often noisy. To make sense of this, the defenders use a mathematical filter, a kind of smart averaging process, to guess what the attackers are doing. The study introduces two specific types of delays into this system: the time it takes to detect an intrusion and the time it takes to fix the problem once it is found. By running complex simulations that account for these lags, the researchers discovered that the system behaves very differently than previously thought.

The most significant finding is that there is a precise tipping point for how long a defender can afford to wait before their response becomes unstable. If the delay in detecting an attack stays below a certain limit, the defenders and attackers settle into a predictable balance. However, once the delay crosses that threshold, the system does not just get slightly worse; it begins to oscillate wildly. The defenders, reacting to outdated information, overcommit to aggressive hunting, which clogs their own systems with false alarms and fatigue. This forces them to pull back, leaving the network vulnerable just as the attackers, seeing the slack, launch a new wave of aggression. This cycle repeats, creating a recurring pattern of breaches and frantic responses that never quite resolves. The research proves that this instability is not a random glitch but a mathematical certainty that occurs when the time lag becomes too long relative to how fast the defenders can learn.

Crucially, the study shows that simply trying to detect attacks faster is not always enough to save the day. The researchers found that if the attackers are highly adaptable and the defenders are slow to learn from the data, no amount of speed in detection can prevent the system from collapsing into chaos. There is a minimum speed at which defenders must be able to process information and update their beliefs about the enemy. If they fall below this speed, the defense is doomed to fail regardless of how quickly they spot the initial breach. This suggests that investing in better sensors or faster alert systems is only half the battle; the ability to learn and adapt quickly is equally critical. The model also reveals a surprising interaction between the two types of delays. While one might assume that having a delay in detection and a delay in fixing the problem would simply add up to make things worse, the study shows that a moderate delay in fixing the problem can actually help stabilize the system, allowing for a slightly longer detection delay without causing a collapse.

To ensure these findings were not just theoretical, the researchers tested their model against real-world data. They analyzed over 300,000 security incidents from a large dataset provided by Microsoft, which included records of how analysts triaged and graded alerts. They also examined logs from IT service desks to understand how long it actually takes to resolve issues. The data confirmed that a single organization learns about attacker behavior at a rate of about 0.07 times per day, meaning it takes roughly two weeks to fully adjust its strategy. However, when multiple organizations share their data, this learning speed jumps to about three times per day, a massive improvement that significantly extends the time defenders can tolerate before their system becomes unstable. Despite this improvement, the study found that even with shared data, the typical time it takes for an attacker to dwell in a network—often around 14 days—is still longer than what the system can safely handle.

The research also looked at the time it takes to fix problems, known as remediation. By analyzing logs of real incident resolutions, the team found that while many issues are solved quickly, a small number of complex problems take weeks or even months to resolve. This "long tail" of slow resolutions is what truly threatens the stability of the defense. The system is most vulnerable not when the average fix takes too long, but when these rare, difficult cases pile up and create a backlog. The study concludes that security teams should not view their performance as a single target, such as a "mean time to respond," but rather as a joint budget of three interconnected factors: how fast they can learn, how fast they can detect, and how fast they can remediate. If any one of these lags too far behind the others, the entire defense mechanism risks falling into a cycle of failure. The work provides a clear, mathematical warning that in the modern cyber landscape, the speed of learning is just as vital as the speed of reaction, and that without a balanced approach, the natural delays of the system will eventually lead to recurrent, unavoidable breaches.

Technical Summary: A Two-Population Delayed Evolutionary Game with Bayesian Learning for Cyber Defense

Problem Statement
Advanced Persistent Threats (APTs) fundamentally exploit the temporal asymmetry between attacker speed and defender latency. While attackers compress their operational timelines (e.g., moving from initial access to lateral movement in seconds), defenders face protracted delays in detection (median dwell times of 14 days) and remediation. Existing mathematical frameworks for cyber defense often rely on static, simultaneous-move games assuming instantaneous payoffs or treat attackers as non-strategic compartments in epidemic models. These approaches fail to capture the coupled dynamics of strategic adaptation, incomplete information, and the specific operational delays inherent in Security Operations Centers (SOCs), such as detection latency and remediation lag.

Methodology
The paper formulates a two-population evolutionary game coupled with a Bayesian filtering mechanism and delay differential equations (DDEs).

Game Structure:
- Defenders: A population of subsystems choosing between Proactive Hunting ( $x$ ) and Passive Monitoring.
- Attackers: A population of intrusion campaigns choosing between Aggressive ( $y$ ) and Stealthy tactics.
- Payoffs: Defenders gain from intercepting aggressive campaigns but incur costs from hunting friction and analyst congestion (a population-level externality dependent on past hunting levels). Attackers gain tempo from aggression but risk interception.
Information and Filtering:
- Defenders do not observe the attacker mix ( $y$ ) directly. Instead, they observe a delayed, noisy Poisson alert stream.
- A Kalman–Bucy filter (in its mean-field limit) processes this stream to generate a posterior belief ( $p$ ) about the attacker mix.
- The filter gain ( $\kappa$ ) represents the learning speed, determined by sensor coverage and alert discriminability.
Dynamics:
- The system is governed by three coupled equations: two replicator equations for the populations ( $x$ and $y$ ) and one belief equation for the filter ( $p$ ).
- Delays: The model explicitly incorporates a detection delay ( $\tau_d$ ) in the information channel and a remediation delay ( $\tau_r$ ) in the congestion feedback loop.

Key Contributions
The paper provides the following theoretical and empirical contributions:

Closed-Form Stability Thresholds: The author derives a closed-form detection-delay threshold, $\tau^*_d(\kappa)$ , for the coupled system. They prove that if the learning speed $\kappa$ is below a critical minimum ( $\kappa_{min}$ ), the system is unstable regardless of how small the detection delay is.
Hopf Bifurcation Analysis: The paper proves that the interior Nash equilibrium undergoes a supercritical Hopf bifurcation when delays exceed the threshold. This leads to recurrent, self-sustained cycles of attacker–defender strategies (breach waves) rather than chaotic divergence. The direction of the bifurcation is confirmed via the first Lyapunov coefficient.
Non-Additive Delay Interaction: Unlike single-population models where delays are often additive, this study shows that detection and remediation delays interact non-additively. A moderate remediation lag can paradoxically enlarge the admissible detection delay, and attacker adaptation reduces the remediation budget by approximately 29% compared to a frozen-attacker benchmark.
Semi-Empirical Calibration:
- Learning Speed ( $\kappa$ ): Calibrated using 303,220 incidents from Microsoft's GUIDE dataset. Results show a single organization learns at $\approx 0.07$ per day, while pooled telemetry across organizations increases this to $\approx 3$ per day.
- Remediation Lag ( $\tau_r$ ): Calibrated using IT Service Management logs (ServiceNow, BPIC 2013). The congestion relaxation time is estimated at 3–6 days, with resolution times exhibiting heavy tails.

Results

Stability Limits: For a single organization with pooled telemetry, the admissible detection delay increases by a factor of 1.3–2.4 compared to a single organization without pooling. However, even with pooling, the model suggests that the 2025 global median dwell time (14 days) often exceeds the stability threshold, particularly when attacker adaptivity is high.
Critical Slowing Down: As the system approaches the bifurcation point, it exhibits "critical slowing down," characterized by increased variance and autocorrelation in the hunting share. This serves as a potential early-warning signal for SOC operators.
Remediation Bottleneck: The analysis indicates that remediation delays, driven by the heavy tail of incident resolution times, often operate close to the stability boundary. The "typical" case (median) is less critical for stability than the "long tail" of slow resolutions.
Frozen-Attacker Limit: The classical threshold for delayed replicator dynamics ( $\pi / (2\beta x^*(1-x^*))$ ) is recovered only in the limit where attackers do not adapt ( $g=\delta=0$ ).

Significance and Claims
The paper claims to supply a model where a Bayesian filter of a strategically adapting attacker population feeds defender fitness through explicit information delays, with stability determined by the coupling of these elements rather than a single aggregated lag.

The author argues that the results provide quantitative design rules for SOCs:

Latency Budgets: Defense strategies must operate within a specific latency budget ( $\tau_d < \tau^*_d$ ) to avoid self-sustained breach cycles.
Minimum Learning Speed: There is a hard floor for learning speed ( $\kappa_{min}$ ); if defenders cannot learn fast enough, reducing detection delay alone cannot stabilize the system.
Joint Management: SOC performance should be managed as a joint budget over learning speed, detection delay, and remediation delay, rather than as a single "mean-time-to-respond" metric.

The study concludes that while information sharing (pooling telemetry) significantly improves delay tolerance, it has diminishing returns (saturation at the instantaneous-learning limit) and cannot fully compensate for the structural instability introduced by long remediation tails and high attacker adaptivity.

More like this