[126] | 2022 |  Machine learning |  Evolution Algorithm - Reinforcement Learning |  Mitigate Attack |  Positive Rate | Multiple
[128] | 2023 |  Attack Trees |  Heuristic - Probabilistic methods |  Calculation of Cost-damage probabilities in Attacks |  Calculation Speed | Multiple
TABLE I: Features of analyzed papers

###  V-A Methodology

As can be seen, the two most frequent values for the methodology observed in
Table I are “Machine Learning” and “Attack Graph”. These two values can show a
trend followed by researchers in this field. Clearly in Section IV, these two
methodologies produce very good results which is why they are widely adopted.
On the one hand, ML offers a wide range of algorithms that have been
developed. These algorithms provide great flexibility when it comes to solving
different problems. In addition, they are algorithms that are very popular and
receive a lot of interest from the community [131, 132]. This supports their
usefulness and effectiveness in many contexts. Specifically, in the context of
reactive systems, ML presents some relevant advantages. To begin with, such a
methodology can manage a very large amount of data efficiently, which means it
has a strong scalability component. Furthermore, in an autonomous reactive
system, it can be used to automate countermeasures after the detection of
attacks, as well as learn from the received data and evolve to face changing
threats. In other words, it also presents an interesting component of
adaptability.

On the other hand, AGs are used in detailing standard attack patterns and
calculating risks across systems. Furthermore, graphs are a very powerful tool
that has been shown to have different advantages. The understandability of AGs
is of significant importance, particularly considering their highly visual
nature. If an autonomous system were to base a decision on these graphs, it is
imperative that operators can easily understand their meaning and
implications. Additionally, they are an interesting tool when planning
incident response plans, in which risk probabilities can be used to help focus
resources on specific assets.

However, AGs present limitations [133], as well as problems of scalability and
time to generate them. Due to globalization and growth in the number of
devices, scalability, and performance issues could greatly affect proposals
using these methodologies. On the ML side, there are different drawbacks
[134]. For example, ML requires a strong database for both training and
evolution. This may present challenges in organizations with little data, or
data of poor quality. Another disadvantage has to do with the lack of
interpretability in the decision-making process of this type of methodology.
This can make operators hesitant to carry out the proposed countermeasures.

###  V-B Algorithm

From the column corresponding to the “Algorithm” feature, one can easily
notice that the values are not as concentrated as they were in the methodology
column. This implies that researchers are exploring and experimenting with a
variety of algorithms for problem-solving. That is due to the fact that
academics are attempting to find the optimal approach to the problem of
implementing AI-based reaction systems.

This diversification in the amount of algorithms may negatively affect the
development of an autonomous reaction system. That is because it may prevent
researchers from following a common strategy. Furthermore, this variety could
present various problems when integrating components into organisations or
make it harder to compare the various proposals due to their differing
similarities.

The importance of NNs is also highlighted, derived through the case studies
analysis of [92] and [110]. It has been proven that NNs have a significant
impact on threat identification and response in various environments. However,
the importance of proper training is emphasized, as poor training can lead to
crucial omissions in the detection and response process.

###  V-C Strategy Objectives

In the case of the “Strategy Objectives” column, it is readily observable that
the most frequent objective is risk minimization. This is achieved through the
selection or generation of countermeasures to counteract threats. The risk
minimization objective can also include values in which the costs associated
with implementing countermeasures are taken into account. These reflect the
goals and needs perceived by researchers in the field, where the objective is
to optimize cybersecurity investment without compromising the protection of
critical systems and assets. Additionally, there is an effort to strike a
balance between mitigating identified threats and the resources available at
that moment.

A noteworthy aspect of the analysis and the table is [108, 102] where the
objective is to establish a standard for countermeasures. Building on this
premise, and based on the survey, it can be seen that there is no universal
standardization process attempting to address these solutions uniformly.
Instead, there are several specific proposals for each model, particularly
concerning countermeasures. This diversity of approaches has resulted in a
fragmented landscape of solutions that, each with its unique characteristics,
do not demonstrate a trend toward convergence. Although this diversity could
present an intriguing opportunity to discover unconventional and previously
unexplored solutions, it is important to note that most works do not seek to
unify the various research towards a common objective.

Concerning countermeasures, in many articles, it is observed that they are
“predefined”. In other words, countermeasures that are inflexible and lack the
capacity to adapt to the context. This can represent a problem when it comes
to dynamizing the solution of the reactive system in almost real-time.
Additionally, it can prevent the identification of unknown threats, where a
more defined system might not find a response.

###  V-D Measurements and results

In relation to the column “Measurements and Results”, it can be seen that
there is a limited range of values associated with the performance tests. The
data demonstrates predominantly the trend toward the metric “Positive rate”.
This trend is particularly significant in the context of the primary challenge
at hand, which revolves around the selection of appropriate countermeasures to
mitigate potential threats effectively. This metric serves as a valuable
indicator of how well the chosen countermeasures align with the specific
threats they are intended to address.

Additionally, it is worth noting the use of metrics such as computation time
or countermeasure selection time. These metrics shed light on the efficiency
and speed at which the countermeasures are identified and implemented. This
efficiency is particularly relevant in environments that face threats, where
rapid response times can make a significant difference in containing potential
damages and minimizing risks.

To conclude the analysis of this column, it may be interesting to note that
during the survey, many risk measures could be identified in terms of
vulnerabilities, such as CVSS or CVE, while for countermeasures no value has
been found that could classify them.

###  V-E Use Case

When examining the “Use Case” column, it becomes evident that the value “All”
holds significant prominence. This indicates that most of the works analyzed
in this survey do not tailor their solutions to a specific system.
Consequently, approaches marked with this value possess the advantage of
adaptable deployment across diverse environments, ensuring highly efficient
protection for most scenarios. However, it is important to consider that by
not tailoring the proposal to a specific system, certain specific areas within
different environments may remain unprotected. For instance, in critical
infrastructure environments, meticulous consideration of all details is
imperative, given the heightened significance of these devices compared to
common devices.

##  VI Research challenges

Based on the findings described in the previous sections, potential future
research directions for further progress in the field of AI-driven threat
response systems can be analyzed. The next subsections explore this potential
future research direction to set out a road map as a possible future path for
researchers.

###  VI-A Unified Frameworks

One of the primary research challenges lies in establishing standardized
procedures and unified structures within AI-powered threat response systems.
The current challenge with these systems is caused by the lack of a common
baseline. This lack of shared foundations can have several significant
implications and consequences. For instance, absence of interoperability
between tools or systems that have to be coordinated for the exchange of
information. Alternatively, it may make it difficult to compare different
proposals because they have no common basis for benchmarking.

By developing unified frameworks that provide a shared basis for the
integration of various AI techniques, consistency and interoperability could
be introduced into these response systems. Such an approach could accelerate
development processes and pave the way for collaborative advances that could
strengthen cohesion among researchers and practitioners.

The challenge of establishing unified frameworks implies the creation of
standardized protocols and structures that integrate a variety of AI
techniques seamlessly. Researchers could work towards developing a
comprehensive taxonomy of AI methodologies and threat response approaches that
would provide a common language and understanding.

###  VI-B Collaborative AI

Collaboration between different AI methodologies, especially NN and ML [92,
32], stands out as a promising field for further exploration. The concept of
combining multiple AI techniques, can be explored for potentially relevant
breakthroughs. By bringing together these diverse techniques, integrated
systems can be developed to leverage the strengths of each approach. This
integration purpose is to take advantage of the strengths of each one, thereby
achieving the highest precision and capacity to counter threats that arise.

To improve collaboration between different AI methodologies, researchers could
focus on creating a standardized platform that facilitates the test of the
integration of different AI techniques. In this case, different methodologies
could be assessed and ranked according to their advantages and weaknesses
based on specific tasks. Subsequently, complex systems could be designed that
unify models according to their strength, thus, building hybrid models that
design the reaction problems and assign tasks to different AIs.

It is worth remarking that this research challenge is closely related to the
previous one, related to the unification of frameworks. Exploring the concept
of a common base structure that not only shares a common set of inputs but
also facilitates the creation of hybrid AI models could significantly simplify
both model development and testing processes. This approach would simplify and
create potential synergies. It could bring together researchers and
practitioners in the search of improvement of model creation and testing in
order to strengthen AI-powered threat response systems.

###  VI-C Evolutive AI

Adaptation and evolution mechanisms of AI models used in threat response
systems represent another interesting research perspective. Due to the dynamic
nature of cyber threats, AI models require evolution and adaptation. This is
because threats are evolving, and new and unknown vulnerabilities are being
discovered regularly. Then, similarly, as threats evolve, AI models must be
dynamically updated. This challenges presents an intriguing research
trajectory to facilitate real-time updates driven by the evolving threat
landscape. The real-time evolution would allow AI models to remain effective
over time and could avoid the obsolescence that some of the models in this
survey may exhibit.

It is important to note that while AI can be designed to be evolutive, it can
also present a series of potential issues. Among these is the need to re-train
models, which could present problems of time and loss of prior knowledge.
Moreover, this re-training would have to be programmed, and this presents
another dilemma in terms of determining the optimal time for this evolution.

To address this challenge, automated mechanisms should be designed to update
AI models. The implementation of a feedback loop between real-world threat
data and AI models can ensure regular and timely updates. Besides, cooperation
with threat intelligence providers can be established to provide such threat
data. This would allow access to updated information for adapting the models.
Alternatively, techniques such as transfer learning and RL [119, 135, 104] can
be applied to facilitate faster adaptation of AI models to new threat
scenarios.

###  VI-D Collaborative Knowledge Exchange

To achieve effective cybersecurity, collaboration is a strong foundation.
Collaboration allows for an approach that promotes research towards
collaborative learning. By enabling organizations and states to collaborate in
sharing information/knowledge for training AI models without compromising data
privacy, a collective defense mechanism could be developed and, due to the
joint effort, become potentially more effective. Particularly, this line of
research could trigger the generation of shared knowledge leading to a more
robust and informed defence against evolving threats.

To address this challenge, the first step should be to establish trusted
frameworks and protocols for secure collaboration. To share threat data
securely without revealing sensitive information. Next, efforts should be made
to find an effective way of sharing information that reaches widely and
equally. For example, a centralized platform that could act as a threat
intelligence intermediary.

This concern also raises certain data-related issues. In the case of detection
models, the datasets that can be found are abundant [136, 137], since it is a
more investigated area, and the data for training is also easier to obtain due
to its nature. Nevertheless, when it comes to training the different reaction
models, there is hardly any data to train and test the performance. Which
presents a problem, since AI models base their knowledge on the quality and
quantity of the datasets on which they are trained. This could also be
considered within this challenge, as it has to do with the data and the way it
is exchanged.

This challenge is connected to several previous challenges. First, it is
connected to the sub-section VI-A since a common framework would require
collaboration to support information sharing. As a second connection, the sub-
section VI-B is also related, in the same way as the previous one, in order to
achieve collaborative AI, data needs to be shared.

###  VI-E AI and Human Experts

In the context of collaboration is not limited to the organizational
environment. Indeed, effective collaboration between humans and AI systems
presents another intriguing scenario. Future research could focus on designing
intuitive user interfaces that facilitate interaction between human experts
and AI-based threat response systems. This collaboration empowers decision-
makers by providing them with AI-generated knowledge while allowing for human
oversight and judgment, which improves the overall threat response process. In
addition, this also addresses the need to explain the decisions made by
autonomous response systems, named as eXplainable Artificial Intelligence
(XAI) [138], requiring the technicians operating these systems to have control
over the decisions being made.

To confront this challenge, researchers could conduct usability studies and
apply human-centered design principles to create user-friendly interfaces that
enhance cooperation between AI and humans. In addition, incorporating
explainable AI techniques can build trust by enabling human experts to
understand and validate AI-generated decisions. An example of such a scenario
would be the AI4CYBER [139] project, which is working on AI-based security
solutions in order to facilitate the work of operators and developers.
Furthermore, this project is focused on AI detection and testing as well as in
the field of reaction.

###  VI-F Countermeasure standardization

As a final alternative to the proposed research challenges, the topic of
predefined countermeasures emerges. As mentioned in the survey discussion,
many articles present “predefined” countermeasures for response systems [97,
85, 117, 110]. That is, countermeasures that are not dynamically generated by
a reactive system, but have a static and unchanging base which has to be used
for all scenarios. As a result, a challenge arises concerning the dynamic
nature of searching for a more universally applicable solution. It may
therefore be attractive to extend this line of research in pursuit of more
dynamic and adaptable approaches to maintain a countermeasure database. The
use of artificial intelligence may be interesting to generate new
countermeasures based on the identification of emerging vulnerabilities or
threats.

To effectively standardize countermeasures, efforts should be dedicated to the
categorization of threats and vulnerabilities in a standardized way.
Developing a common language for countermeasures that fits this categorization
can help standardize responses [108, 102]. In addition, leveraging ML and
natural language processing to analyze and classify emerging threats can
automate the generation of countermeasures.

To effectively standardize countermeasures, little efforts should be dedicated
to the categorization of threats and vulnerabilities in a standardized way.
Reduced efforts can be attributed to the fact that, as mentioned above, there
are standards for the representation of vulnerabilities and threats that are
widely used, such as CVE and CVSS. This implies that progress should continue
to be made in this field, however

it could be interesting for academia to research a method for standardization
of countermeasures that provides a scoring. In the same way as the
categorization of vulnerabilities, such a score could be used to assess the
effectiveness of a countermeasure. Thus helping the optimal selection of
countermeasures by a reaction system. In essence, developing a common language
for countermeasures that fits this categorization can also help standardize
responses [108, 102].

However, this also requires collaboration, as industry stakeholders need to
agree on the standard to be followed. Not only that, but they must apply it to
new developments and try to update old systems.

###  VI-G Generative AI

In 2017, the article “Attention is All You Need” [140] presented the
Transformer architecture for artificial intelligence. A model that allowed the
network model to learn the relationships between parts of an input stream. In
2018, “Improving Language Understanding with Unsupervised Learning” [141] was
presented, an article that presented BERT, an improvement that allowed
bidirectional models to be trained by capturing contextual information in both
directions in a sequence of text, allowing context to be understood. In 2019,
the OpenAI team launched GPT-2 [142], increasing the size of the model and
extending the performance of tasks such as natural language processing. In
2020, GPT-3 [143] was released, further increasing its performance and
creating ChatGPT. After extensive study, and to the best of our knowledge, the
use of this type of artificial intelligence, called generative modeling, has
not been put into practice for the reactive systems environment. Several
research papers have been found that use this type of model for malware
detection [144, 145]. However, no papers have been found that attempt to
combine generative models for reactive systems.

Such models could be used in a variety of ways. For a start, it could be used
to create an interface that simplifies the work of a cybersecurity operator.
This advantage is related to the “AI and Human Experts” challenge, as it could
extend the explainability of AIs, as well as simplify and accelerate the tasks
of incident response or threat prevention. An additional potential benefit
could be the automatic creation or reading of incident reports, facilitating
the process of information sharing. This would be linked to the “Collaborative
Knowledge Exchange”, where generative models could be on both sides sharing
information and breaking it down as it is received. As a final example, a
generative model could be used for threat simulation through text generation,
so that the security configurations implemented in a system could be checked
and tested automatically.

In conclusion, the link between generative artificial intelligence models and
reactive systems in the world of cybersecurity presents a great challenge that
could be very interesting to investigate.

###  VI-H Summary

To enhance the reader’s understanding, an illustrative support, represented by
Figure 7, has been incorporated. This figure visually presents the research
challenges, illustrating their interconnections through arrows. In particular,
an additional parameter called “Collaboration” has been introduced to indicate
whether a research pathway requires stakeholder collaboration.

Figure 7: Graph with research challenge interconnections

##  VII Conclusions and future work

Human dependence on the use of information technologies has grown
exponentially. This dependence poses considerable security challenges, which
can be seen in frequent cyberattacks targeting businesses, critical
infrastructures, and companies, and even impacting geopolitical events. In
response, both private enterprises and nation-states are actively exploring
effective ways to strengthen the security measures of their systems, aiming to
safeguard sensitive data and prevent unauthorized access. This trend has
triggered an increase in research efforts to address these critical
challenges. The emergence of cutting-edge technologies, like AI, has enriched
the landscape. When integrated into the cybersecurity sector, this technology
offers numerous advantages, such as the identification of threats and the
identification of appropriate countermeasures. With the assistance of AI,
dedicated systems can be used to detect, prevent, and respond to threats
within the realm of cyberspace.

This paper presented a novel survey that delves into the recent advancements
within the domain of AI-driven threat response systems. The primary objective
is to closely examine and compare diverse recent papers in this area, trying
to highlight and uncover the various complexities associated with integrating
AI into cyber defense. Through this exploration, the survey identifies
opportunities to strengthen defense mechanisms using AI-powered response
systems, paving the way for future research.

The survey presented focuses on examining several research studies that share
common characteristics. From this analysis, some interesting approaches that
use a variety of AI techniques to solve the challenge of creating an
autonomous threat response system are presented. The variety of approaches
found reflects the range of the field and the growing diversity of strategies
for dealing with cyber threats.

It is important to note that this comparison reflects a snapshot in time and
that the field of threat response systems using AI continues to develop.
Future research advances and discoveries could have an impact on this
comparative survey, further improving our understanding of this essential area
of research.

Concerning the methodological target, one of the key aspects is the selection
of countermeasures to minimize both the risk and the costs associated with the
identified threats. The research highlights the importance of this strategic
choice and how AI techniques can influence the determination of the most
appropriate countermeasures. There is also an emerging trend in the
integration of machine learning techniques and Neural Networks to improve the
accuracy of threat identification.

While not the primary focus of this literature review, it has also
incorporated studies presenting solutions that can be adapted or evaluated for
response systems. These additional works provide a complementary perspective
on how to address the various challenges and can serve as a basis for future
research in this evolving area. As cyber threats continue to evolve,
collaboration between different approaches and disciplines becomes critical to
developing robust and effective threat response strategies.

Finally, a research challenge section has been proposed in which different
future research directions have been suggested. Among these, work will be done
investigating the development of some interesting concepts such as:

  * –

The use of generative models for the creation of useful interfaces for
cybersecurity operators.

  * –

Designing automated mechanisms to update AI models in response to real-world
threat data.

  * –

Create a standardized platform for testing the integration of different AI
techniques.

  * –

Create a comprehensive taxonomy of AI methodologies and threat response
approaches.

## Acknowledgement

This work has been partially funded by the strategic project CDL-TALENTUM from
the Spanish National Institute of Cybersecurity (INCIBE) and by the Recovery,
Transformation and Resilience Plan, Next Generation EU.

## References

  * [1] G. Bhatt and V. Grover, “Types of information technology capabilities and their role in competitive advantage: An empirical study,” _J. of Management Information Systems_ , vol. 22, pp. 253–278, 2005.
  * [2] D. Buil-Gil, N. Trajtenberg, and M. Aebi, _Measuring Cybercrime and Cyberdeviance in Surveys_. Routledge, 2023.
  * [3] M. Fischetti. Data theft: Hackers attack. [Online]. Available: https://www.scientificamerican.com/article/data-theft-hackers-attack/
  * [4] D.-O. Jaquet-Chiffelle and M. Loi, “Ethical and unethical hacking,” in _The International Library of Ethics, Law and Technology_. Springer International Publishing, 2020, pp. 179–204. [Online]. Available: https://doi.org/10.1007/978-3-030-29053-5_9
  * [5] M. Lindsay and J. Krysik, “Online harassment among college students,” _Information, Communication & Society_, vol. 15, no. 5, pp. 703–719, Jun. 2012. [Online]. Available: https://doi.org/10.1080/1369118x.2012.674959
  * [6] D. Weissbrodt, “Cyber-conflict, cyber-crime, and cyber-espionage,” _Minn. J. Int’l L._ , vol. 22, p. 347, 2013.
  * [7] S. Yu, G. Gu, A. Barnawi, S. Guo, and I. Stojmenovic, “Malware propagation in large-scale networks,” _IEEE Transactions on Knowledge and Data Engineering_ , vol. 27, no. 1, pp. 170–179, 2015.
  * [8] I. Vojinovic. More than 70 cybercrime statistics – a $6 trillion problem. [Online]. Available: https://dataprot.net/statistics/cybercrime-statistics/
  * [9] C. Griffiths. The latest 2023 cyber crime statistics. [Online]. Available: https://aag-it.com/the-latest-cyber-crime-statistics/
  * [10] A. Alshamrani, S. Myneni, A. Chowdhary, and D. Huang, “A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities,” _IEEE Communications Surveys & Tutorials_, vol. 21, no. 2, pp. 1851–1877, 2019.
  * [11] L. Y. Hunter, C. D. Albert, E. Garrett, and J. Rutland, “Democracy and cyberconflict: how regime type affects state-sponsored cyberattacks,” _Journal of Cyber Policy_ , vol. 7, no. 1, pp. 72–94, Jan. 2022. [Online]. Available: https://doi.org/10.1080/23738871.2022.2041060
  * [12] CSIS. Cyber operations during the russo-ukrainian war. [Online]. Available: https://www.csis.org/analysis/cyber-operations-during-russo-ukrainian-war#h2-russian-cyber-operations
  * [13] X. Cheng and X. Liao, “The application of cloud computing in military intelligence fusion,” in _2011 International Conference of Information Technology, Computer Engineering and Management Sciences_ , vol. 1, 2011, pp. 241–244.
  * [14] Y. A. Younis and K. Kifayat, “Secure cloud computing for critical infrastructure: A survey,” _Liverpool John Moores University, United Kingdom, Tech. Rep_ , pp. 599–610, 2013.
  * [15] W. Duo, M. Zhou, and A. Abusorrah, “A survey of cyber attacks on cyber physical systems: Recent advances and challenges,” _IEEE/CAA Journal of Automatica Sinica_ , vol. 9, no. 5, pp. 784–800, 2022.
  * [16] K. Elleithy, D. Blagovic, W. Cheng, and P. Sideleau, “Denial of service attack techniques: Analysis, implementation and comparison,” _Journal of Systemics, Cybernetics and Informatics_ , vol. 3, pp. 66–71, 2006.
  * [17] T. Mahjabin, Y. Xiao, G. Sun, and W. Jiang, “A survey of distributed denial-of-service attack, prevention, and mitigation techniques,” _International Journal of Distributed Sensor Networks_ , vol. 13, no. 12, 2017.
  * [18] A. Asen, W. Bohmayr, S. Deutscher, M. González, and D. Mkrtchian. Are you spending enough on cybersecurity? [Online]. Available: http://boston-consulting-group-brightspot.s3.amazonaws.com/img-src/BCG-Are-You-Spending-Enough-on-Cybersecurity-Feb-2019_tcm9-214372.pdf
  * [19] F. Gioulekas, E. Stamatiadis, A. Tzikas, K. Gounaris, A. Georgiadou, A. Michalitsi-Psarrou, G. Doukas, M. Kontoulis, Y. Nikoloudakis, S. Marin, R. Cabecinha, and C. Ntanos, “A cybersecurity culture survey targeting healthcare critical infrastructures,” _Healthcare_ , vol. 10, p. 327, 2022.
  * [20] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey of intrusion detection systems: techniques, datasets and challenges,” _Cybersecur 2_ , 2019.
  * [21] O. Podzins and A. Romanovs, “Why siem is irreplaceable in a secure it environment?” in _2019 Open Conference of Electrical, Electronic and Information Sciences (eStream)_ , 2019, pp. 1–5.
  * [22] D. D. López, M. B. Uribe, C. S. Cely, A. V. Torres, N. M. Guataquira, S. M. Castro, P. Nespoli, and F. G. Mármol, “Shielding IoT against cyber-attacks: An event-based approach using SIEM,” _Wireless Communications and Mobile Computing_ , vol. 2018, pp. 1–18, Oct. 2018. [Online]. Available: https://doi.org/10.1155/2018/3029638
  * [23] N. Ierace, C. Urrutia, and R. Bassett, “Intrusion prevention systems,” _Ubiquity_ , vol. 6, no. 19, pp. 2–2, 2005.
  * [24] B. Foo, M. W. Glause, G. M. Howard, Y.-S. Wu, S. Bagchi, and E. H. Spafford, “Intrusion response systems: a survey,” _Information assurance: dependability and security in networked systems_ , pp. 377–412, 2008.
  * [25] V. Rani, M. Kumar, A. Mittal, and K. Kumar, “Artificial intelligence for cybersecurity: Recent advancements, challenges and opportunities,” _Robotics and AI for Cybersecurity and Critical Infrastructure in Smart Cities_ , p. 73–88, 2022.
  * [26] K. Morovat and B. Panda, “A survey of artificial intelligence in cybersecurity,” in _2020 International Conference on Computational Science and Computational Intelligence (CSCI)_ , 2020, pp. 109–115.
  * [27] C. Ulbricht, G. Dorffner, and A. Lee, “Neural networks for recognizing patterns in cardiotocograms,” _Artificial intelligence in Medicine_ , vol. 12, no. 3, pp. 271–284, 1998.
  * [28] J. Porciello, M. Ivanina, M. Islam, S. Einarson, and H. Hirsh, “Accelerating evidence-informed decision-making for the sustainable development goals using machine learning,” _Nature Machine Intelligence_ , vol. 2, no. 10, pp. 559–565, 2020.
  * [29] S. Ghosh-Dastidar and H. Adeli, “Spiking neural networks,” _International journal of neural systems_ , vol. 19, no. 04, pp. 295–308, 2009.
  * [30] M. Macas, C. Wu, and W. Fuertes, “A survey on deep learning for cybersecurity: Progress, challenges, and opportunities,” _Computer Networks_ , vol. 212, p. 109032, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1389128622001864
  * [31] D. Díaz-López, G. Dólera-Tormo, F. Gómez-Mármol, and G. Martínez-Pérez, “Dynamic counter-measures for risk-based access control systems: An evolutive approach,” _Future Generation Computer Systems_ , vol. 55, pp. 321–335, 2016. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167739X14002052
  * [32] A. Abubakar and B. Pranggono, “Machine learning based intrusion detection system for software defined networks,” in _2017 Seventh International Conference on Emerging Security Technologies (EST)_ , 2017, pp. 138–143.
  * [33] J.-C. Pomerol, “Artificial intelligence and human decision making,” _European Journal of Operational Research_ , vol. 99, no. 1, pp. 3–25, 1997.
  * [34] S. Mohanty and S. Vyas, _Cybersecurity and AI_. Berkeley, CA: Apress, 2018, pp. 143–153. [Online]. Available: https://doi.org/10.1007/978-1-4842-3808-0_6
  * [35] Y. Farhaoui, “Performance assessment of tools of the intrusion detection/prevention systems,” _IJCSIS_ , vol. 10, p. 7, 01 2012.
  * [36] M. Papadaki and S. Furnell, “Ids or ips: what is best?” _Network Security_ , vol. 2004, no. 7, pp. 15–19, 2004. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1353485804001060
  * [37] P. Nespoli, D. Papamartzivanos, F. Gómez Mármol, and G. Kambourakis, “Optimal countermeasures selection against cyber attacks: A comprehensive survey on reaction frameworks,” _IEEE Communications Surveys and Tutorials_ , vol. 20, no. 2, pp. 1361–1396, 2018.
  * [38] Z. Inayat, A. Gani, N. B. Anuar, M. K. Khan, and S. Anwar, “Intrusion response systems: Foundations, design, and challenges,” _Journal of Network and Computer Applications_ , vol. 62, pp. 53–74, 2016. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1084804515002994
  * [39] A. Shameli-Sendi, N. Ezzati-Jivan, M. Jabbarifar, and M. Dagenais, “Intrusion response systems: Survey and taxonomy,” _International Journal Computer Science Network Security (IJCSNS)_ , vol. 12, 01 2012.
  * [40] B. Fessi, M. Hamdi, S. Benabdallah, and N. Boudriga, “Automated intrusion response system: Surveys and analysis,” in _2008 International Conference on Security & Management_, 07 2008, pp. 149–155.
  * [41] K. Goztepe, “Designing fuzzy rule based expert system for cyber security,” _International Journal of Information Security Science_ , vol. 1, no. 1, pp. 13 – 19, 2012.
  * [42] M. Sonka, W. Park, and E. Hoffman, “Rule-based detection of intrathoracic airway trees,” _IEEE Transactions on Medical Imaging_ , vol. 15, no. 3, pp. 314–326, 1996.
  * [43] C. M. Frenz and J. P. Yoon, “Xssmon: A perl based ids for the detection of potential xss attacks,” in _2012 IEEE Long Island Systems, Applications and Technology Conference (LISAT)_ , 2012, pp. 1–4.
  * [44] D. Wagner and R. Dean, “Intrusion detection via static analysis,” in _Proceedings 2001 IEEE Symposium on Security and Privacy_ , 2001, pp. 156–168.
  * [45] E. Guillen, J. Sánchez, and R. Paez, “Inefficiency of ids static anomaly detectors in real-world networks,” _Future Internet_ , vol. 7, no. 2, pp. 94–109, 2015. [Online]. Available: https://www.mdpi.com/1999-5903/7/2/94
  * [46] C. Constantinides, S. Shiaeles, B. Ghita, and N. Kolokotronis, “A novel online incremental learning intrusion prevention system,” in _2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS)_ , 2019, pp. 1–6.
  * [47] T. Xing, D. Huang, L. Xu, C.-J. Chung, and P. Khatkar, “Snortflow: A openflow-based intrusion prevention system in cloud environment,” in _2013 Second GENI Research and Educational Experiment Workshop_ , 2013, pp. 89–92.
  * [48] O. Sheyner and J. Wing, “Tools for generating and analyzing attack graphs,” in _Formal Methods for Components and Objects_ , F. S. de Boer, M. M. Bonsangue, S. Graf, and W.-P. de Roever, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2004, pp. 344–371.
  * [49] E. Tyugu, “Artificial intelligence in cyber defense,” in _2011 3rd International Conference on Cyber Conflict_ , 2011, pp. 1–11.
  * [50] M. G. Tolani and H. G. Tolani, “Use of artificial intelligence in cyber defence,” _International Research Journal of Engineering and Technology_ , vol. 06, no. 07, 2019.
  * [51] P. Hamet and J. Tremblay, “Artificial intelligence in medicine,” _Metabolism_ , vol. 69, pp. S36–S40, 2017, insights Into the Future of Medicine: Technologies, Concepts, and Integration. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S002604951730015X
  * [52] I. Andras, E. Mazzone, F. Leeuwen, G. De Naeyer, M. Van Oosterom, S. Beato, T. Buckle, S. O’Sullivan, P. Leeuwen, A. Beulens, N. Crisan, F. D’Hondt, P. Schatteman, H. Poel, P. Dell’Oglio, and A. Mottrie, “Artificial intelligence and robotics: a combination that is changing the operating room,” _World Journal of Urology_ , vol. 38, 10 2020.
  * [53] J. W. Goodell, S. Kumar, W. M. Lim, and D. Pattnaik, “Artificial intelligence and machine learning in finance: Identifying foundations, themes, and research clusters from bibliometric analysis,” _Journal of Behavioral and Experimental Finance_ , vol. 32, p. 100577, 2021. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2214635021001210
  * [54] R. Abduljabbar, H. Dia, S. Liyanage, and S. A. Bagloee, “Applications of artificial intelligence in transport: An overview,” _Sustainability_ , vol. 11, 2019. [Online]. Available: https://www.mdpi.com/2071-1050/11/1/189
  * [55] Y. Wu, “Artificial intelligence is the technical guarantee of network security,” in _The 2020 International Conference on Machine Learning and Big Data Analytics for IoT Security and Privacy_ , J. MacIntyre, J. Zhao, and X. Ma, Eds. Cham: Springer International Publishing, 2021, pp. 69–74.
  * [56] K. Morgan, “Role of ai in thr role of ai in threat detection and z eat detection and zero-day attacks,” _Cybersecurity Undergraduate Research - ODU Digital Commons_ , 2023.
  * [57] S. Cooper. Ai & ml in network management. [Online]. Available: https://www.comparitech.com/net-admin/ai-ml-in-network-management/
  * [58] J. O. Oche, “The risk of artificial intelligence in cyber security and the role of humans,” _Texila International Journal of Academic Research_ , 2017.
  * [59] A. Ali, M. A. Khan, K. Farid, S. S. Akbar, A. Ilyas, T. M. Ghazal, and H. Al Hamadi, “The effect of artificial intelligence on cybersecurity,” in _2023 International Conference on Business Analytics for Technology and Security (ICBATS)_ , 2023, pp. 1–7.
  * [60] J. Botha and H. Pieterse, “Fake news and deepfakes: A dangerous threat for 21st century information security,” in _15t International Conference on Cyber Warfare and SecurityAt_ , 03 2020.
  * [61] S. He, J. Fu, C. Chen, and Z. Guo, “Research on password cracking technology based on improved transformer,” _Journal of Physics: Conference Series_ , 2020.
  * [62] K. Zarei, R. Farahbakhsh, N. Crespi, and G. Tyson, “Impersonation on social media: A deep neural approach to identify ingenuine content,” in _2020 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM)_ , 2020, pp. 11–15.
  * [63] “Deep reinforcement learning instrumenting bettercap for wifi pwning.” [Online]. Available: https://pwnagotchi.ai/
  * [64] S. Bharati, P. Podder, M. R. Hossain Mondal, and M. R. Alam Robel, “Threats and countermeasures of cyber security in direct and remote vehicle communication systems,” _CoRR_ , vol. abs/2006.08723, 2020. [Online]. Available: https://arxiv.org/abs/2006.08723
  * [65] C. Lopez, A. Sargolzaei, H. Santana, and C. Huerta, “Smart grid cyber security: An overview of threats and countermeasures,” _Journal of Energy and Power Engineering_ , vol. 9, 07 2015.
  * [66] T. T. Khoei, H. O. Slimane, and N. Kaabouch, “A comprehensive survey on the cyber-security of smart grids: Cyber-attacks, detection, countermeasure techniques, and future directions,” 2022.
  * [67] J.-P. A. Yaacoub, H. N. Noura, O. Salman, and A. Chehab, “Robotics cyber security: vulnerabilities, attacks, countermeasures, and recommendations,” _International Journal of Information Security_ , p. pages115–158, 2022.
  * [68] K. Goztepe, V. Dizdaroğlu, and S. Sagiroglu, “New directions in military and security studies: Artificial intelligence and military decision making process,” _International Journal of Information Security Science_ , vol. 4, pp. 69–80, 01 2015.
  * [69] I. E. Naqa and M. J. Murphy, “What is machine learning?” in _Machine Learning in Radiation Oncology_. Springer International Publishing, 2015, pp. 3–11. [Online]. Available: https://doi.org/10.1007/978-3-319-18305-3_1
  * [70] G. J. Pai and J. B. Dugan, “Enhancing software reliability estimation using bayesian networks and fault trees,” _FastAbstract ISSRE and Chillarege Corp. Copyright_ , 2001.
  * [71] T. A. Stephenson, “An introduction to bayesian network theory and usage,” _IDIAP_ , 2000. [Online]. Available: http://infoscience.epfl.ch/record/82584
  * [72] N. Aloysius and M. Geetha, “A review on deep convolutional neural networks,” in _2017 International Conference on Communication and Signal Processing (ICCSP)_ , 2017, pp. 0588–0592.
  * [73] D. Foead, A. Ghifari, M. B. Kusuma, N. Hanafiah, and E. Gunawan, “A systematic literature review of a* pathfinding,” _Procedia Computer Science_ , vol. 179, pp. 507–514, 2021, 5th International Conference on Computer Science and Computational Intelligence 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1877050921000399
  * [74] A. Sohail, “Genetic algorithms in the fields of artificial intelligence and data sciences,” _Annals of Data Science_ , vol. 10, p. pages1007–1018, 2021.
  * [75] R. R. Hoffman, S. T. Mueller, G. Klein, and J. Litman, “Metrics for explainable ai: Challenges and prospects,” 2019.
  * [76] G. S. Handelman, H. K. Kok, R. V. Chandra, A. H. Razavi, S. Huang, M. Brooks, M. J. Lee, and H. Asadi, “Peering into the black box of artificial intelligence: Evaluation metrics of machine learning methods,” _American Journal of Roentgenology_ , vol. 212, no. 1, pp. 38–43, Jan. 2019. [Online]. Available: https://doi.org/10.2214/ajr.18.20224
  * [77] J. Moteff, C. Copeland, and J. Fischer, “Critical infrastructures: What makes an infrastructure critical?” Library of congress Washington DC congressional research service, Tech. Rep. ADA467306, 2003. [Online]. Available: https://apps.dtic.mil/sti/citations/ADA467306
  * [78] J. Moteff and P. Parfomak, “Critical infrastructure and key assets: Definition and identification,” Library of congress Washington DC congressional research service, Tech. Rep. ADA454016, 2004. [Online]. Available: https://apps.dtic.mil/sti/citations/ADA454016
  * [79] D. Evans, “The internet of things,” _How the Next Evolution of the Internet is Changing Everything, Whitepaper, Cisco Internet Business Solutions Group (IBSG)_ , vol. 1, pp. 1–12, 2011.
  * [80] D.-R. Berte, “Defining the iot,” _Proceedings of the International Conference on Business Excellence_ , vol. 12, no. 1, pp. 118–128, 3918. [Online]. Available: https://doi.org/10.2478/picbe-2018-0013
  * [81] A. P. Henriques de Gusmão, M. Mendonça Silva, T. Poleto, L. Camara e Silva, and A. P. Cabral Seixas Costa, “Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory,” _International Journal of Information Management_ , vol. 43, pp. 248–260, 2018. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S026840121830077X
  * [82] D. Kritzinger, “4 - fault tree analysis,” in _Aircraft System Safety_ , D. Kritzinger, Ed. Woodhead Publishing, 2017, pp. 59–99. [Online]. Available: https://www.sciencedirect.com/science/article/pii/B9780081008898000040
  * [83] D. Dubois and H. Prade, “Fuzzy set and possibility theory-based methods in artificial intelligence,” _Artificial Intelligence_ , vol. 148, no. 1, pp. 1–9, 2003, fuzzy Set and Possibility Theory-Based Methods in Artificial Intelligence. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0004370203001188
  * [84] P. Ekel, J. Martini, and R. Palhares, “Multicriteria analysis in decision making under information uncertainty,” _Applied Mathematics and Computation_ , vol. 200, no. 2, pp. 501–516, 2008, special Issue on The Foz2006 Congress of Mathematics and its Applications. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0096300307011307
  * [85] I. Kotenko, E. Doynikova, A. Chechulin, and A. Fedorchenko, _AI- and Metrics-Based Vulnerability-Centric Cyber Security Assessment and Countermeasure Selection: An Artificial Intelligence Approach_. Springer Cham, 2018, pp. 101–130.
  * [86] “Snyk vulnerability database.” [Online]. Available: https://security.snyk.io/
  * [87] “Mend vulnerability database.” [Online]. Available: https://www.mend.io/vulnerability-database/
  * [88] (2020) Niac common vulnerability scoring system: Final report and recommendations. [Online]. Available: www.cisa.gov/resources-tools/resources/niac-common-vulnerability-scoring-system-final-report-and-recommendations
  * [89] O. Stan, R. Bitton, M. Ezrets, M. Dadon, M. Inokuchi, Y. Ohta, T. Yagyu, Y. Elovici, and A. Shabtai, “Heuristic approach for countermeasure selection using attack graphs,” in _2021 IEEE 34th Computer Security Foundations Symposium (CSF)_ , 2021, pp. 1–16.
  * [90] X. Ou, S. Govindavajhala, and A. W. Appel, “Mulval: A logic-based network security analyzer,” in _Proceedings of the 14th Conference on USENIX Security Symposium - Volume 14_ , ser. SSYM’05. USA: USENIX Association, 2005, p. 8.
  * [91] D. H. D. Warren, L. M. Pereira, and F. Pereira, “Prolog - the language and its implementation compared with lisp,” _SIGPLAN Not._ , vol. 12, no. 8, p. 109–115, aug 1977. [Online]. Available: https://doi.org/10.1145/872734.806939
  * [92] D. Papamartzivanos, F. Gómez Mármol, and G. Kambourakis, “Introducing deep learning self-adaptive misuse network intrusion detection systems,” _IEEE Access_ , vol. 7, pp. 13 546–13 560, 2019.
  * [93] J. Vizcarrondo, J. Aguilar, E. Exposito, and A. Subias, “Mape-k as a service-oriented architecture,” _IEEE Latin America Transactions_ , vol. 15, no. 6, pp. 1163–1175, 2017.
  * [94] O. Standard. Network topology mapper. [Online]. Available: https://www.solarwinds.com/network-topology-mapper?utm_source=itfirms.co&utm_medium=referral&utm_campaign=networkmappingsoftware
  * [95] A. Makhzani and B. Frey, “k-sparse autoencoders,” 2014.
  * [96] X. Li, C. Zhou, Y.-C. Tian, and Y. Qin, “A dynamic decision-making approach for intrusion response in industrial control systems,” _IEEE Transactions on Industrial Informatics_ , vol. 15, no. 5, pp. 2544–2554, 2019.
  * [97] G. Gonzalez-Granadillo, E. Doynikova, J. Garcia-Alfaro, I. Kotenko, and A. Fedorchenko, “Stateful rori-based countermeasure selection using hypergraphs,” _Journal of Information Security and Applications_ , vol. 54, p. 102541, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2214212619307409
  * [98] N. Kheir, N. Cuppens-Boulahia, F. Cuppens, and H. Debar, “A service dependency model for cost-sensitive intrusion response,” in _Computer Security – ESORICS 2010_ , D. Gritzalis, B. Preneel, and M. Theoharidou, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2010, pp. 626–642.
  * [99] B. Fila and W. Wideł, “Exploiting attack–defense trees to find an optimal set of countermeasures,” in _2020 IEEE 33rd Computer Security Foundations Symposium (CSF)_ , 2020, pp. 395–410.
  * [100] J. B. Hong and D. S. Kim, “Performance analysis of scalable attack representation models,” in _Security and Privacy Protection in Information Processing Systems_. Springer Berlin Heidelberg, 2013, pp. 330–343. [Online]. Available: https://doi.org/10.1007/978-3-642-39218-4_25
  * [101] M. Khosravi-Farmad and A. Ghaemi-Bafghi, “Bayesian decision network-based security risk management framework,” _Journal of Network and Systems Management_ , vol. 28, no. 4, pp. 1794–1819, 2020.
  * [102] K. Hughes, K. McLaughlin, and S. Sezer, “Dynamic countermeasure knowledge for intrusion response systems,” in _2020 31st Irish Signals and Systems Conference (ISSC)_ , 2020, pp. 1–6.
  * [103] C. Program. Cve® program mission. [Online]. Available: https://www.cve.org/
  * [104] S. Iannucci, V. Cardellini, O. D. Barba, and I. Banicescu, “A hybrid model-free approach for the near-optimal intrusion response control of non-stationary systems,” _Future Generation Computer Systems_ , vol. 109, pp. 111–124, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167739X19320424
  * [105] M. Otterlo and M. Wiering, “Reinforcement learning,” _Adaptation, Learning, and Optimization_ , 2012.
  * [106] R. S. Sutton and A. G. Barto, _Reinforcement learning: An introduction_. MIT press, 2018.
  * [107] H. A. Kholidy, “Autonomous mitigation of cyber risks in the cyber–physical systems,” _Future Generation Computer Systems_ , vol. 115, pp. 171–187, 2021. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167739X19320680
  * [108] P. Nespoli, F. G. Mármol, and J. M. Vidal, “A bio-inspired reaction against cyberattacks: Ais-powered optimal countermeasures selection,” _IEEE Access_ , vol. 9, pp. 60 971–60 996, 2021.
  * [109] P. Nespoli, F. Gomez Marmol, and J. Maestre Vidal, “Battling against cyberattacks: towards pre-standardization of countermeasures,” _Cluster Computing_ , vol. 24, pp. 1–25, 03 2021.
  * [110] S. Iannucci, E. Casalicchio, and M. Lucantonio, “An intrusion response approach for elastic applications based on reinforcement learning,” in _2021 IEEE Symposium Series on Computational Intelligence (SSCI)_ , 2021, pp. 01–10.
  * [111] G. C. Platform. Online boutique. [Online]. Available: https://github.com/GoogleCloudPlatform/microservices-demo
  * [112] I. Kalderemidis, A. Farao, P. Bountakas, S. Panda, and C. Xenakis, “Gtm: Game theoretic methodology for optimal cybersecurity defending strategies and investments,” in _Proceedings of the 17th International Conference on Availability, Reliability and Security_ , ser. ARES ’22. New York, NY, USA: Association for Computing Machinery, 2022. [Online]. Available: https://doi.org/10.1145/3538969.3544431
  * [113] Y. Wang, Y. Wang, J. Liu, Z. Huang, and P. Xie, “A survey of game theoretic methods for cyber security,” in _2016 IEEE First International Conference on Data Science in Cyberspace (DSC)_ , 2016, pp. 631–636.
  * [114] W. Kenton. Zero-sum game definition in finance, with example. [Online]. Available: https://www.investopedia.com/terms/z/zero-sumgame.asp#:~:text=Investopedia%20%2F%20Laura%20Porter-,What%20Is%20a%20Zero%2DSum%20Game%3F,wealth%20or%20benefit%20is%20zero.
  * [115] P. Krugman. Nash equilibrium: Definition and examples of nash equilibrium. [Online]. Available: https://www.masterclass.com/articles/nash-equilibrium-explained
  * [116] T. Nessus. Nessus: Network vulnerability scanning tool. [Online]. Available: https://www.tenable.com/products/nessus
  * [117] W. Wideł, P. Mukherjee, and M. Ekstedt, “Security countermeasures selection using the meta attack language and probabilistic attack graphs,” _IEEE Access_ , vol. 10, pp. 89 645–89 662, 2022.
  * [118] W. Wideł, S. Hacks, M. Ekstedt, P. Johnson, and R. Lagerström, “The meta attack language - a formal description,” _Computers & Security_, vol. 130, p. 103284, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167404823001943
  * [119] Y. Yue, Y. Zhou, L. Xu, and D. Zhao, “Optimal defense strategy selection algorithm based on reinforcement learning and opposition-based learning,” _Applied Sciences_ , vol. 12, no. 19, 2022. [Online]. Available: https://www.mdpi.com/2076-3417/12/19/9594
  * [120] Z. H. Abdaljabar, O. N. Ucan, and K. M. Ali Alheeti, “An intrusion detection system for iot using knn and decision-tree based classification,” in _2021 International Conference of Modern Trends in Information and Communication Technology Industry (MTICTI)_ , 2021, pp. 1–5.
  * [121] M. Ahzam, R. Ahamed, F. Hanum, A. Gani, E. Ahmed, A. Salam, M. Nainar, N. Md Akim, and M. Imran, “Deep learning and big data technologies for iot security,” _Computer Communications_ , vol. 151, pp. 495–517, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0140366419315361
  * [122] Z. Liu, N. Thapa, A. Shaver, K. Roy, M. Siddula, X. Yuan, and A. Yu, “Using embedded feature selection and cnn for classification on ccd-inid-v1—a new iot dataset,” _Sensors_ , vol. 21, no. 14, 2021. [Online]. Available: https://www.mdpi.com/1424-8220/21/14/4834
  * [123] T. Cody, A. Rahman, C. Redino, L. Huang, R. Clark, A. Kakkar, D. Kushwaha, P. Park, P. Beling, and E. Bowen, “Discovering exfiltration paths using reinforcement learning with attack graphs,” 2022.
  * [124] M. S. Barik, A. Sengupta, and C. Mazumdar, “Attack graph generation and analysis techniques,” _Defence Science Journal_ , vol. 66, no. 6, p. 559, Oct. 2016. [Online]. Available: https://doi.org/10.14429/dsj.66.10795
  * [125] W. Wang, F. Harrou, B. Bouyeddou, S.-M. Senouci, and Y. Sun, “Cyber-attacks detection in industrial systems using artificial intelligence-driven methods,” _International Journal of Critical Infrastructure Protection_ , vol. 38, p. 100542, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1874548222000300
  * [126] V. Cardellini, E. Casalicchio, S. Iannucci, M. Lucantonio, S. Mittal, D. Panigrahi, and A. Silvi, “irs-partition: An intrusion response system utilizing deep q-networks and system partitions,” _SoftwareX_ , vol. 19, p. 101120, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2352711022000796
  * [127] IBM. ¿qué es la simulación montecarlo? [Online]. Available: https://www.ibm.com/es-es/topics/monte-carlo-simulation
  * [128] M. Lopuhaä-Zwakenberg and M. Stoelinga, “Cost-damage analysis of attack trees,” 2023.
  * [129] B. Schneier, “Attack trees,” _Dr. Dobb’s journal_ , vol. 24, no. 12, pp. 21–29, 1999.
  * [130] T. R. Ingoldsby, “Attack tree-based threat risk analysis,” _Amenaza Technologies Limited_ , pp. 3–9, 2010.
  * [131] D. Gibert, C. Mateu, and J. Planes, “The rise of machine learning for detection and classification of malware: Research developments, trends and challenges,” _Journal of Network and Computer Applications_ , vol. 153, p. 102526, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1084804519303868
  * [132] A. Mari, “The rise of machine learning in marketing: Goal, process, and benefit of ai-driven marketing,” Swiss Cognitive, Tech. Rep., 2019. [Online]. Available: https://doi.org/10.5167/uzh-197751
  * [133] Z. Alaaraji, S. S. Syed Ahmad, R. Abdullah, A. Mutlag, H. Raheem, and S. Basri, “Attack graph reachability: concept, analysis, challenges and issues,” _Network Security_ , vol. 2021, pp. 13–19, 06 2021.
  * [134] M. M. Malik, “A hierarchy of limitations in machine learning,” 2020.
  * [135] E. Doynikova and I. Kotenko, “Countermeasure selection based on the attack and service dependency graphs for security incident management,” in _Risks and Security of Internet and Systems_. Cham: Springer International Publishing, 2016, pp. 107–124.
  * [136] Kaggle. Datasets of network intrusion detection. [Online]. Available: https://www.kaggle.com/datasets?search=Network+Intrusion+Detection
  * [137] PapersWithCode. Datasets of network intrusion detection. [Online]. Available: https://paperswithcode.com/task/network-intrusion-detection/codeless
  * [138] D. Gunning, M. Stefik, J. Choi, T. Miller, S. Stumpf, and G.-Z. Yang, “XAI—explainable artificial intelligence,” _Science Robotics_ , vol. 4, no. 37, Dec. 2019. [Online]. Available: https://doi.org/10.1126/scirobotics.aay7120
  * [139] AI4CYBER. About us. [Online]. Available: https://ai4cyber.eu/?page_id=219/#whoweare
  * [140] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” p. 6000–6010, 2017.
  * [141] A. Radford and K. Narasimhan, “Improving language understanding by generative pre-training,” 2018. [Online]. Available: https://api.semanticscholar.org/CorpusID:49313245
  * [142] I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-Voss, J. Wu, A. Radford, and J. Wang, “Release strategies and the social impacts of language models,” 08 2019.
  * [143] T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei, “Language models are few-shot learners,” in _Proceedings of the 34th International Conference on Neural Information Processing Systems_. Curran Associates Inc., 2020.
  * [144] N. Abdalgawad, A. Sajun, Y. Kaddoura, I. A. Zualkernan, and F. Aloul, “Generative deep learning to detect cyberattacks for the iot-23 dataset,” _IEEE Access_ , vol. 10, pp. 6430–6441, 2022.
  * [145] A. Shi, “Cyber attacks detection based on generative adversarial networks,” in _2021 2nd Asia Conference on Computers and Communications (ACCC)_ , 2021, pp. 111–114.