Strategic Cyber Decision-Making under Evolving Intelligence:

A Dynamic Bayesian Game-Theoretic Framework for AI-Assisted Cyber Threat Intelligence

Abstract

Artificial Intelligence (AI) is revolutionizing Cyber Threat Intelligence (CTI), facilitating quicker detection, analysis, and response to cyber threats with enhanced precision. But current studies on AI for CTI tend to focus exclusively on the engineering side of the problem, with a scope that includes threat detection, malware classification, anomaly detection and automated response, rather than the strategic aspects of information-gathering that takes place between adaptive attackers and defenders when information is incomplete. This research introduces a Dynamic Bayesian Game-Theoretic Framework that combines AI-assisted CTI with strategic decision-making in the presence of uncertainty. The proposed framework differs from traditional cyber security game models, which consider information as exogenous and fixed, by treating the quality of intelligence as an endogenous game variable, which is continuously evolving. In the face of ever-evolving attacks and counterattacks, defender beliefs are dynamically updated by Bayesian learning using AI-generated cyber intelligence, and attackers dynamically change their behavior based on defenders' actions, leading to strategic equilibrium evolving over repeated interactions. It embeds all these essential components of rational attacker-defender interaction, incomplete information, dynamic belief updating and AI supported intelligence generation within a single analytical model. The 2021 Colonial Pipeline ransomware attack is used to demonstrate how AI-driven CTI can increase situational awareness, speed up Bayesian belief updating, aid in defense decision-making, and minimize strategic uncertainty during ransomware attacks. This study adds value by incorporating AI-based CTI into DBGT, by making cyber intelligence more dynamic than a given information assumption, and by offering an analytical basis for adaptive cyber defense and critical infrastructure security via AI-driven intelligence.