Cybersecurity researchers have unveiled a new game-theoretic framework that promises to make one of the field’s most promising proactive defense techniques dramatically cheaper to deploy. The framework, called the Multiple Target Moving Target Defense Model, or MT2M, was developed by Jamil Ahmad Kassem and Helena Rifà Pous of the Universitat Oberta de Catalunya and the CYBERCAT Center for Cybersecurity Research of Catalonia, together with Joaquin Garcia-Alfaro of Télécom SudParis, Institut Polytechnique de Paris. Writing in the Journal of Network and Systems Management, the team reports that their approach achieves security comparable to existing moving target defense strategies while cutting defense costs by up to fifteen percent. The work addresses a persistent obstacle that has kept moving target defense largely confined to research settings: the operational expense of constantly shuffling resources across a network to confuse attackers.
Moving target defense, an active defensive technique rooted in military practice and later adapted to secure digital communications, works by continuously changing the attack surface that adversaries must contend with. A classic example is the periodic rotation of IP addresses, which increases attacker uncertainty and forces adversaries to continuously re-learn the topology they intend to compromise. The technique reduces dependence on prior knowledge of specific attack strategies, focusing instead on managing system vulnerabilities proactively. But this constant motion comes at a price. Against rational adversaries targeting critical infrastructures with persistent denial-of-service attacks and information disclosure threats, the cost of continuously relocating resources can balloon beyond what most organizations are willing or able to pay. The stakes are far from abstract: a twelve-hour interruption at the Apple Store once carried a financial impact of twenty-five million dollars, a five-hour outage at Delta Airlines led to two thousand canceled flights and one hundred fifty million dollars in economic losses, and even small businesses face downtime costs averaging nine thousand dollars per minute.
At the heart of the new model lies a classical construction from game theory known as the Bayesian Stackelberg game. In this two-player formulation, the network administrator acts as the leader, making defense decisions while anticipating the response of the adversary, who acts as the follower. Crucially, the leader must account for uncertainty in the follower’s preferences and adjust strategy accordingly. This structure mirrors the asymmetric information environment of real cyber conflicts. The adversary in MT2M’s formulation is persistent, adaptive and resourceful, operating under conditions of uncertainty and ambiguity. Such an attacker typically follows a structured progression, beginning with reconnaissance to gather intelligence about system architecture and network topology, moving on to vulnerability identification, and culminating in exploitation through methods ranging from distributed denial-of-service attacks and zero-day exploits to insider threats and ransomware. Because the attacker cannot observe internal configurations or the true importance of individual resources, they rely on probabilistic estimations derived from external observations, treating all resources as if they shared the system-wide average criticality. The defender, by contrast, knows the actual criticality of each resource and can exploit this knowledge gap.
The technical core of MT2M is a mathematical representation of the network as a set of nodes and resources, where nodes correspond to communication paths and resources correspond to critical services such as web applications, databases and API gateways. The defender’s strategic choices are encoded in a probability matrix that captures the likelihood of each resource residing at each node. The expected impact of an attack on any node is computed as the dot product of the relevant matrix column and the resource criticality vector. The defender’s total cost combines this expected attack impact with the cost of executing the defense itself, which depends on movement costs, the frequency and method of resource movement, and the waiting time before each resource relocates, since consistent movement patterns increase predictability and vulnerability. Prioritizing the timing dimension of defense decisions, the model deliberately optimizes when to apply defensive changes, complementing existing work on how to implement them and which assets to protect.
Perhaps the most significant technical achievement of the study is the transformation of an intractable computational problem into a tractable one. Optimizing resource allocation in this setting is formally equivalent to variants of the subset sum problem and the multi-container packing problem, both of which are strongly NP-hard, meaning their complexity grows exponentially with network size. Exhaustive search over possible resource configurations quickly becomes impossible even for modest networks, and earlier game-theoretic moving target models frequently depended on such brute-force approaches or on oversimplified formulations that sacrificed optimality. The researchers sidestepped this barrier by demonstrating that the NP-hard cost optimization can be reformulated as a linear problem that scales gracefully. Their algorithm proceeds in stages, first balancing the criticality distribution across all nodes to minimize expected attack impact, then consolidating resources within single nodes to minimize movement frequency, and finally distributing movement costs across multiple resources rather than concentrating them on a single one. The resulting computation carries a time complexity of order m times n, where m is the number of resources and n the number of nodes, a negligible overhead that makes deployment in large networks feasible.
The model was evaluated across three scenarios of increasing realism. In the constant scenario, all resources carry equal criticality, serving as a foundational baseline. In the variable scenario, resources differ in importance, reflecting realistic conditions where denial-of-service attacks may simultaneously target assets of disparate value, as in the 2015 BlackEnergy attack on Ukraine’s power grid that caused a system-wide outage. In the single-target scenario, nodes are capacity-limited and can host only one resource at a time, modeling focused attacks such as phishing or man-in-the-middle campaigns. Simulations were run in MATLAB, repeated one hundred times per configuration, with system variables including node count, resource count, total criticality and the standard deviation of criticality varied systematically. A practical use case consisting of twenty hosts connected through six communication paths was also constructed in the Mininet network simulator to demonstrate the framework’s applicability to software-defined networking environments built on OpenFlow protocols.
The results revealed several counterintuitive insights with direct operational implications. From the defender’s perspective, MT2M performed identically to a baseline model that maximizes security through continuous resource movement, meaning actual security was never sacrificed. Yet from the adversary’s perspective, the expected impact appeared higher under MT2M, an effect arising because the attacker, lacking knowledge of individual resource criticalities, overestimates the value of what it can destroy. This information asymmetry creates a genuine dilemma for the attacker: either strike the node that appears most attractive but actually contains low-criticality resources, or target the genuinely critical resource in a node with a lower apparent attack success rate. The number of resource movements, a key driver of operational cost, was markedly lower under MT2M than under competing models. The researchers also found that increasing the number of nodes and resources benefits the defender by expanding the maneuvering margin, and that a diverse mix of high and low criticality resources increases adversary uncertainty and thereby strengthens the defense.
Benchmarking against entropy, a standard measure of unpredictability in moving target systems, further validated the approach. Higher entropy indicates greater variability in resource placement, making the system harder for adversaries to predict and target. While the entropy-maximizing baseline achieved the theoretical maximum unpredictability, it did so at the highest possible cost. MT2M matched the baseline’s security performance at a substantially lower expense, with defense costs rising much more slowly as the network grows. When compared specifically with prior Stackelberg-based moving target models, including work by Feng and colleagues that integrates deception and false messaging, and earlier work by Kassem and colleagues that handled multiple resources but assumed uniform criticality, MT2M occupied a distinctive position: slightly lower entropy than the maximum achievable, but with a cost profile that makes sustained deployment economically realistic. The criticality standard deviation emerged as the crucial variable determining MT2M’s advantage, with models relying on average criticality showing progressively deteriorating performance as resource values diverge.
The framework is also designed for practical implementation on existing infrastructure. The researchers outline deployment paths using container orchestration systems such as Kubernetes, including dynamic service relocation through ingress controllers and service meshes, dynamic load redistribution via node affinity policies, ephemeral services with autogenerated secrets, network path randomization, adaptive scaling with moving target logic, and serverless-based movement of critical functions into environments like AWS Lambda or Google Cloud Functions where execution contexts are ephemeral and distributed. These implementation scenarios suggest that organizations need not rebuild their networks from scratch to benefit from cost-optimized moving target defense; the framework can be layered onto contemporary cloud-native architectures using tools that many operations teams already manage.
The authors acknowledge important limitations that define the research frontier. MT2M assumes a single adversary with relatively static behavior and a fixed system state, functioning primarily as a pre-attack planning tool that can be re-optimized between attack instances rather than adapted in real time. Real systems often face multiple adversaries with varied skill levels, and real adversaries adapt their strategies in response to defenses. Future research directions include incorporating reinforcement learning to develop defense policies that evolve with observed attacker behavior, relaxing the static adversary assumption with learning-based attacker models to test whether cost benefits persist across repeated interactions, and developing methodologies to assess and prioritize different segments of the attack surface. By converting the daunting mathematics of strategic cyber defense into a linear, scalable computation, MT2M moves moving target defense one step closer to becoming an affordable standard practice rather than an expensive theoretical ideal.
Subject of Research: Strategic cost-based optimization of cyber defense using Bayesian Stackelberg game theory and moving target defense techniques
Subject of Research: Technology and Engineering
Article Title: MT2M: Strategic Cost-Based Optimization of Cyber Defense in Variable Constraints Systems
Article References: Kassem, J. A., Pous, H. R., & Garcia-Alfaro, J. (2026). MT2M: Strategic Cost-Based Optimization of Cyber Defense in Variable Constraints Systems. Journal of Network and Systems Management, 34(4), Article 105. https://doi.org/10.1007/s10922-026-10068-z
Image Credits: AI Generated
DOI: 10.1007/s10922-026-10068-z
Keywords: Cybersecurity, Moving target defense, Cyber defense, Game theory, Bayesian Stackelberg game, Cost optimization, Network security, Resource allocation, Denial-of-service attacks, NP-hard optimization, Software-defined networking, Logic model
Cite Scienmag News
APA
MLA
Chicago
Hailey Crawford. (September 11, 2026). MT2M: Cost-Driven Strategy for Cyber Defense Under Changing Constraints. Scienmag. https://scienmag.com/mt2m-cost-driven-strategy-for-cyber-defense-under-changing-constraints/
Hailey Crawford. “MT2M: Cost-Driven Strategy for Cyber Defense Under Changing Constraints.” Scienmag, 11 September 2026, https://scienmag.com/mt2m-cost-driven-strategy-for-cyber-defense-under-changing-constraints/. Accessed 11 September 2026.
Hailey Crawford. “MT2M: Cost-Driven Strategy for Cyber Defense Under Changing Constraints.” Scienmag. September 11, 2026. https://scienmag.com/mt2m-cost-driven-strategy-for-cyber-defense-under-changing-constraints/
Copy citation
Download RIS
Tags: attacker uncertainty enhancement techniquescost-benefit analysis in cyber defensecost-effective cyber defense strategiescost-efficient cyber defensecybersecurity game theorycybersecurity game-theoretic frameworkcybersecurity research innovationsdynamic attack surface managementgame-theoretic cybersecurity modelsmilitary-inspired cyber defensemoving target defense strategiesmultiple target moving target defensenetwork security resource allocationnetwork shuffling techniquesoperational costs of cyber defenseoptimizing moving target defense deploymentproactive cybersecurity measuresproactive cybersecurity techniquesreducing operational cybersecurity costsresearch on cost-efficient cybersecurity solutionsresource shuffling in network securityshifting defense strategies in cybersecuritythreat uncertainty enhancement
