A Situation Prediction Driven Stochastic‐Stackelberg Game Approach for Defense Decision‐Making in Industrial Internet

ABSTRACT In the highly interconnected industrial internet, security threats often exhibit multi‐stage and cross‐domain cascading characteristics. Traditional defense strategies that depend on static configurations are insufficient to support real‐time and anticipatory protection. To address this limitation, this paper proposes an industrial situation‐prediction‐driven role‐switching stochastic Stackelberg game method. First, we construct an industrial network situation prediction model constrained by attack graphs. By incorporating a reachability‐mask matrix and vulnerability exposure metrics, the proposed model enables interpretable and forward‐looking situation prediction while strictly preventing illegal state transitions. Then, we propose a role‐switching stochastic Stackelberg game framework that integrates leader‐follower role transitions induced by real‐time and predicted situations into a unified decision‐making model. Finally, we introduce a situation‐prediction‐driven multi‐agent reinforcement learning algorithm to approximate game equilibria, enabling efficient computation of optimal pre‐deployment defense strategies. Experimental results on a simulation testbed demonstrate that the proposed method improves prediction accuracy by approximately 11% over baseline approaches and completely eliminates unreachable state transitions. The prediction‐enhanced adaptive defense strategy reduces attack success rates by 57%, decreases critical asset loss by about 48%, and significantly extends the attack chain length, yielding a defense strategy that is both cost‐efficient and loss‐minimizing.