The rise of Agentic AI, driven by advances in Large Language Models (LLMs), has enabled the design of autonomous multi-agent systems capable of strategic coordination in adversarial environments. This paper introduces a Gestalt games-in-games framework for modeling and orchestrating agentic AI workflows in cyber operations, particularly emphasizing cyber deception. The proposed framework captures two interwoven layers of decision-making: a workflow-level coordination game among agents assigned to interdependent tasks, and task-level adversarial games where agents confront strategic attackers. We formalize this structure using a layered stochastic game model and introduce the Gestalt-Nash Equilibrium, a joint solution concept that unifies local adversarial reasoning with global workflow optimization. To enable reasoning and coordination within this framework, we develop LLM-assisted decision algorithms that integrate prompt-based reasoning, rollout planning, and utility-guided adaptation. We demonstrate the practical value of this approach through a detailed case study on Mirai botnet deception in a software-defined networking (SDN) environment. Our results show that the LLM-enabled algorithm significantly improves deception effectiveness, reduces compromise rates, and increases attacker uncertainty and wasted effort over time. This work establishes a principled foundation for the design of modular, adaptive, and strategically aligned agentic AI systems in cybersecurity.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Gestalt Game-Theoretic Framework for Designing Agentic AI Workflows in Cyber Deception

  • Muhammad Akram Al Bari,
  • Quanyan Zhu

摘要

The rise of Agentic AI, driven by advances in Large Language Models (LLMs), has enabled the design of autonomous multi-agent systems capable of strategic coordination in adversarial environments. This paper introduces a Gestalt games-in-games framework for modeling and orchestrating agentic AI workflows in cyber operations, particularly emphasizing cyber deception. The proposed framework captures two interwoven layers of decision-making: a workflow-level coordination game among agents assigned to interdependent tasks, and task-level adversarial games where agents confront strategic attackers. We formalize this structure using a layered stochastic game model and introduce the Gestalt-Nash Equilibrium, a joint solution concept that unifies local adversarial reasoning with global workflow optimization. To enable reasoning and coordination within this framework, we develop LLM-assisted decision algorithms that integrate prompt-based reasoning, rollout planning, and utility-guided adaptation. We demonstrate the practical value of this approach through a detailed case study on Mirai botnet deception in a software-defined networking (SDN) environment. Our results show that the LLM-enabled algorithm significantly improves deception effectiveness, reduces compromise rates, and increases attacker uncertainty and wasted effort over time. This work establishes a principled foundation for the design of modular, adaptive, and strategically aligned agentic AI systems in cybersecurity.