Multi-Channel Power Scheduling Based on Intrusion Detection System Under DDoS Attack: A Starkberg Game Approach

TL;DR

This paper proposes a game-based approach to optimize power allocation in wireless networks under DDoS attacks using an intrusion detection system.

Contribution

A novel intrusion detection system and power allocation strategy using a Stackelberg game framework under DDoS attacks.

Findings

The proposed IDS using packet reception rate improves intrusion detection accuracy.

Combining APF with DE algorithm effectively solves non-linear optimization problems.

Case studies confirm the effectiveness of the defense strategy under energy constraints.

Abstract

This study aims to explore the optimal power allocation problem under Distributed Denial of Service (DDoS) attack in wireless communication networks. The Starkberg Equilibrium (SE) framework is employed to analyze the strategic interactions between defenders and attacker under conditions of incomplete information. Considering the energy constraints of both sensors and attacker, this paper also proposes an Intrusion Detection System (IDS) based on remote estimation to achieve an optimal defense strategy, with Packet Reception Rate (PPR) serving as a criterion for intrusion detection. Targeting leaders and followers, the optimal power allocation solution is derived with Signal-to-Interference-Noise Ratio (SINR) and transmission cost as the objective functions. By combining the Adaptive Penalty Function (APF) method with the Differential Evolution (DE) algorithm, the study effectively addresses related non-linear and non-convex optimization problems. Finally, the effectiveness of the proposed method is verified through case studies.

Figures

Full text

1. Introduction

In recent years, cyber-physical systems (CPSs) have achieved fruitful results in the research field and have found extensive applications in domains including military defense, intelligent transportation, and smart grids [1,2,3,4,5]. However, due to the involvement of numerous critical infrastructures, any attack on CPSs can result in severe losses. With the emergence of various sophisticated intrusion techniques, attackers can disrupt network systems in a short period [6,7,8,9]. Major security incidents worldwide have highlighted the importance of CPS security issues. For example, in 2018, GitHub experienced 1.35 Tbps delayed traffic, leading to a 10 min service interruption; in September 2021, the Russian internet giant Yandex suffered a large-scale Distributed Denial of Service (DDoS) attack with requests per second reaching up to 21.8 million [10]. Therefore, with the rapid development of CPSs, the identification and prevention of network security intrusions have become particularly crucial.

In the literature [11,12,13], researchers have discussed the optimal power scheduling problem for Denial of Service (DoS) attacks based on Signal-to-Interference-plus-Noise Ratio (SINR) in CPSs, considering energy constraints of sensors and attackers. Li et al. [11] simulated the interaction decision-making process between sensors and attackers by establishing a Markov game framework. Ref. [12] proposed a Stackelberg Equilibrium (SE) framework to examine the strategic interaction between defenders and attackers in situations involving two distinct forms of incomplete information. Additionally, ref. [13] delved into a Stackelberg game involving a defender and multiple attackers. Distinguishing itself from the existing literature, which predominantly centers on equilibrium in static games, this study also reflects the dynamic process of Stackelberg games, demonstrating the intelligence of attackers in switching channel allocation for attack energy.

To ensure the security and reliability of network system resources, real-time monitoring of network transmissions is necessary to maintain confidentiality, integrity, and availability. The research in [14,15,16,17,18,19,20,21,22] proposes attack detection methods tailored to the constructed attack models, highlighting the existence of trade-off thresholds. In particular, the work in [19] designed a replay attack detection framework based on model-free reinforcement learning to effectively deal with attackers purposefully changing attack strategies. Furthermore, Agah et al. proved through a game theory framework that a Nash equilibrium is reached between attackers and Intrusion Detection System (IDS) [20]. In another study [22], a game-theoretic intrusion detection and defense method for DDoS attacks on the internet was proposed, modeling the interaction between the system and entities as a two-player Bayesian signal zero-sum game. These studies hold significant theoretical and practical value within the realm of network security, offering invaluable perspectives and solutions for real-time monitoring of network transmissions and the security of network system resources.

A Denial of Service (DoS) attack is a type of cyberattack where a single attacker floods a target system with excessive traffic or requests, aiming to overwhelm its resources and make it unavailable to legitimate users. The attack is typically launched from a single machine or a small number of machines [23,24,25,26,27,28]. A Distributed Denial of Service (DDoS) attack is a more advanced form of a DoS attack, where multiple compromised systems (often referred to as a “botnet”) are used to flood the target system with traffic. The distributed nature of the attack makes it much harder to defend against, as the traffic comes from many different sources, making it difficult to block all incoming connections without affecting legitimate users [6,29]. In most literature, Nash Equilibrium (NE) is commonly used to describe game situations where participants simultaneously choose actions. However, when decisions of defenders and attackers are made sequentially, the Stackelberg game framework is better suited to elucidate this procedure [12,30].

Although traditional DDoS attacks typically occur at the network layer, such as by flooding target servers with a large number of packets, physical layer attacks pose a significant threat in wireless sensor networks (WSNs). The open and interference-prone nature of wireless channels allows attackers to disrupt sensor node communications by transmitting high-power wireless signals, leading to degraded signal quality and even complete communication outages. Studies have shown that high-power interference can significantly reduce the signal-to-noise ratio (SINR) at the receiver, causing communication interruptions [31]. Additionally, physical layer attacks possess characteristics such as strong stealth and high energy efficiency, enabling attackers to achieve significant disruption with minimal energy expenditure [32]. To address this challenge, this study assumes that the attacker primarily influences system performance through physical layer interference. This assumption is supported by multiple studies that highlight the effectiveness of physical layer attacks in WSNs, especially under conditions of limited energy resources [33].

Unlike existing research, which typically assumes a static network environment and symmetric information between attackers and defenders [13,21], our study introduces dynamic channel changes, transmission costs, and the signal-to-interference-plus-noise ratio (SINR) into a Stackelberg game framework. This approach provides a more realistic simulation of real-world attack and defense scenarios. Additionally, our IDS uses remote state estimation for more precise detection, offering a clear advantage over traditional feature or anomaly-based methods. By considering energy constraints, environmental background noise, and time factors, we have developed a multi-stage Stackelberg game model that better reflects actual attack and defense interactions. These innovations significantly enhance system security and robustness, providing new theoretical and technical support for the field of wireless network security. The primary contributions of this research are outlined as follows:

1. Optimal energy scheduling under Distributed Denial of Service (DDoS) attack: The optimal energy scheduling problem is modeled in consideration of channels’ Signal-to-Interference-Noise Ratio (SINR) and transmission cost under Distributed Denial of Service (DDoS) attack. In the absence of an Intrusion Detection System (IDS), profit functions for the attacker and defenders are provided. To find the optimal solution, an improved differential evolution algorithm based on Adaptive Penalty Function (APF) is used to address the corresponding non-linear and non-convex optimization problems. Remote state estimation-based Detection System (IDS): We design an Intrusion Detection System (IDS) at the receiver end based on remote state estimation, using Packet Reception Rate (PPR) as the intrusion detection criterion. Unlike traditional feature- or anomaly-based methods [12,13], this approach is more suitable for real-world applications. Experimental results demonstrate that the presence of IDS can reduce the attacker’s profit and increase the defender’s profit. Multi-stage Stackelberg game model: A multi-stage Stackelberg game model is constructed to deal with the optimization problem, considering energy constraints of attacker and defenders, defenders’ awareness of environmental background noise, and introducing a time factor to build a finite-time Stackelberg game model. Compared to existing game models [12,13], our model better reflects the dynamic interactions between attackers and defenders, providing a more complex and realistic description of the attack and defense process. This new model offers valuable insights into developing effective defense strategies.

Notations: $[eqn]$ and $[eqn]$ represent the n-dimensional and m-dimensional Euclidean space. $[eqn]$ and $[eqn]$ represent the sets of natural numbers and nonnegative integers, respectively. The superscript $[eqn]$ denotes transpose. The symbols $[eqn]$ and $[eqn]$ represent the probability and expectation. $[eqn]$ is the aggregation of $[eqn]$ positive semidefinite matrices. $[eqn]$ is defined as $[eqn]$ for vectors x and y. $[eqn]$ . $[eqn]$ presents the spectral radius of a matrix. For any two functions f and g, their composition is defined as $[eqn]$ .

2. Model Setup

2.1. Process and Sensor Model

We consider discrete linear systems with multiple sensors as shown in Figure 1, consisting of a total of N independent discrete-time linear time-invariant systems and N sensors. The i-th sensor monitors the i-th system as follows:

$$[eqn]$$

where $[eqn]$ , the time index $[eqn]$ . $[eqn]$ is the state transition matrix, where $[eqn]$ is the dimension of the state vector $[eqn]$ . $[eqn]$ is the observation matrix, where $[eqn]$ is the dimension of the observation vector $[eqn]$ . $[eqn]$ and $[eqn]$ are independent zero-mean Gaussian white noises, satisfying $[eqn]$ , $[eqn]$ , $[eqn]$ , the covariance $[eqn]$ , $[eqn]$ , $[eqn]$ . The initial state $[eqn]$ is a zero-mean Gaussian random vector with covariance $[eqn]$ , which is uncorrelated with $[eqn]$ and $[eqn]$ . To avoid trivial issues, we assume that the system is unstable, i.e.,  $[eqn]$ , $[eqn]$ . We assume that $[eqn]$ is observable, and  $[eqn]$ is controllable.

We assume that the sensors are “smart” and have sufficient computational capabilities. Following the measurement of the respective system at time step k, every sensor initiates a local Kalman filter to gauge the state of the process, incorporating all amassed measurements up to time k [34]. Subsequently, each sensor forwards its local estimate to a remote estimator. Based on the local estimate of the current state, we can calculate the minimum error estimate $[eqn]$ of the local state of the i-th subsystem and the corresponding estimate error covariance matrix $[eqn]$ :

$$[eqn]$$ $$[eqn]$$

Computed by standard Kalman filtering [35]:

$$[eqn]$$

We further define the Lyapunov operator and Riccati operators $[eqn]$ and $[eqn]$ : $[eqn]$ :

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$

where ∘ denotes the k-fold composition of the function $[eqn]$ , i.e., the function $[eqn]$ applied consecutively k times. $[eqn]$ is an $[eqn]$ symmetric positive semi-definite matrix, representing the system’s covariance matrix or the estimation error covariance matrix.

The local estimate error covariance $[eqn]$ converges to a steady-state value at an exponential rate. Therefore, we make the assumption:

$$[eqn]$$

where $[eqn]$ is the unique positive semi-definite solution to $[eqn]$ .

2.2. Communication Model with SINR

After receiving the data packet, sensor i obtains a local estimate $[eqn]$ , which is then sent to the data fusion center through a wireless lossy channel. Due to channel attenuation and interference effects, random data loss occurs. To simulate this scenario, we assume that the channel uses an Additive White Gaussian Noise (AWGN) channel with Quadrature Amplitude Modulation (QAM) [11]. Subsequently, utilizing digital communication theory reveals the relationship between Symbol Error Rate (SER) and signal-to-noise ratio (SNR) [24]:

$$[eqn]$$

where $[eqn]$ is a parameter.

SNR can be described as:

$$[eqn]$$

where $[eqn]$ is the fading channel gain for channel i, $[eqn]$ is the background noise, $[eqn]$ represents the transmission power allocated by sensor i to channel i at time k, $[eqn]$ is the correlation coefficient between channels i and j.

We assume that DDoS attacks primarily occur at the physical layer, where the attacker interferes with sensor node communications by transmitting high-power wireless signals. If considering a DDoS attack on channel i, the SNR should be modified to the signal-to-interference-plus-noise ratio (SINR) as follows:

$$[eqn]$$

where $[eqn]$ is the fading channel gain for the attacker on channel i, and $[eqn]$ represents the transmission power allocated by the attacker to channel i at time k. Additionally, for sensors and attackers, the cost of transmitting unit power is assumed to be $[eqn]$ and $[eqn]$ , respectively. In CPSs, wireless channels are susceptible to external interference. Attackers can significantly reduce the SINR at the receiver by increasing the transmission power $[eqn]$ , thereby impacting the system’s performance.

2.3. DDoS Attack

Distributed Denial of Service (DDoS) attacks can block communication between components of cyber-physical systems (CPSs), thereby reducing the overall system performance. In current research, the attacker weakens system performance by continuously invading and maliciously disrupting communication channels. In real-life scenarios, energy constraints are an unavoidable issue for both sensors and attackers, impacting the performance of remote estimation and the strategies of both sides. Due to the presence of energy constraints, sensors need to manage energy efficiently to prolong their operational time, while attackers may exploit this limitation to design more destructive attack strategies. Therefore, when designing and deploying remote estimation systems, considering energy constraints is crucial for system stability and security. Attackers can use noise to interfere with communication channels between sensors and the fusion center.

In practical applications, both the defender and the attacker can estimate each other’s power levels by monitoring Channel State Information (CSI) or through other methods such as historical data analysis and predictive models [36,37]. Therefore, we assume that at time k, the defender knows the total power of the attacker is $[eqn]$ , and the attacker knows the total power of the defender is $[eqn]$ Here, $[eqn]$ represents the total power of the attacker across all channels at time k, while $[eqn]$ represents the total power of the defender across all channels at time k. On channel i, the total power of the attacker and the defender over the time horizon T is denoted as $[eqn]$ and $[eqn]$ , respectively, where $[eqn]$ . Within the entire time range T, the total power of the attacker and the defender across all channels is denoted as $[eqn]$ and $[eqn]$ , respectively, where $[eqn]$ .

In practical applications, attackers face energy budget constraints and therefore need to carefully decide whether to launch the DDoS attack on the wireless channel at each sampling instant. This strategic decision involves balancing the impact of the attack with energy expenditure. Attackers may formulate attack strategies based on system performance metrics, communication requirements, and their own energy resources. By effectively managing energy budgets and strategically timing attack, attackers can maximize the impact on the performance of remote estimators while ensuring their ability to sustain attack behavior. We use $[eqn]$ to represent the attacker’s attack on channel i at time k; otherwise, $[eqn]$ . Within a finite time domain T, the i-th communication channel suffers a DDoS attack denoted by $[eqn]$ , $[eqn]$ . If $[eqn]$ , then $[eqn]$ ; if $[eqn]$ , then $[eqn]$ . Within the time domain T, assuming the DDoS attacker applies constant interference power on the i-th communication channel, when the constant power $[eqn]$ is given, we can determine the total number of attacks on channel i within the time range T as $[eqn]$ .

Therefore, the attacker’s attack strategy $[eqn]$ can be represented as:

$$[eqn]$$

The energy constraint faced by the attacker is:

$$[eqn]$$

where $[eqn]$ and $[eqn]$ represent the lower and upper power limits of $[eqn]$ , respectively.

Similarly, we use $[eqn]$ to represent the i-th sensor selecting to transmit a data packet at time k; otherwise, $[eqn]$ . Within a finite time domain T, the i-th sensor sends data packets denoted by $[eqn]$ , $[eqn]$ . If $[eqn]$ , then $[eqn]$ ; if $[eqn]$ , then $[eqn]$ . Assuming the i-th sensor maintains a constant transmission power within the time domain T, when the constant power $[eqn]$ is given, we can determine the total number of data packets sent by the i-th sensor within the time range T as $[eqn]$ .

Therefore, the sensor’s transmission strategy $[eqn]$ can be represented as:

$$[eqn]$$

The energy constraint faced by the sensor is:

$$[eqn]$$

where $[eqn]$ and $[eqn]$ represent the lower and upper bounds of the transmission power $[eqn]$ , respectively.

2.4. Remote Estimation with a Lossy Channel

In each time step k, sensor i transmits its result from the local Kalman filter $[eqn]$ to a fusion center through a lossy communication channel. Let $[eqn]$ represent whether the data packet is received by the fusion center without errors. If it is successfully received, $[eqn]$ ; otherwise, $[eqn]$ . When an attacker launches an attack and blocks the channel, sensor data packets are received with a probability $[eqn]$ . Assume that $[eqn]$ follows a Bernoulli distribution and

$$[eqn]$$

Using $[eqn]$ to represent all the data packets received by the remote estimator at time step k, the remote estimator estimates the minimum mean square error $[eqn]$ and covariance $[eqn]$ of the remote end based on the received $[eqn]$ , as follows:

$$[eqn]$$ $$[eqn]$$

If $[eqn]$ is successfully received, it is used to estimate $[eqn]$ ; otherwise, the estimator forecasts the estimate using its prior estimate and the system model. Therefore, the minimum mean square error $[eqn]$ and covariance $[eqn]$ obtained by the remote estimator can be derived as follows:

$$[eqn]$$

At time k, $[eqn]$ can only take values from a finite set $[eqn]$ , where $[eqn]$ satisfies $[eqn]$ .

Therefore, we can represent the expected error covariance as:

$$[eqn]$$

3. Payoff Functions

This section will present the payoff functions of attackers and defenders in Figure 1 (Section 3.1), as well as the payoff functions of both parties with the presence of the Intrusion Detection System (IDS) detector in Figure 2 along with the corresponding constraint conditions (Section 3.2).

3.1. Rewards

We assume that the likelihood of the sensor perceiving solely background noise in the environment is denoted by $[eqn]$ . Therefore, the probability of a Intrusion Detection System (IDS) occurring is $[eqn]$ . The N systems we are considering are mutually independent, so we assume that the attack sequence for each system satisfies the following form:

$$[eqn]$$

where 1 represents the attacker choosing to attack the channel at this moment, and 0 represents the attacker choosing not to attack at this moment, satisfying: $[eqn]$ .

To evaluate the quality of estimation within the time interval T, we introduce the profit function of the attacker:

$$[eqn]$$

where

$$[eqn]$$

In (21), $[eqn]$ represents the total power cost for the attacker. Additionally, introducing $[eqn]$ in the attacker’s reward function aims to deplete the defender’s energy.

Similarly, we assume that the transmission sequence for each sensor satisfies the following form:

$$[eqn]$$

The equation to satisfy is $[eqn]$ .

To evaluate the quality of estimation within the time interval T, we introduce the profit function of the defender:

$$[eqn]$$

where

$$[eqn]$$

In (22), $[eqn]$ represents the total power cost for the defender.

3.2. Profit Function in the Presence of an IDS

In practical applications, when the estimator detects data loss due to unknown factors such as environmental changes or enemy intrusions, an Intrusion Detection System (IDS) is typically introduced at the receiving end, as shown in Figure 2, to effectively mitigate these influencing factors. This section introduces the concept of Packet Reception Rate (PRR) at the receiver end as a standard for intrusion detection. PRR refers to the ratio between successfully received packets by the estimator and the packets sent by the sensor. Therefore, $[eqn]$ can be expressed as:

$$[eqn]$$

The parameter $[eqn]$ represents the length of the time window, and the parameter $[eqn]$ represents the number of packets received on the i-th channel within that time window.

Remark 1.  When the packet reception rate is low, indicating a high packet loss rate, an Intrusion Detection System (IDS) may infer the presence of intruders in the system and issue an alert. To ensure the safe arrival of packets at the remote computer, sensors can adopt new technologies such as channel hopping. Channel hopping is a technique that dynamically changes channels during communication, enhancing the reliability and security of data transmission. Specifically, channel hopping technology switches between different channels at different time intervals, allowing packets to be transmitted through multiple channels. The benefit of this approach is that even if a specific channel experiences interference or packet loss, the system can still transmit data through other channels, improving the overall reliability of the communication link. By using channel hopping technology, sensors can select available channels to ensure that packets reach the remote computer safely, reduce the likelihood of packet loss, and enhance the performance and security of the system.

We assume that when $[eqn]$ , an alert will be triggered, where $[eqn]$ represents a predefined threshold value for triggering the alert.

Lemma 1. 

• $[eqn]$ , $[eqn]$ , where $[eqn]$ , $[eqn]$ .*

Proof. The triggering condition of the alarm $[eqn]$ is equivalent to $[eqn]$ . Therefore, we assume that the number of packet losses $[eqn]$ for the i-th channel in any time window is less than or equal to $[eqn]$ , which leads to $[eqn]$ . This contradicts the triggering condition $[eqn]$ ; thus, the assumption is not valid. By proof of contradiction, it is demonstrated that the triggering condition $[eqn]$ is also equivalent to $[eqn]$ .    □

From Lemma 1, it can be deduced that if the length of any attack sequence does not exceed $[eqn]$ , the attack will not be detected by the detector. In fact, the attacker can steal the values of time window $[eqn]$ and $[eqn]$ through the wireless channel, and then take action to carry out the attack. When the system has an IDS detector, the optimization of the payoff functions for the attacker and defender is as follows:

$$[eqn]$$ $$[eqn]$$

where

$$[eqn]$$

In reality, the attacker can eavesdrop on the values of time $[eqn]$ and $[eqn]$ through wireless channels before taking any attack actions. In order not to be detected by the IDS, on the basis of the optimal attack strategy of the attacker in (13), a constraint condition is added:

$$[eqn]$$

Both the sensor and the attacker aim to maximize their own objective functions. Under the premise of energy constraints, the optimal strategies for both sides need to be found, and the main problem 1 needs to be solved.

Problem 1.  The optimal attack schedule for the attacker:

$$[eqn]$$

and the optimal defense schedule for the defender:

$$[eqn]$$

4. Stackelberg Game for the Optimization Problem

The Stackelberg game is an important model in game theory. It describes a game process between a leader and a follower, where the defender, as the leader, formulates a strategy first, and the attacker reacts after observing the defender’s strategy. Both parties can formulate their own optimal strategies by analyzing the best response of the other party, and thus engage in a repeated game process, gradually approaching an equilibrium point. Under conditions of incomplete information, both parties need to infer the possible behaviors of the other party based on known information and probabilities, in order to formulate the optimal strategy. The elements of the Stackelberg game framework outlined in this paper are as follows:

• Players: N sensors and a Distributed Denial of Service (DDoS) attack.
• Strategy: The strategies of the defender and attacker are, respectively, $[eqn]$ and $[eqn]$ .
• Reward: The reward function of the defender is $[eqn]$ , and the reward function of the attacker is $[eqn]$ .
• Interaction: A continuous-time two-stage dynamic game. First, the defender makes a decision as the leader, and then the attacker makes their own decision based on the defender’s decision, and so on.

We define the best responses of both sides in the game as follows [38].

Definition 1.  The best response is the action that brings the maximum return to a player while taking into account the actions of the other players. Specifically, the best responses for the defender and attacker are $[eqn]$ and $[eqn]$ , respectively.

Theorem 1.  The solution of the Stackelberg game first involves calculating:

$$[eqn]$$

then computing

$$[eqn]$$

Thus, $[eqn]$ represents the equilibrium solution of the Stackelberg game.

Proof. When the defender’s defense strategy $[eqn]$ is given, the attacker chooses the attack strategy as $[eqn]$ . The defender is aware of this reaction from the attacker, so the defender will choose a corresponding defense strategy to maximize their payoff $[eqn]$ , which can be represented as:

$$[eqn]$$

Upon observing the defender’s strategy $[eqn]$ , the attacker responds accordingly to determine the optimal strategy $[eqn]$ :

$$[eqn]$$

Proof completed.    □

Remark 2.  The Stackelberg equilibrium $[eqn]$ and the Nash equilibrium $[eqn]$ have significant differences. In the Stackelberg model, the leader first chooses the strategy $[eqn]$ , and then the follower selects the optimal response $[eqn]$ based on the leader’s strategy. This sequential decision making mechanism allows the leader to optimize global performance, maximize the system’s total utility, and enhance security. In contrast, in the Nash equilibrium, all participants choose their strategies simultaneously, with each participant’s strategy considering only their own interests, which can lead to suboptimal solutions, especially in cases of conflict or competition. Additionally, the Stackelberg model typically offers better stability and predictability, making it suitable for long-term planning and global optimization scenarios. On the other hand, the Nash model may exhibit higher short-term utility in environments with high information transparency and ideal market conditions, but it tends to be less stable in dynamic and complex environments. The Stackelberg equilibrium must satisfy the following conditions:

$$[eqn]$$ $$[eqn]$$

Considering the conditions that need to be met in problem 1, we design the attacker’s best response through the following optimization problem:

Problem 2. 

$$[eqn]$$

which is equivalent to the following problem:

Problem 3. 

$$[eqn]$$

Then, by calculation, we can obtain

$$[eqn]$$

and

$$[eqn]$$

The results indicate that when $[eqn]$ and $[eqn]$ , we have $[eqn]$ . Clearly, for all $[eqn]$ , we have $[eqn]$ . The attacker can observe the defense strategy chosen by the defender; therefore, they only launch attacks upon detecting the transmission of sensor data to save energy. We assume that at time k, if  $[eqn]$ , then $[eqn]$ ; if $[eqn]$ , then $[eqn]$ , where $[eqn]$ , ψ denotes the number of $[eqn]$ . Therefore, (36) can be solved through the following convex optimization problem:

Problem 4. 

$$[eqn]$$

where

$$[eqn]$$

Theorem 2.  If the defender’s strategy is θ, then the attacker’s best response can be calculated by the following formula:

$$[eqn]$$

where $[eqn]$ is obtained from the following equation:

$$[eqn]$$

Proof. We define the Lagrangian function at each time point k as:

$$[eqn]$$

where $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ . Thus, the Karush–Kuhn–Tucker (KKT) conditions can be represented as:

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Through Equations (44) to (52), we systematically verify each part of the KKT conditions. Equation (44) ensures that the gradient of the objective function, when combined linearly with the Lagrange multipliers of all constraints, is zero, thereby satisfying the stationarity condition. Equations (45) to (49) ensure that all primal feasibility and dual feasibility conditions are met, including constraints such as energy limits and transmission power limits. Equations (50) to (52) utilize the complementary slackness conditions to determine which constraints are active, i.e., which constraints are binding at the optimal solution, where

$$[eqn]$$

Define $[eqn]$ . Therefore, the relationship between $[eqn]$ and $[eqn]$ is given by (41).    □

Remark 3.  It should be noted that $[eqn]$ is crucial for designing the optimal strategy $[eqn]$ and the parameters $[eqn]$ should be computed first. However, since $[eqn]$ is not easily computable, we provide Algorithm 1 to solve for it.

Algorithm 1 Calculating parameter $[eqn]$

• 1:Calculate $[eqn]$
• 2:Sort $[eqn]$ : $[eqn]$
• 3:Find $[eqn]$ such that $[eqn]$ , where $[eqn]$
• 4:if $[eqn]$ , then $[eqn]$

The defender’s best response can be obtained by solving the following optimization problem:

$$[eqn]$$

where $[eqn]$ .

Theorem 3.  If $[eqn]$ is given, then there exists $[eqn]$ , so the defender’s best strategy can be $[eqn]$ . After obtaining $[eqn]$ , Algorithm 2 can be used to calculate $[eqn]$ . Therefore, $[eqn]$ is the Stackelberg equilibrium.

Algorithm 2 APF-based Differential Evolution

• 1:Construct adaptive penalty function: $[eqn]$ where $[eqn]$ , $[eqn]$ , $[eqn]$
• 2:Initialize:  $[eqn]$ represents an N-dimensional variable, where $[eqn]$ and G is the generation. Choose $[eqn]$ , where $[eqn]$ , $[eqn]$ and $[eqn]$ .
• 3:Variation: Generate variogram vector, as follows: $[eqn]$ , where $[eqn]$ and $[eqn]$ , and the adaptive mutation operator F can be given by $[eqn]$ , where $[eqn]$ . $[eqn]$ represents the maximum generation.
• 4:Crossover: Denote $[eqn]$ , If  $[eqn]$ ,     $[eqn]$

else      $[eqn]$ where $[eqn]$ is crossover operator, and  $[eqn]$ is a sequence selected randomly.

To obtain the defender’s strategy, the optimization problem (54) needs to be solved. However, due to the nonlinearity and possible non-convexity of the reward function $[eqn]$ , solving (54) is not easy. This paper combines the Adaptive Penalty Function (APF) method and the Differential Evolution Algorithm to handle related non-convex and nonlinear optimization problems [39]. Algorithm 2 details the main steps of the Differential Evolution algorithm based on APF. Differential Evolution (DE) is an efficient global optimization algorithm suitable for nonlinear, non-convex, and multimodal problems. Artificial Potential Field (APF) is a path-planning method that quickly finds feasible paths using potential fields. By combining DE and APF, we leverage DE’s global search capabilities to find the global optimum and APF’s local guidance to speed up convergence. This integration enhances optimization efficiency and better handles complex environments and constraints. Once $[eqn]$ is obtained, the attacker’s best response $[eqn]$ can be calculated according to Theorem 2.

5. Simulations

In this section, we use numerical examples to demonstrate the theoretical results of the Stackelberg game strategies under the presence of Intrusion Detection System (IDS) detectors as proposed in this paper. We set the following parameters: $[eqn]$ $[eqn]$ $[eqn]$ $[eqn]$ . To further validate the proposed framework’s effectiveness in practical wireless communication, we refer to recent experiments using real-world datasets and testbeds. For instance, ref. [40] evaluated a similar strategy on an IEEE 802.11-based testbed, showing improved throughput and SINR under interference. Similarly, ref. [41] used USRP devices to simulate a multi-user environment and showed effective attack mitigation while maintaining high communication quality. These studies demonstrate advantages and achievements from different perspectives, providing useful references. It is worth noting that our proposed framework includes an IDS detector. Compared with [12], its uniqueness is introducing this detector at the estimator end. This innovation makes our framework more effective in practical scenarios. Through in-depth analyses, we find it more robust and applicable, offering more reliable guarantees and better performance.

When the IDS does not exist in the system model, as shown in Figure 1, the reward functions of both sides are as given by Equations (21) and (22). Keeping other parameters constant, we can establish the relationship between time k and the reward functions of both sides, as shown in Figure 3. In this paper, we have designed an IDS at the remote estimator end, as depicted in Figure 2. By choosing $[eqn]$ and $[eqn]$ , we are able to obtain the relationship between time k and the reward functions of both sides, as shown in Figure 4, as well as the strategic choices of both participants when reaching equilibrium in Figure 5. The three graphs from top to bottom in Figure 5, respectively, display the strategy values of attackers and defenders on channels 1, 2, and 3. By comparing Figure 3 and Figure 4, it can be observed that the proposed IDS detector in this paper can reduce the reward value of attackers and effectively increase the reward value of defenders. In Figure 4, after each participant undergoes 650 iterations, the reward function converges to the optimal value.

By solving Theorem 2 and Algorithm 2, the relationship between the boundary values $[eqn]$ , $[eqn]$ triggering alarms in the IDS detector, and the reward values of both players is illustrated in Figure 6. We choose $[eqn]$ and $[eqn]$ . The first graph in Figure 6 represents the reward function of the defender, while the second graph illustrates the reward function of the attacker. From the graph, we can conclude that when $[eqn]$ is fixed, $[eqn]$ has a significant impact on $[eqn]$ , with an increase in $[eqn]$ corresponding to a larger $[eqn]$ . The influence of $[eqn]$ on $[eqn]$ is minimal. When $[eqn]$ is determined, changes in $[eqn]$ result in different reward values for both players in the game. As $[eqn]$ transitions from 0 to 1, it is evident that the reward function value of the attacker sharply decreases, while the defender’s reward value slightly increases. For $[eqn]$ the attacker’s reward value exhibits minor periodic fluctuations, while the defender’s reward value remains relatively stable.

In the simulation, we can select the range of values for $[eqn]$ based on the communication constraints of each channel, which in turn affects the optimization results. Therefore, the results obtained may not be the optimal solution but a suboptimal one. Given this, the nonlinear and non-convex optimization proposed in this paper can provide a feasible solution. In Figure 4, we have chosen $[eqn]$ . If we set $[eqn]$ , the reward function values for both parties are depicted in Figure 7.

Our optimization scheme combines the global search capabilities of Differential Evolution (DE) with the local guidance advantages of the Artificial Potential Field (APF) method. The time complexity of DE is $[eqn]$ , where $[eqn]$ is the population size, G is the maximum number of iterations, and D is the dimensionality of each individual. This complexity arises from the matrix operations involved in evaluating the fitness function. The time complexity of APF is $[eqn]$ , primarily dependent on the number of nodes N and the size of the channel gain matrix H. Therefore, the overall time complexity of our combined approach is $[eqn]$ . Based on our current experimental setup ( $[eqn]$ ), the average runtime is 2.5 s. Although these experiments were conducted on a smaller scale, we can extrapolate the performance for larger scales by adjusting parameters (e.g., $[eqn]$ ). Our complexity analysis suggests that while runtime will increase, it will remain within a reasonable range. To evaluate real-time performance, we simulated a scenario requiring one optimization decision per second. Under current settings, the optimization completes within 1 s, meeting real-time requirements. However, for larger problem scales, we may need to adjust parameters, such as reducing population size or lowering the number of iterations, to maintain real-time performance. We also explored parallel computing, where processing individuals across multiple nodes can significantly reduce runtime without sacrificing optimization effectiveness. This approach is a promising direction for future research.

6. Conclusions

This study aims to explore the optimal power control problem when the wireless channel undergoes Distributed Denial of Service (DDoS) attacks with the presence of an Intrusion Detection System at the remote estimator. Considering the impact of the attacker on the wireless channel, we quantify it using signal-to-noise ratio as a metric. To address this, we propose a Stackelberg game framework to analyze the game situation when both sides are in an incomplete information state. In such scenarios, the optimal strategy relationship between attackers and defenders can be determined through Karush–Kuhn–Tucker (KKT) conditions. We employ a Differential Evolution (DE) method based on Artificial Potential Field (APF) to design the optimal strategy for the defense side. Finally, we not only provide specific steps to solve the corresponding optimization problem but also observe that this optimization scheme can effectively reduce the reward function value for attackers and simultaneously increase the reward value for defenders when an Intrusion Detection System exists at the remote estimator. In future work, we plan to investigate integrated defense strategies that combine DDoS attacks with other network attacks (e.g., man-in-the-middle attacks, data tampering). By developing a multi-layered, multi-dimensional defense system, we aim to enhance overall security and improve the system’s resilience against complex attack environments.