Lu-Xing Yang杨橹星杨橹星Lu-Xing Yang

School of Information Technology, Deakin University迪肯大学信息技术学院

Lu-Xing Yang杨橹星 杨橹星Lu-Xing Yang

Senior Lecturer in Cybersecurity
School of Information Technology, Deakin University, Melbourne 网络安全高级讲师
澳大利亚迪肯大学 信息技术学院

My research gives defenders a mathematical basis for deciding when, where and how hard to act against threats that spread through networks. 威胁在网络里扩散时，防御方该在什么时候、在哪里、用多大力度出手？我的研究为这些决定提供数学依据。

How close can you get to the optimized schedule? Try it in Fig. 1你能多接近优化方案？在图 1 里试试

My work covers malware, advanced persistent threats, social engineering and rumors. In each case the defender has incomplete information and limited resources, and the attacker adapts. To work out what the defender should do, I combine complex network dynamics, game theory and optimal control with single- and multi-agent reinforcement learning. 研究对象有恶意软件、高级持续性威胁、社会工程攻击和谣言。防御方往往信息不全、资源有限，攻击者还会不断调整做法，我关心的是这时该怎样决策。方法上以复杂网络动力学、博弈论和最优控制为基础，结合强化学习和多智能体强化学习。

I am strongly committed to cybersecurity research that holds up mathematically and works in practice, and to training the researchers who will take it further.我致力于做数学上严谨、实际中用得上的网络安全研究，也重视培养能把这些工作继续推进的研究者。

Now当前I am working on piecewise-constant (HOLD) games and multi-agent reinforcement learning, applied to cyber attack and defense and to containing rumors and disinformation. I am also combining large language models with cybersecurity and game theory. 我主要在做分段常数（HOLD）博弈和多智能体强化学习，用在网络攻防和谣言、虚假信息遏制上；另一个重点是把大语言模型和网络安全、博弈论结合起来。Current focus当前研究重心

Expected cost in the node-level model, same total effort总投入相同时，节点级模型下的期望成本

Fig. 1. An attack–defense model on a scale-free network of 72 hosts. Malware spreads from host to host. An infection can be detected only 10 steps after it starts, and only detected infections can be patched. (a) Red hosts are infected, and a ring marks a detected infection. Teal hosts have been patched or have recovered on their own. Click any host to infect it. (b) Shares of hosts infected and recovered (top), and the defender’s patch rate, the chance per step that each detected infection is patched (bottom). The 150-step response window opens at the first alert. (c) Expected cost over the window in the node-level model of this network: the share of hosts infected (red) plus an effort cost that grows with the square of the patch rate (blue). The three patching schedules spend the same total effort. The constant schedule keeps one rate throughout. The PMP schedule is the one Pontryagin’s maximum principle gives for this model and cost. Its rate changes at every step, which is hard to carry out in practice, so it serves as a benchmark. The HOLD schedule is one a defender can actually follow: it sets a rate at the alert and changes it only every 25 steps, holding it in between. Its six rates give the lowest cost that six held rates can reach; a check of all 5,243,014 schedules that can be set under You found none lower. Both act hardest soon after the alert and ease off as the outbreak shrinks. With six commands instead of 150, HOLD costs only 0.5 more than the benchmark. The animation in (a) and (b) is one random run on the same network. The buttons below the figure switch between the schedules. Choose “You” and drag the six steps in (b) to set the held rates yourself, and see how close you can get to HOLD.

图 1　72 台主机组成一张无标度网络，恶意软件在主机之间传播。感染发生 10 步以后才能被发现，防御方只能修补已发现的感染。(a) 红色是已感染主机，外面的圆环表示这处感染已被发现；青色是已恢复的主机，可能是防御方修补的，也可能是自行恢复的。点击任一主机，它就会被感染。(b) 上方是感染和已恢复主机所占比例；下方是防御方的修补率，即每个已发现的感染在每一步被修补的概率。响应窗口从第一次告警开始，共 150 步。(c) 这张网络的节点级模型下，窗口内的期望成本：被感染主机的比例（红色）加上投入成本（蓝色），投入成本随修补率的平方增长。三种修补方案的总投入相同。恒定方案始终用同一个修补率。PMP 方案由庞特里亚金最大值原理针对这个模型和成本求出；它的修补率每一步都在变，实际中很难执行，所以用作对照基准。分段常数（HOLD）方案是防御方实际能执行的：告警时定下修补率，之后每 25 步才调整一次，中间保持不变。它的六个取值达到了六段保持能做到的最低成本：“你来”里能设定的 524 万余种方案全部检查过，没有一种成本更低。两种方案都在告警后不久力度最大，随着感染范围缩小逐步放缓。HOLD 只需 6 条命令，PMP 要 150 条，成本只高出 0.5。(a) 和 (b) 的动画是这张网络上的一次随机运行。图下方的按钮可以在各方案之间切换。选“你来”，可以拖动 (b) 里的六级台阶自己设定六段修补率，看看能多接近分段常数方案。

  • 100+papers published发表论文
  • 3,988Google Scholar citationsGoogle Scholar 引用
  • 36h-indexh 指数
  • 7papers in IEEE TIFSIEEE TIFS 论文
  • AUD 1.2M+research funding as CI主要研究者经费
  • 8PhD students graduated已毕业博士生

Citation figures from Google Scholar, October 2026.引用数据来自 Google Scholar，2026 年 10 月。

Recent news近期动态

  1. “Compromise-age malware dynamics and shared-capacity defense on directed networks” accepted in Applied Mathematical Modelling.论文 Compromise-age malware dynamics and shared-capacity defense on directed networks 被 Applied Mathematical Modelling 录用。

  2. Congratulations to Dr. Mousa Tayseer Mousa Ja’far, whose PhD thesis, A Hybrid Intelligent Framework to Mitigate Cybersecurity Attacks in Internet of Things Networks, has been approved for conferral.祝贺 Mousa Tayseer Mousa Ja’far 获批授予博士学位，博士论文为 A Hybrid Intelligent Framework to Mitigate Cybersecurity Attacks in Internet of Things Networks。

  3. Named among Research.com’s Best Computer Science Scientists 2026.入选 Research.com 2026 全球最佳计算机科学家榜单。

  4. “Mitigating Insider-Facilitated Advanced Persistent Threat: A Three-Player Differential Game Approach” accepted in IEEE Transactions on Information Forensics and Security.论文 Mitigating Insider-Facilitated Advanced Persistent Threat: A Three-Player Differential Game Approach 被 IEEE TIFS 录用。

  5. “Modeling and Mitigating Social Engineering Malware” (IEEE TIFS) was selected as an IEEE Signal Processing Society Paper Spotlight.IEEE TIFS 论文 Modeling and Mitigating Social Engineering Malware 入选 IEEE 信号处理学会（Signal Processing Society）Paper Spotlight。

  6. Promoted to Senior Lecturer at Deakin University.晋升为迪肯大学高级讲师。

  7. Congratulations to Dr. Xiaojuan Cheng, whose PhD thesis, Modeling and Analysis of Cyberwar, has been approved for conferral.祝贺 Xiaojuan Cheng 获批授予博士学位，博士论文为 Modeling and Analysis of Cyberwar。

  8. “Attack Graph-Epidemic Hybrid Modeling for Mitigating Cyber Threats Propagation” accepted in IEEE Transactions on Computational Social Systems.论文 Attack Graph-Epidemic Hybrid Modeling for Mitigating Cyber Threats Propagation 被 IEEE TCSS 录用。

  9. “Modeling and Mitigating Social Engineering Malware: Integrating Malware-Opinion Dynamics With Optimal Impulse Control Approaches” accepted in IEEE Transactions on Information Forensics and Security.论文 Modeling and Mitigating Social Engineering Malware: Integrating Malware-Opinion Dynamics With Optimal Impulse Control Approaches 被 IEEE TIFS 录用。

  10. Elevated to IEEE Senior Member.成为 IEEE 高级会员。

About简介

Portrait of Lu-Xing Yang
  • Deakin University迪肯大学Senior Lecturer since 2026; on faculty since 20192026 年起任高级讲师，2019 年起任教
  • PhD, Chongqing University重庆大学博士Computer Science, 2015计算机科学，2015 年
  • Research positions此前研究经历Imperial College London · TU Delft · Deakin帝国理工学院 · 代尔夫特理工大学 · 迪肯大学

I am a Senior Lecturer in the School of Information Technology at Deakin University, Melbourne. I received my PhD in Computer Science from Chongqing University in 2015. Before joining the Deakin faculty in 2019, I held research positions at Imperial College London, Delft University of Technology and Deakin University.

My research on cyber threat dynamics and intelligent defense covers threat propagation in complex networks, dynamic attack–defense games, rumor control and learning-based autonomous defense. The methods come from complex network dynamics, game theory, optimal control, and single- and multi-agent reinforcement learning. For advanced persistent threats (APTs), I developed the first node-level epidemic models of attack–defense dynamics and derived defense strategies from optimal control and differential games. I introduced impulsive control theory into cyber-warfare modeling, and gave the first rigorous analysis of multiple competing viruses spreading over complex networks. Because the competing viruses can be malware, opinions or products, that analysis applies to malware suppression, rumor containment and word-of-mouth marketing.

I have published more than 100 papers: seven in IEEE TIFS; others in IEEE TDSC, TSMC, TNSE and TCSS; and more than ten at CORE A*/A conferences such as IJCAI, AsiaCCS and PAKDD. As a chief investigator, I have secured over AUD 1.2 million in research funding. I am an IEEE Senior Member and an Academic Editor of PLOS ONE. Research.com named me among its Best Computer Science Scientists 2026, and in 2021 The Australian’s Research Magazine listed me among Australia’s top 40 early career researchers.

Public services, businesses and households now depend on networks, and how a defender spends limited resources decides how far an attack can reach. My aim is to give those decisions a rigorous basis, and to mentor the students who will carry the work forward.

杨橹星，澳大利亚迪肯大学（Deakin University）信息技术学院高级讲师。2015 年在重庆大学获得计算机科学博士学位，曾在英国帝国理工学院、荷兰代尔夫特理工大学和迪肯大学做研究，2019 年起在迪肯大学任教。

他的研究方向是网络空间威胁演化与智能防御，具体包括：威胁在复杂网络中的传播与风险演化，动态攻防博弈与资源有限时的协同防御，谣言控制建模，以及把机理模型和学习方法结合起来的自主防御。用到的方法有复杂网络动力学、博弈论、最优控制、强化学习和多智能体强化学习。他率先建立了高级持续性威胁（APT）攻防的节点级传播模型，并提出了基于最优控制和微分博弈的 APT 防御策略。他把脉冲控制理论引入了网络战建模。对复杂网络上多种病毒的竞争传播，他首次给出了严格分析；这里的“病毒”可以是相互竞争的恶意软件、观点或产品，因此这些结果可用于恶意软件抑制、谣言遏制和口碑营销。

已发表论文 100 余篇：IEEE TIFS 7 篇，IEEE TDSC、TSMC、TNSE、TCSS 等期刊上也有论文，IJCAI、AsiaCCS、PAKDD 等 CORE A*/A 类会议论文 10 余篇。作为主要研究者（CI），他获得的科研经费超过 120 万澳元。现为 IEEE 高级会员、PLOS ONE 学术编辑。2026 年入选 Research.com 全球最佳计算机科学家榜单（Best Computer Science Scientists 2026）；2021 年入选《澳大利亚人报》（The Australian）Research Magazine 评选的澳大利亚 40 位顶尖青年学者。

公共服务、企业和家庭都已离不开网络，防御方怎样使用有限的资源，决定了攻击能走多远。他致力于为这些决定提供严谨的依据，也重视培养能把这项工作继续推进的学生。

Research研究方向

Cyber threat dynamics and intelligent defense网络空间威胁演化与智能防御

This work follows malware, advanced persistent threats, social engineering and malicious information as they evolve across computer networks, the Internet of Things and online social platforms. It asks how network structure, individual behavior and attack–defense strategies together decide the security outcome. The models build on complex network dynamics, game theory and control theory, combined with data-driven learning and artificial intelligence, and treat threat modeling, dynamic risk assessment, strategic resource allocation and adaptive defense as linked steps. The aim is defense that is interpretable, grounded in theory and practical to deploy when information is incomplete, resources are limited and adversaries keep changing.

恶意软件、高级持续性威胁、社会工程攻击和恶意信息，会在计算机网络、物联网和在线社交平台上传播。威胁怎样演化，由网络结构、个体行为和攻防双方的策略共同决定；我们研究其中的规律，也研究怎样有效防御。方法上以复杂网络动力学、博弈论和控制理论为基础，结合数据驱动的学习和人工智能，从威胁传播建模做起，延伸到动态风险评估、攻防策略优化和自适应防御。防御方往往信息不全、资源有限，攻击者也在不断调整做法，安全决策就要在这样的条件下作出。我们希望给出的防御方法讲得清机理，有理论依据，在实际中也能执行。

Current focus当前研究重心

These directions grow out of the three longer-standing themes below.这些是我眼下在做的研究，都是从后面三个长期方向延伸出来的。

  • hold保持 update更新 update更新 update更新 command命令 state网络状态

    Piecewise-constant (HOLD) games and their extensions分段常数（HOLD）博弈及其扩展

    An administrator might recompute the isolation level once a minute; devices hold each value until the next one arrives, while infection and recovery carry on. I study games built on such held commands, in which several actions draw on one shared response capacity. How long each command is held, and what each side knows at each update, both shape the risk that follows and the cost that accumulates. Fig. 1 at the top of this page runs a one-defender version: the PMP schedule changes its patch rate at every step, which is hard to carry out in practice, while HOLD issues just six held commands, costs only 0.5 more in expected cost and beats every other six-command schedule. Pick “You” under the figure to try six commands of your own.管理员每分钟重新算一次隔离强度，设备收到后照着执行，等下一条命令到了再调整，这一分钟里感染和恢复照常发生。我研究的分段常数博弈就建立在这种保持命令上，而且几项处置要共用同一份响应能力。命令保持多久再更新，更新时双方各自掌握了哪些信息，都会改变后面的风险和累计成本。本页顶部的图 1 演示了只有一个防御方的情形：PMP 方案的修补率每一步都在变，实际中很难执行；分段常数方案只需六条保持命令，期望成本只比它高 0.5，而且胜过其他任何六段方案。在图下方选“你来”，也可以自己设定六条命令试试。

    • Piecewise-constant games分段常数博弈
    • Zero-order hold零阶保持
    • Shared capacity共享响应能力

    Related papers: 相关论文：Appl. Math. Model. 2027 (shared-capacity defense)（共享响应能力下的防御）

  • Deployed network 1部署网络 1 Deployed network 2部署网络 2 Headquarters总部 Contractor承包商网络 red enters红方进入

    Multi-agent learning, simulated in CAGE Challenge 4多智能体强化学习，在 CAGE Challenge 4 中仿真

    Defenders in different parts of a network each see only local alerts, yet they share resources and their actions affect one another. I combine multi-agent reinforcement learning with HOLD games so that the defenders can improve their coordination from execution feedback. The attack–defense simulations run on CAGE Challenge 4 (Kiely et al., AAAI 2025) in CybORG. There, five blue agents guard parts of an enterprise network, and blocking an attack can also interrupt normal business.网络里各个区域的防御方只看到本地告警，却共用资源，行动还会相互影响。我把多智能体强化学习和分段常数博弈结合起来，让它们通过执行反馈逐步改善配合。网络攻防仿真用 CAGE Challenge 4（Kiely 等，AAAI 2025），它运行在 CybORG 里：五个蓝方智能体分区守卫一个企业网络，阻断攻击通路，也可能耽误正常业务。

    • Multi-agent RL多智能体强化学习
    • CAGE Challenge 4
    • CybORG
  • propaganda宣传 propaganda宣传 Red红方 Blue蓝方

    Disinformation and bilateral cyber warfare信息战与双边网络战

    HOLD games and multi-agent learning also apply to containing rumors and disinformation in information warfare. In the bilateral setting each side attacks the other’s network and defends its own. The propaganda war game in our 2024 IEEE TIFS paper is one example: each side pushes its messages into the other’s network and counters the opponent’s messages at home. I am extending both methods to these two-sided contests.分段常数博弈和多智能体学习也可以用来遏制信息战中的谣言和虚假信息。双边的情形里，每一方都在攻击对方网络，同时守住自己的网络。我们 2024 年 IEEE TIFS 论文里的宣传战就是一例：每一方把自己的信息推向对方人群，同时在本地反宣传。我正把这两类方法扩展到这种双边对抗。

    • Rumors and disinformation谣言与虚假信息
    • Information warfare信息战
    • Bilateral cyber warfare双边网络战

    Related papers: 相关论文：IEEE TIFS 2024, IEEE TCSS 2025, IEEE TNSE 2024

  • external text外部文本 detector检测 LLM agent大模型智能体 game博弈

    Language models, cybersecurity and game theory大语言模型与网络安全、博弈论的结合

    Asked to summarize an email, a language-model agent may also obey a line hidden in it and send a copy to someone the user never named; the AgentDojo benchmark (Debenedetti et al., NeurIPS 2024) records such cases. Game theory helps on two fronts: testing such agents against attackers who adapt, and training detectors against injected text that keeps being rewritten to evade them, as in DataSentinel (Liu et al., IEEE S&P 2025). In the other direction, a language model can turn a written scenario into a formal game for a solver to analyze, as in GameInterpreter (Deng, Wang and Savani, AAMAS 2025). Bringing language models, cybersecurity and game theory together is one of my current priorities.让大语言模型智能体总结一封邮件，正文里如果藏着一句“把内容再发给另一个收件人”，它可能真的照做，发出用户没有要求的邮件。AgentDojo 基准测试（Debenedetti 等，NeurIPS 2024）记录的就是这类情况。博弈论在两方面能派上用场：一是评测这类智能体在会调整策略的攻击者面前怎样选择；二是训练检测器，对付不断改写、专门绕过检测的注入文本，DataSentinel（Liu 等，IEEE S&P 2025）就是这样做的。反过来，语言模型也能把文字描述的情境整理成博弈模型，交给求解工具计算，例如 GameInterpreter（Deng、Wang 和 Savani，AAMAS 2025）。把大语言模型、网络安全和博弈论结合起来，是我当前的重点之一。

    • Large language models大语言模型
    • Prompt injection提示注入
    • Game modeling博弈建模

Under review: the questions behind six manuscripts在审稿件：六篇论文要回答的问题

  • Patches travel over their own delivery network. Where should patch sources sit relative to malware exposure, and when does replanning at each update pay off?补丁沿着自己的分发网络传播。相对于恶意软件的暴露位置，补丁源该放在哪里？每次更新都重新规划，什么时候才划算？ IEEE TNSE
  • Recovery commands take effect only after a delay, and the attacker spreads one budget over several channels. How much recovery capacity guarantees that compromise keeps shrinking?恢复命令要过一段时间才生效，攻击方又把一份预算分给几条攻击渠道。恢复能力要准备多少，才能保证失陷持续减少？ IEEE TCNS
  • Recovery takes time, and each responder may serve only some hosts. Which compromised hosts should be restored first?恢复需要时间，每名处置人员又只能处理部分主机。该先恢复哪些失陷主机？ IEEE TDSC
  • Risk runs on two clocks: time since a host was last renewed and time since it was compromised. How should one budget be split between proactive renewal and reactive removal?风险取决于两个时间：主机上次更新后过了多久，被入侵后又过了多久。一份预算该怎样在主动更新和事后清除之间分配？ IEEE TCNS
  • Emotion can outlast sharing. Why can a rumor rebound after sharing falls, and how should mitigation be held between scheduled reviews?情绪可能比转发持续得更久。转发减少以后，谣言为什么还会反弹？两次复核之间，干预该怎样保持？ IEEE TKDE
  • Each side splits limited capacity between attacking its rival and keeping its own services running. How should that split change over a campaign?每一方都要把有限的能力分给攻击对方和维持自己的服务。整场对抗中，这种分配该怎样随时间调整？ Ann. Oper. Res.

Approach and long-standing themes研究思路与长期方向

  1. 1 Model the spread刻画传播

    Epidemic and opinion dynamics on networks: who can infect whom, and how fast.在网络上建立传播模型：谁能感染谁，传得多快。

  2. 2 Analyze the dynamics分析演化

    Thresholds and long-run behavior: when a threat dies out and when it persists.传播阈值和长期行为：威胁什么时候消退，什么时候一直存在。

  3. 3 Decide the response决定应对

    Optimal control and games: when, where and how hard to intervene against an attacker who adapts.最优控制与博弈：对手会调整时，什么时候、对谁、用多大力度出手。

  4. 4 Learn from data从数据中学习

    Reinforcement learning when the model is uncertain and only part of the network is visible.模型不准、只看得到部分网络时，用强化学习改进策略。

Defender防御方 scans扫描 Attacker攻击方 acts行动 9:00 scan9:00 扫描 next day 9:00次日 9:00 waits until the scan ends等扫描结束再动手
Fig. 2. Why the attacker is modeled as a player. If an organization always scans its hosts at 9:00, an attacker can learn the schedule and act after each scan ends. The scans still run, but they are less likely to catch the attack. Comparing scan plans therefore has to take the attacker’s response into account.图 2　为什么要把攻击者当作博弈的一方。一个单位把主机扫描固定在每天上午九点，管理员很好安排，攻击者却也可能慢慢摸清这个规律，等扫描结束以后再活动。扫描照常进行，查到攻击的机会却小了。比较扫描计划时，就得把对手的这种回应考虑进去。
  1. Theme 1方向一

    Threat propagation and risk dynamics in complex networks复杂网络中的威胁传播与风险演化

    What decides how far a threat spreads through a network, how long it persists and how much risk builds up?网络连接和人的认知、行为，怎样影响恶意软件和谣言的扩散、持续与风险累积？

    Malware, harmful rumors and manipulative information spread over networks that are heterogeneous, multilayer and time-varying. The answer depends on connectivity, on how individuals think and behave, and on how different spreading processes interact. Technical infection and information-driven behavior change are different mechanisms; social engineering couples them, and this theme models that coupling. The analysis covers propagation thresholds and long-run behavior, and extends to identifying models from data, predicting risk and studying how generative AI and automated accounts amplify it.恶意软件、网络谣言和操纵性信息所在的网络，往往是异质的、多层的，还随时间变化。这里研究它们怎样传播：网络连接、个体的认知与行为、几种传播过程之间的相互作用，怎样影响威胁的扩散、持续和风险累积。技术感染和信息影响是两种不同的机制，先把它们分清，再刻画社会工程攻击里技术漏洞和人的行为怎样耦合，分析传播阈值、长期演化和关键的干预因素。结合观测数据，还可以识别模型、预测风险。生成式人工智能和自动化账号参与进来以后，信息怎样传播、风险怎样被放大，也是这里研究的问题。

    • Node-level epidemic models节点级传播模型
    • Competing spreading竞争传播
    • Malware-opinion coupling恶意软件与观点耦合
    • Thresholds and long-run behavior阈值与长期行为

    Case · patch the devices, train the people案例 · 修补设备，也培训人

    Device compromise设备受侵 Human vigilance人员警觉 raises提高警觉 lowers infection pressure降低感染压力

    Compromise spreads through connected devices, and vigilance spreads among neighbors. Compromise raises vigilance, and vigilance lowers infection pressure. One defender schedules patching and training at fixed times and chooses how intense each round is, while infection keeps spreading between rounds. The study uses real network topologies; in the paper’s cost comparison, the computed schedule cost less than each of 100 sampled alternatives.设备受侵会在相连的设备之间传播，警觉也会在邻居之间相互影响：受侵提高警觉，警觉降低感染压力。一位防御者在预定时刻统一安排修补和培训，每次用多大强度要算出来；两次干预之间，感染照样传播。研究使用真实网络拓扑；在论文的成本比较中，算出的方案比 100 个抽样方案的总成本都低。

    Cheng et al., IEEE TIFS 2025 · IEEE Signal Processing Society Paper Spotlight入选 IEEE 信号处理学会 Paper Spotlight

    Representative work: 代表性工作：Appl. Math. Comput. 2013, PLOS ONE 2015, IEEE TNSE 2018, IEEE TIFS 2025, IEEE TCSS 2026, Appl. Math. Model. 2027

  2. patch修补 patch修补 compromise受侵程度 Theme 2方向二

    Dynamic attack–defense games and resource-constrained cooperative defense动态攻防博弈与资源约束下的协同防御

    When, where and how intensively should a defender with limited, shared resources isolate, remediate, patch or intervene?资源有限、又要共用时，防御方该在什么时候、在哪里、用多大力度去隔离、修复、打补丁或做信息干预？

    Attackers, defenders and other stakeholders interact over time in persistent intrusions, lateral movement, malware propagation and adversarial information campaigns. This theme uses differential games, optimal control and feedback control to time, target and size isolation, remediation, patching and information interventions. A good policy balances what an adaptive adversary will do against the cost of defense and long-term security. The analysis covers strategic equilibria, closed-loop stability and defensive effectiveness, with the goal of policies that adapt as threats evolve while keeping services running.在持续渗透、横向移动、恶意软件扩散和网络信息对抗中，攻击者、防御者和其他参与方的互动会延续一段时间，防御资源有限，还要协同调配。这里以微分博弈、最优控制和反馈控制为主要工具，安排隔离、修复、补丁部署和信息干预的时机、对象和强度。攻击者会适应防御，防御要付出成本，长期的安全收益也要算进去，三者之间需要权衡。在此基础上研究策略均衡、闭环稳定性和防御效果，得到能执行的防御策略，同时顾及安全收益、运行成本和业务连续性。

    • Differential games微分博弈
    • Stackelberg gamesStackelberg 博弈
    • Optimal and impulsive control最优控制与脉冲控制
    • Feedback control反馈控制

    Case · red and blue: steady propaganda, scheduled counter-propaganda案例 · 红蓝宣传战：持续宣传，定时反宣传

    Each side keeps pushing its message into the other side’s network and, at scheduled times, runs counter-propaganda inside its own. Users are grouped by degree (number of contacts), and the model tracks the share of each group that is unaware, spreading the opponent’s message, or countering it. Each side chooses its continuous effort and the strength of each counter-propaganda impulse. The result is a two-player nonzero-sum differential game with continuous flow and state jumps.红蓝双方平时持续向对方网络宣传，到预定时刻在自己的网络里集中反宣传。人群按联系数分组，各组记录未接触宣传、传播对方信息和参与反宣传的比例。每一方选择平时的投入路径和每次反制的强度，于是得到一个既有连续作用、又有状态跳变的双人非零和微分博弈。

    Cheng et al., IEEE TIFS 2024 · nominated for Cybersecurity Best Paper 2025获 Cybersecurity Best Paper 2025 提名

    Representative work: 代表性工作：IEEE TIFS 2019, IEEE TDSC 2020, IEEE TSMC 2021, IEEE TIFS 2024, IEEE TIFS 2026

  3. observe观测 plan规划 act执行 learn学习 Theme 3方向三

    Model-informed learning for trustworthy autonomous defense机理与学习融合的可信自主防御

    How can a defender that learns from data act reliably when it sees only part of the network, its model is uncertain and the attacker keeps changing?状态看不全、模型有偏差、对手还在变时，怎样让自主防御可靠？

    Autonomous defense here combines mechanistic security models with data-driven learning. Propagation dynamics, game structure and resource constraints are built into reinforcement learning and multi-agent decision-making, so that state estimation needs less data and policies can adapt and be executed in coordination. Large language models are being explored for hierarchical decision-making alongside feedback control and model predictive control. The open questions are whether a policy generalizes across networks, adapts when the adversary changes and satisfies its constraints. Human oversight and a safe fallback are there to make autonomous defense more reliable.实际网络中，威胁状态很难完整观测，传播模型有偏差，攻击策略也在变。这里把传播动力学、博弈结构和资源约束放进强化学习和多智能体决策，探索用较少的数据做状态估计、策略学习和协同执行。大模型能理解语义、规划任务，我们研究它怎样和反馈控制、模型预测控制衔接，组成分层决策。关键问题有策略的跨网络泛化、对手变化后的适应，以及约束满足。人机协同和安全回退机制用来提高自主防御的可靠性。

    • Reinforcement learning强化学习
    • Multi-agent RL多智能体强化学习
    • Model predictive control模型预测控制
    • Large language models大语言模型

    Case · plan ahead, act one step, learn, plan again案例 · 规划一段，执行一步，学习后再规划

    In a real IoT network, how fast infection spreads and how long devices take to recover are often unclear at the start, yet defense has to continue. Model predictive control (MPC) plans ahead from the current state within control limits and executes only the first step. A learning module then compares measured and predicted states and updates the parameters used in the next round. In the paper’s simulation, this learning-assisted MPC kept the peak number of highly infected devices lower than open-loop response and plain MPC did, and reached full recovery first.在实际的物联网里，感染会传多快、设备多久能恢复，开始时往往拿不准，可防御还得继续做。模型预测控制（MPC）从当前状态出发，在控制限制下向前规划，只执行第一步；学习模块把实测状态和预测状态放在一起比较，更新下一轮规划用的参数。在论文的模拟里，与开环响应和普通 MPC 相比，加入学习的 MPC 让高感染设备的峰值更低，也更早完成恢复。

    Jafar et al., IEEE TIFS 2024

    Representative work: 代表性工作：IEEE TIFS 2024, Computers & Security 2025

Six defense questions and the papers that answer them六个防御问题，六篇论文

Each security setting changes what the defender has to decide, and so changes the model.安全场景不同，防御方要做的决定就不同，模型也要跟着变。

Selected publications代表性论文

The full list is on Google Scholar; dblp lists only the computer science papers.完整论文列表见 Google Scholar；dblp 只收录其中计算机类期刊和会议的论文。

  • TIFS6
  • TNSE4
  • TSMC3
  • TCSS2
  • TDSC2
  • Other其他5

The 22 papers below, by venue (IEEE Transactions unless noted).下列 22 篇论文的期刊分布（除“其他”外均为 IEEE Transactions）。

Under review在审稿件

Manuscripts at IEEE TKDE, IEEE TDSC, IEEE TCNS (two), IEEE TNSE, Annals of Operations Research and other journals, and two submissions to WWW 2027. Current focus lists the questions behind six of them.投往 IEEE TKDE、TDSC、TCNS（两篇）、TNSE、Annals of Operations Research 等期刊的稿件，以及两篇 WWW 2027 投稿。其中六篇研究的问题，列在当前研究重心里。

  1. 2027

    1. Compromise-age malware dynamics and shared-capacity defense on directed networks

      Xiaofan Yang, Lu-Xing Yang

      AMMApplied Mathematical Modelling, vol. 163, 117375, 2027

  2. 2026

    1. A Stackelberg Differential Game Framework for Cost-Effective Promotion of Employee Security Compliance

      Yang Qin, Xiaofan Yang, Lu-Xing Yang, Yushu Zhang, Tianqing Zhu, Gang Li

      TDSCIEEE Transactions on Dependable and Secure Computing, to appear录用待刊

    2. Mitigating Insider-Facilitated Advanced Persistent Threat: A Three-Player Differential Game Approach

      Yang Qin, Lu-Xing Yang, Xiaofan Yang, Gang Li, Robin Doss

      TIFSIEEE Transactions on Information Forensics and Security, vol. 21, pp. 3153–3168, 2026

    3. Attack Graph-Epidemic Hybrid Modeling for Mitigating Cyber Threats Propagation

      Mousa Tayseer Jafar, Wei Ren, Lu-Xing Yang, Gang Li

      TCSSIEEE Transactions on Computational Social Systems, vol. 13, no. 2, pp. 2288–2307, 2026

  3. 2025

    1. Modeling and Mitigating Social Engineering Malware: Integrating Malware-Opinion Dynamics With Optimal Impulse Control Approaches

      Xiaojuan Cheng, Lu-Xing Yang, Gang Li, Zenan Ma, Tianqing Zhu, Lidan Wang, Shukai Duan

      TIFSIEEE Transactions on Information Forensics and Security, vol. 20, pp. 12231–12244, 2025

      IEEE Signal Processing Society Paper Spotlight, January 2026入选 IEEE 信号处理学会 Paper Spotlight（2026 年 1 月）

    2. Impulse Strategies for Suppressing Cyber Propaganda With Awareness

      Xiaojuan Cheng, Lu-Xing Yang, Qingyi Zhu, Chenquan Gan, Gang Li

      TCSSIEEE Transactions on Computational Social Systems, vol. 12, no. 5, pp. 2685–2695, 2025

    3. Mitigating Social Engineering Attacks Through Cost-Effective Security Awareness Training Policy

      Yang Qin, Xiaofan Yang, Lu-Xing Yang, Kaifan Huang

      TNSEIEEE Transactions on Network Science and Engineering, vol. 12, no. 4, pp. 3145–3158, 2025

    4. An innovative practical roadmap for optimal control strategies in malware propagation through the integration of RL with MPC

      Mousa Tayseer Jafar, Lu-Xing Yang, Gang Li

      C&SComputers & Security, vol. 148, 104186, 2025

  4. 2024

    1. Cost-Effective Hybrid Control Strategies for Dynamical Propaganda War Game

      Xiaojuan Cheng, Lu-Xing Yang, Qingyi Zhu, Chenquan Gan, Xiaofan Yang, Gang Li

      TIFSIEEE Transactions on Information Forensics and Security, vol. 19, pp. 9789–9802, 2024

      Nominated for Cybersecurity Best Paper 2025获 Cybersecurity Best Paper 2025 提名

    2. Minimizing Malware Propagation in Internet of Things Networks: An Optimal Control Using Feedback Loop Approach

      Mousa Tayseer Jafar, Lu-Xing Yang, Gang Li, Qingyi Zhu, Chenquan Gan

      TIFSIEEE Transactions on Information Forensics and Security, vol. 19, pp. 9682–9697, 2024

    3. Cost-Effective Company Response Policy for Product Co-Creation in Company-Sponsored Online Community

      Jiamin Hu, Lu-Xing Yang, Xiaofan Yang, Kaifan Huang, Gang Li, Yong Xiang

      TSMCIEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 54, no. 7, pp. 4494–4506, 2024

    4. Mitigating the Impact of a False Message Through Sequential Release of Clarifying Messages

      Kaifan Huang, Xiaofan Yang, Lu-Xing Yang, Ye Zhu, Gang Li

      TNSEIEEE Transactions on Network Science and Engineering, vol. 11, no. 2, pp. 1785–1798, 2024

  5. 2023

    1. Impulsive Artificial Defense Against Advanced Persistent Threat

      Hao Sun, Xiaofan Yang, Lu-Xing Yang, Kaifan Huang, Gang Li

      TIFSIEEE Transactions on Information Forensics and Security, vol. 18, pp. 3506–3516, 2023

  6. 2022

    1. Effective Multiplatform Advertising Policy

      Kaifan Huang, Lu-Xing Yang, Xiaofan Yang, Yuan Yan Tang

      TSMCIEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 52, no. 7, pp. 4483–4493, 2022

  7. 2021

    1. Effective Quarantine and Recovery Scheme Against Advanced Persistent Threat

      Lu-Xing Yang, Pengdeng Li, Xiaofan Yang, Yong Xiang, Frank Jiang, Wanlei Zhou

      TSMCIEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 51, no. 10, pp. 5977–5991, 2021

    2. Defense Against Advanced Persistent Threat Through Data Backup and Recovery

      Lu-Xing Yang, Kaifan Huang, Xiaofan Yang, Yushu Zhang, Yong Xiang, Yuan Yan Tang

      TNSEIEEE Transactions on Network Science and Engineering, vol. 8, no. 3, pp. 2001–2013, 2021

  8. 2020

    1. A Risk Management Approach to Defending Against the Advanced Persistent Threat

      Lu-Xing Yang, Pengdeng Li, Xiaofan Yang, Yuan Yan Tang

      TDSCIEEE Transactions on Dependable and Secure Computing, vol. 17, no. 6, pp. 1163–1172, 2020

  9. 2019

    1. Effective Repair Strategy Against Advanced Persistent Threat: A Differential Game Approach

      Lu-Xing Yang, Pengdeng Li, Yushu Zhang, Xiaofan Yang, Yong Xiang, Wanlei Zhou

      TIFSIEEE Transactions on Information Forensics and Security, vol. 14, no. 7, pp. 1713–1728, 2019

  10. 2018

    1. A Bi-Virus Competing Spreading Model with Generic Infection Rates

      Lu-Xing Yang, Xiaofan Yang, Yuan Yan Tang

      TNSEIEEE Transactions on Network Science and Engineering, vol. 5, no. 1, pp. 2–13, 2018

  11. 2016

    1. The optimal dynamic immunization under a controlled heterogeneous node-based SIRS model

      Lu-Xing Yang, Moez Draief, Xiaofan Yang

      Phys. APhysica A: Statistical Mechanics and its Applications, vol. 450, pp. 403–415, 2016

  12. 2015

    1. The Impact of the Network Topology on the Viral Prevalence: A Node-Based Approach

      Lu-Xing Yang, Moez Draief, Xiaofan Yang

      PLOSPLOS ONE, vol. 10, no. 7, e0134507, 2015

  13. 2013

    1. Epidemics of computer viruses: A complex-network approach

      Lu-Xing Yang, Xiaofan Yang, Jiming Liu, Qingyi Zhu, Chenquan Gan

      AMCApplied Mathematics and Computation, vol. 219, no. 16, pp. 8705–8717, 2013

Funding and recognition科研项目与荣誉

Research funding科研项目

Chief investigator on three external and four internal grants, totaling over AUD 1.2 million.作为主要研究者（CI）获得外部项目 3 项、校内项目 4 项，经费合计超过 120 万澳元。

  • Quantum Automation for Cyber DefenceQuantum Automation for Cyber Defence（面向网络防御的量子自动化）

    Australia’s Economic Accelerator (AEA) Ignite Program · chief investigator · 2025–2026澳大利亚经济加速器（AEA）Ignite 计划 · 主要研究者（CI）· 2025–2026

    479,960AUD澳元

  • Augmenting Cyber Defence Capability (ACDC)Augmenting Cyber Defence Capability（增强网络防御能力）

    Cyber Security Cooperative Research Centre (CSCRC) · chief investigator · 2022–2024澳大利亚网络安全合作研究中心（CSCRC）· 主要研究者（CI）· 2022–2024

    390,000AUD澳元

  • Privacy-Respecting and Compliant Digital Credential Wallet (PRCDCAT)Privacy-Respecting and Compliant Digital Credential Wallet（隐私保护且合规的数字凭证钱包）

    Cyber Security Cooperative Research Centre (CSCRC) · chief investigator · 2023–2024澳大利亚网络安全合作研究中心（CSCRC）· 主要研究者（CI）· 2023–2024

    325,000AUD澳元

Awards and recognition荣誉与奖励

Teaching and supervision教学与研究生指导

Teaching教学

Teaching areas: cybersecurity, applied mathematics, computer programming and data science fundamentals. Graduate Certificate of Higher Education (Learning and Teaching), Deakin University, 2022. In the list below, T1–T3 are Deakin’s three trimesters.教学方向：网络安全、应用数学、程序设计和数据科学基础。2022 年获迪肯大学高等教育教学研究生证书（Graduate Certificate of Higher Education, Learning and Teaching）。下文的 T1–T3 指迪肯大学每年的三个学期。

  • SIT281

    Cryptography密码学（Cryptography） 2020–2026, every T22020–2026 年，每年 T2

  • SIT103/772

    Database Fundamentals数据库基础（Database Fundamentals） 2019 T3, 2021 T2, 2022 T2, 2024 T3, 2025 T3, 2026 T2

  • SIT102

    Introduction to Programming程序设计导论（Introduction to Programming） 2019 T3, 2020 T2–T3, 2021 T1

  • SIT374/764SIT378/782

    Capstone Program毕业设计项目（Capstone Program） 2022 T1, 2023 T1

  • SIT374

    Software Project Management, taught offshore at Southwest University, China软件项目管理（Software Project Management），在中国西南大学授课 May 2022, 2023, 2024 and 20262022、2023、2024、2026 年 5 月

Lecture series系列讲座

Game Theory for Cybersecurity博弈论与网络安全

Four lectures · Chongqing University of Posts and Telecommunications (CQUPT), China四讲 · 重庆邮电大学（CQUPT）

The series sticks to ideas and small worked examples, from whether to patch one host to how a whole network organizes its defense. The last lecture covers multi-agent learning and how game theory and large language models can help each other.四讲以概念和思路为主，配几个直观的小例子：小到一台主机该不该打补丁，大到整张网络怎样组织防御。最后一讲谈多智能体强化学习，以及博弈论和大语言模型怎样结合。

  1. Lecture 1第一讲Best responses and Nash equilibrium最佳反应与纳什均衡Which defense is best when the attacker also chooses strategically?攻击者也在盘算时，哪种防御最好？
  2. Lecture 2第二讲Private information and signaling私人信息与信号传递How should a defender act when the sender’s type is private?对方是什么类型只有它自己知道时，防御方该怎样行动？
  3. Lecture 3第三讲Commitment and control over time承诺与动态控制When does an announced plan change behavior, and how is it executed?公布的计划什么时候会改变对方的行为？又该怎样执行？
  4. Lecture 4第四讲Learning and adaptive defense学习与自适应防御How can a controller improve its decisions from data?控制者怎样从数据中改进自己的决策？

Doctoral students博士生2 current · 8 graduated在读 2 人 · 已毕业 8 人

  • In progress在读Domain-Invariant Sequence Modeling for Unsupervised Domain-Adaptive Point Cloud CompletionYinghui Li
  • In progress在读Isolation-based Models for Unsupervised LearningXiaoyu Qin
  • Graduated 20262026 年毕业A Hybrid Intelligent Framework to Mitigate Cybersecurity Attacks in Internet of Things NetworksMousa Tayseer Mousa Ja’far
  • Graduated 20252025 年毕业Modeling and Analysis of CyberwarXiaojuan Cheng
  • Graduated 20252025 年毕业Generative Model for Tabular Data GenerationYishuo Zhang
  • Graduated 20252025 年毕业Identification of Abnormal Status in Natural Gas WellsYang Cao
  • Graduated 20232023 年毕业New Methods for Distributed Denial-of-Service Attack DetectionLu Zhou
  • Graduated 20232023 年毕业Detection and Prevention of Harmful Information Propagation in CyberspaceShu Li
  • Graduated 20222022 年毕业Location Privacy Protection Ensuring Utility of ServicesNisha Nisha
  • Graduated 20202020 年毕业Improving PDF Maldoc Detection via Data-Driven Feature EngineeringAhmed Falah

Experience and education经历与教育

Appointments工作经历

  1. Jan 2026 – present2026.01 至今

    Senior Lecturer (equivalent to Associate Professor in North America)高级讲师（相当于北美副教授）Current现任 School of Information Technology, Deakin University迪肯大学信息技术学院

  2. Oct 2019 – Dec 20252019.10 – 2025.12

    Lecturer讲师 School of Information Technology, Deakin University迪肯大学信息技术学院

  3. Feb 2018 – Oct 20192018.02 – 2019.10

    Alfred Deakin Postdoctoral Research FellowAlfred Deakin 博士后研究员 Deakin University, with Prof. Yong Xiang and Prof. Wanlei Zhou迪肯大学，合作导师：Yong Xiang 教授、Wanlei Zhou 教授

  4. Mar 2016 – Sep 20172016.03 – 2017.09

    Postdoctoral Research Fellow博士后研究员 Delft University of Technology, the Netherlands, with Prof. Piet Van Mieghem荷兰代尔夫特理工大学，合作导师：Piet Van Mieghem 教授

  5. Oct 2014 – Oct 20152014.10 – 2015.10

    Research Associate, joint PhD training programResearch Associate（博士联合培养） Imperial College London, United Kingdom, with Prof. Moez Draief英国帝国理工学院，合作导师：Moez Draief 教授

Education教育背景

  1. 2022

    Graduate Certificate of Higher Education (Learning and Teaching)高等教育教学研究生证书 Deakin University迪肯大学

  2. 2015

    PhD in Computer Science计算机科学博士 Chongqing University, China; advisor Prof. Xiaofan Yang重庆大学，导师：Xiaofan Yang 教授

  3. 2012

    BSc in Applied Mathematics应用数学学士 Chongqing University, China重庆大学

Service学术服务

Editorial roles编辑工作

Academic Editor, PLOS ONEPLOS ONE 学术编辑Ongoing现任

Guest Editor of nine special issues:担任 9 个专刊的客座编辑：

  • Apr 20252025.04Cyber-Physical System: Security and DefenseApplied Sciences
  • Nov 20232023.11Mathematical Modeling and Strategic Decision-Making of Cyber ConflictsMathematical Biosciences and Engineering
  • Nov 20222022.11Propagation Dynamics and Control of Disinformation in Online Social PlatformsMathematical Biosciences and Engineering
  • Dec 20212021.12Network Structural Perturbation and Its Applications for Controlling Misinformation DiffusionSecurity and Communication Networks
  • Nov 20212021.11Epidemic Spreading Dynamics on Temporal NetworksComplexity
  • Sep 20202020.09Coevolving Spreading Dynamics of Complex NetworksComplexity
  • Apr 20202020.04Mathematical Models for New Types of Cyberattack and Associated Defense StrategiesSecurity and Communication Networks
  • Sep 20172017.09Mathematical Models for Malware PropagationSecurity and Communication Networks
  • Dec 20162016.12Epidemic Processes on Complex NetworksDiscrete Dynamics in Nature and Society

Reviewing审稿

Regular reviewer for IEEE Transactions on Information Forensics and Security, IEEE Transactions on Dependable and Secure Computing, IEEE/ACM Transactions on Networking, IEEE Transactions on Cybernetics, IEEE Transactions on Systems, Man, and Cybernetics: Systems, IEEE Transactions on Network Science and Engineering, and other journals.经常为 IEEE TIFS、IEEE TDSC、IEEE/ACM ToN、IEEE TCYB、IEEE TSMC、IEEE TNSE 等期刊审稿。

  • IEEE TIFS
  • IEEE TDSC
  • IEEE/ACM ToN
  • IEEE TCYB
  • IEEE TSMC
  • IEEE TNSE

University service and membership校内服务与学术兼职

  • 2022–2024

    Higher Degree by Research (HDR) Coordinator, School of Information Technology迪肯大学信息技术学院研究生（HDR）协调人

  • Ongoing现任

    Member, Cyber Security Course Team网络安全专业课程组成员

  • Ongoing现任

    Member, Faculty Human Ethics Advisory Group学院人类研究伦理咨询组成员

  • Since Feb 20252025 年 2 月起

    IEEE Senior MemberIEEE 高级会员

Contact联系方式

  • Email邮箱

    y.luxing@deakin.edu.au

    ylx910920@gmail.com

  • Office办公室

    Office T3.19, School of Information Technology
    Deakin University, Melbourne Burwood Campus
    221 Burwood Highway, Burwood VIC 3125, Australia    迪肯大学信息技术学院 T3.19 办公室
    墨尔本 Burwood 校区
    221 Burwood Highway, Burwood VIC 3125, Australia

  • Profiles学术主页