Methods and systems for determining a reallocation of resources are described. A device may determine initial allocation data that indicates a first amount of resources allocated to a plurality of areas. The device may determine a set of attacker expected rewards based on the initial allocation data. The device may determine a set of defender expected rewards based on the attacker expected rewards. The device may determine moving rewards indicating defensive scores in response to movement of the resources among the plurality of areas. The device may determine defender response rewards indicating defensive scores resulting from an optimal attack on the plurality of areas. The device may generate reallocation data indicating an allocation of a second amount of resources to the plurality of areas. The second amount of resources may maximize the moving rewards and the defender response rewards.