Cyber Deception for Wireless Network Virtualization Using Stackelberg Game Theory

Cyber deception has great potential in thwarting cyberattacks [1, 4, 8]. A defender (e.g., network administrator) can use deceptive cyber artifacts such as honeypots and faking services to confuse attackers (e.g., hackers) and thus reduce the success rate and effectiveness of attacks. However, the attackers are often diverse and some attackers may be aware of the deception and adapt to the defender's strategy. Therefore, when the defender designs the deception strategy, he needs to take into account the attacker's strategic response. Game theory is suitable for such strategic interaction between the defender and the attacker. Building upon our previous work on security games,[2, 3] we developed a series of game-theoretic models for cyber deception, as well as algorithms to compute the equilibrium or the optimal defender strategy in the games. The first model we proposed is the Cyber Deception Game, a zero-sum Stackelberg game between the defender and an adversary. In this game, the defender is tasked to protect a set of targets, where each target corresponds to a system or a node in a network. Each target has a true configuration, which consists of a set of attributes, e.g., an operating system, services hosted, etc. The defender can choose an observed configuration for each target when responding to probes and scans that may be launched by the attacker. The observed configuration can be different from the true configuration and thus the deception. The attacker, after collecting information about the observed configuration, chooses which target to attack. We show that finding the defender's optimal strategy is NP-hard and provides mixed-integer linear programming (MILP)-based algorithms to compute the optimal deception scheme, and also several heuristic algorithms. In a follow-up work,[7] we extended this game model to a general-sum one, which captures the fact that the cost for the defender may not always be equal to the gain of the attacker. The general-sum nature of this new game model leads to new computational challenges. We provided a Fully Polynomial Time Approximation Scheme (FPTAS) for solving the game and designed a MILP-based algorithm together with several techniques to speed up the computation. In a recent work,[5] we proposed a new attack graph-based Stackelberg security game model and analyze the optimal deception strategy the defender can use. In contrast to previous models, the attacker in this new game can take sequential actions to reach the targets, which is modeled as taking a path on the attack graph. The defender can strategically manipulate the attack graph through deceptive actions in addition to allocating defensive resources to protect important targets from attackers. We provided a MILP-based solution for a special class of attack graphs and a neural architecture search-based method for general directed acyclic attack graphs. We empirically demonstrated the benefit of deception in all these game models and the scalability of the algorithms. This talk features an introduction to these models and algorithms, together with a discussion on future research directions for game theory-based cyber deception.

Maliciously-injected power load, a.k.a. power attack, has recently surfaced as a new egregious attack vector for dangerously compromising the data center availability. This paper focuses on the emerging threat of power attacks in a multi-tenant colocation data center, an important type of data center where multiple tenants house their own servers and share the power distribution system. Concretely, we discover a novel physical side channel --- a voltage side channel --- which leaks the benign tenants' power usage information at runtime and helps an attacker precisely time its power attacks. The key idea we exploit is that, due to the Ohm's Law, the high-frequency switching operation (40~100kHz) of the power factor correction circuit universally built in today's server power supply units creates voltage ripples in the data center power lines. Importantly, without overlapping the grid voltage in the frequency domain, the voltage ripple signals can be easily sensed by the attacker to track the benign tenants' runtime power usage and precisely time its power attacks. We evaluate the timing accuracy of the voltage side channel in a real data center prototype, demonstrating that the attacker can extract benign tenants' power pattern with a great accuracy (correlation coefficient = 0.90+) and utilize 64% of all the attack opportunities without launching attacks randomly or consecutively. Finally, we highlight a few possible defense strategies and extend our study to more complex three-phase power distribution systems used in large multi-tenant data centers.

The integration of industrial control systems (ICS) with information technologies offers not only convenience but also creates security problems, from public networks to ICS. Spear-phishing attacks account for a considerable proportion of such security incidents. Therefore, there have been many studies about dealing with spear-phishing attacks. Most of these studies focus on studying strategies with better defense capabilities for spear-phishing attacks while neglecting the cost of implementing the strategies. However, a strategy with strong defense capabilities may not always be highly cost-effective. Moreover, considerable research has tended to consider the attacker and defender separately while ignoring the fact that the spear-phishing attack-defense process is a dynamic process of confrontation between the attacker and the defender. Actually, the deployment of defense strategies should comprehensively consider the defender's condition and the adversary's possible actions. Therefore, how to select the optimal strategy that defends against spear-phishing attacks with minimum overhead is a problem worthy of further study. Motivated by this consideration, we construct the multistage spear-phishing attack-defense signaling game model (MSPAD-SGM), which comprehensively considers the defense capability, the strategy cost, and the possible strategies of the two sides. Based on this model, we propose the optimal strategy selection algorithm for the spear-phishing attack-defense process. In addition, rather than numerical values, we adopt symbolic variables to quantify the payoffs and present a deep analysis of how the variation of payoffs influences the game result, which helps to reduce the subjectivity and improve the feasibility of our model. The simulation and deduction of the proposed approach are presented in a case study of MSPAD-SGM to demonstrate the feasibility and effectiveness of the proposed strategy's optimal selection approach. Our method provides decision support for the spear-phishing attack-defense process and improves the dynamic analysis efficiency of defense decision-making.

Existing passive defence methods cannot effectively guarantee network security; to solve this problem, a novel method is proposed that selects the optimal defence strategy. The network attack-defence process is modelled based on the Bayesian game. The payoff is quantified from the impact value of the attack-defence actions. The optimal defence strategy is selected that takes defence effectiveness as the criterion. The rationality and feasibility of the method are verified through a representative example, and the general rules of network defence are summarised. Compared to the classic strategy selection methods based on game theory, the proposed method can select the optimal strategy in the form of pure strategy by quantifying defence effectiveness, which was proven to perform better.

Intelligence and impact contests in systems with redundancy, false targets, and partial protection

Cyber intrusions to substations are critical issues to a power grid, which must be defended and mitigated. Essentially, to better understand a cyber intrusion, reconnaissance activities should be modeled. Then, strategies of cyber attacker and defender can be studied, which help to identify substations vulnerable to cyber-attacks. In this paper, a successful intrusion is regarded as a probabilistic event related to reconnaissance activities. Its probability can be approximated by the Poisson distribution of the number of vulnerabilities discovered by the attacker. Furthermore, models of intrusion and defense in competition for control of the substations are proposed using Markov decision process (MDP). Key characteristics of target substation, attacker and defender are considered for determining probabilistic state transitions related to intrusion and defense actions. Thus, by solving the MDP models, the optimal strategies (action policies) of both the attacker and defender can be obtained. With these optimal strategies, the cyber security status of a substation can be evaluated within varied time frames. The case study validates the proposed models and method, including time-based strategies of the attacker and defender.

With the development of various wireless personal area networks (WPANs), the issue of security has become a crucial problem for their applications. Jamming is one of the most important methods of attack to deprive or reduce the communication service of WPANs. Most existing jamming attacks can cause negative interference, but the attack strategies are usually not adjusted against the countermeasures that are currently taken. This paper proposes an effective dynamic jamming attack (EDJam) in an 802.15.4-compliant WPAN. In this attack, a jammer who is aware of a change in the network defense strategy, e.g. the use of a dynamic retransmission mechanism, may choose a better strategy to make more damage to the network with less cost. Similarly, a well-protected network can change its defense strategy against the EDJam. This procedure of competition between the EDJam attacker and defending networks is modeled and formulated as a Stackelberg game, and a unique Nash Equilibrium point is derived in analytical format. Based on an equilibrium analysis, we discuss the condition under which a defense strategy will increase the utility of the network and a dynamic retransmission mechanism defense strategy is proposed accordingly. The simulation results show that EDjam can be more cost-efficient than continuous, random and fixed-period jamming.

With the ever-evolving cyber attacks as well as defense technologies, the attack behaviors are characterized by uncertainty, complexity, and diversity, and the attack operations are becoming large-scale, synergistic, and multilevel. To study any cyber attacks, it is necessary to establish an objective and scientific and descriptive methodology for accurate feature analysis so as to come up with some general laws based on which the overall defense strategies will be put forward. So far, there is not a universal scientific theoretical model for us to depict the cyber attack behaviors, and the existing theoretical models are proposed for specific scenarios or certain attack categories. The scientific description of cyber attack behaviors is the premise and basis for analyzing the theory of cyber attacks and establishing a general theory of cyber defense. This chapter is an overview or an attempted summary of the existing formal description methods of mainstream network attacks and proposes some preliminary suggestions for the formal analysis of cyber attacks against the complicated dynamic heterogeneous redundant (DHR) network environments. The content herein, though not directly applied in the following chapters, is of guiding significance and reference value for the research on the theory of cyber attacks based on vulnerabilities or backdoors, the formulation of cyberspace defense strategies, and the design of cyber attack defense mechanisms.

Current network assessment models often ignore the impact of attack-defense timing on network security, making it difficult to characterize the dynamic game of attack-defense effectively. To effectively manage the network security risks and reduce potential losses, in this article, we propose a selection strategy for network defense based on a time game model. By analyzing the attack-defense status by analogy with the SIR infectious disease model, construction of an optimal defense strategy model based on time game, and calculation of the Nash equilibrium of the the attacker and the defender under different strategies, we can determine an optimal defense strategy. With the Matlab simulation, this strategy is verified to be effective.

This paper deals with an attrition game on a combat network, where attackers depart from multiple start nodes heading to multiple destination nodes and defenders deploy a limited number of members on arcs to intercept the attackers. Due to conflicts between the attackers and the deployed defenders, both players incur casualties or attrition on arcs. The attackers aim to bring as many members as possible to destination nodes while the defenders desires to minimize the number of surviving attackers. For the two-person zero-sum (TPZS) attrition game, we propose linear programming formulations to derive an optimal attacker's strategy of their attack paths and an optimal defender's strategy of deployment on arcs.

A method is presented to solve two-person, single-stage, deterministic, Stackelberg games. The approach lies on the delineation of the inducible region. If the leader is extremely powerful, he can induce the follower to do whatever he desires. However, the leader in general can only induce the follower's behavior to certain extent due to limited information, control, etc. In other words, there exists a region inside which the leader can induce the follower's behavior. Thus, the best the leader can do is to minimize his cost inside this region. In this paper, we delineate precisely the inducible region, and obtain a leader's optimal strategy, if it exists. In case that a Stackelberg strategy does not exist, we show that an ?-Stackelberg strategy always exists.

Real time Demand-Response algorithm is a real time price (RTP) based demand response (DR) algorithm which helps in obtaining optimal control of load devices in a facility. We form a virtual electricity trading process, where energy management center (EMC) calculates the virtual retail prices and allots to each device, from which devices purchases energy. Here EMC acts as the leader and devices in the facility are followers. So the Stackelberg game between one-leader and M-followers is formulated to extract interactions between them, and optimization problems are formed for each player of the game to assist in finding the optimal strategy. We also demonstrated the unique Stackelberg equilibrium of the Stackelberg game which gives the optimal strategy or optimal energy demands for each device. The results of the simulation showed that Stackelberg game based DR algorithm is successful to get the optimal load control of device at all RTP throughout the day.

Nowadays, enterprises face many challenges of cyber security. How to efficiently allocate defensive resources to reduce damages which are caused by cyber attackers and evaluate system survivability to keeping services operating became important issues. Hence, we develop a scenario of that both cyber attacker and network defender are with incompletely understanding the information about each other is considered. We conduct a mathematical model for analyze this problem for the decision makers to resolve these dilemmas. The Average DOD is then applied to evaluate damage degree of network to estimate all possible strategies which both cyber attacker and network defender would take. Moreover, network defender could release message which might be doing nothing at all, truth, secrecy or deception to confuse cyber attacker to achieve better defense efficiency. In the process of problem solving, the "gradient method" and "game theory" would be used to obtain the optimal resource allocation strategies for both cyber attacker and network defender.

Stackelberg game in critical infrastructures from a network science perspective

With the complication of attack means, the network security technology needs new changes. This study analyzed the establishment of the game model and strategy selection in the process of network security attack and defense confrontation. Firstly, the relevant theory of game theory was introduced; then the network attack and defense game model was established; the components of the model were analyzed; and finally, the Nash equilibrium of the hybrid strategy was solved to obtain the optimal defense strategy. The simulation results showed that the method could find the best attack and defense strategy {a3, d4} in the complex hybrid strategy. The calculation of payoff verified the correctness of the strategy. The experimental results show that the application of the attack‐defense confrontation in the network security field is feasible and it can effectively generate optimal attack‐defense strategy to realize network security.