Game Theoretic Models for Cyber Deception

Wireless virtualization is becoming a popular solution to resource sharing problems integral in providing access to future wireless networking applications by enabling access to the same physical wireless infrastructure by multiple virtual networks concurrently. This paper investigates cyber deception using game theory model for defining the deceptive interactions between a cyber attacker and the defender. We consider both the naive attacker who is not aware of the defender's strategy, and the rational (powerful) attacker who knows the defense strategy. In the Stackelberg game, the defender controls the observable configuration of the network when probed by an attacker. We show that the process for selecting an optimal defense strategy against a naive attacker is NP-hard. We also proposed an algorithm for computing optimal strategy for a naive attacker and a greedy based algorithm for selecting the optimal strategy against a powerful attacker. Results from extensive simulation runs show the scalability and effectiveness of the proposed approaches based on the run time in finding the optimum defense strategy as well as minimizing the attacker's utility are better than the approaches in state of the art literature.

To step beyond the first-generation deployments of attacker-defender security games -- for LAX Police, US FAMS and others -- it is critical that we relax the assumption of perfect rationality of the human adversary. Indeed, this assumption is a well-accepted limitation of classical game theory and modeling human adversaries' bounded rationality is critical. To this end, quantal response (QR) has provided very promising results to model human bounded rationality. However, in computing optimal defender strategies in real-world security games against a QR model of attackers, we face difficulties including (1) solving a nonlinear non-convex optimization problem efficiently for massive real-world security games; and (2) addressing constraints on assigning security resources, which adds to the complexity of computing the optimal defender strategy. This paper presents two new algorithms to address these difficulties: Gosaq can compute the globally optimal defender strategy against a QR model of attackers when there are no resource constraints and gives an efficient heuristic otherwise; Pasaq in turn provides an efficient approximation of the optimal defender strategy with or without resource constraints. These two novel algorithms are based on three key ideas: (i) use of a binary search method to solve the fractional optimization problem efficiently, (ii) construction of a convex optimization problem through a non-linear transformation, (iii) building a piecewise linear approximation of the non-linear terms in the problem. Additional contributions of this paper include proofs of approximation bounds, detailed experimental results showing the advantages of Gosaq and Pasaq in solution quality over the benchmark algorithm (Brqr) and the efficiency of Pasaq. Given these results, Pasaq is at the heart of the PROTECT system, which is deployed for the US Coast Guard in the port of Boston, and is now headed to other ports.

This paper deals with an attrition game on a combat network, where attackers depart from multiple start nodes heading to multiple destination nodes and defenders deploy a limited number of members on arcs to intercept the attackers. Due to conflicts between the attackers and the deployed defenders, both players incur casualties or attrition on arcs. The attackers aim to bring as many members as possible to destination nodes while the defenders desires to minimize the number of surviving attackers. For the two-person zero-sum (TPZS) attrition game, we propose linear programming formulations to derive an optimal attacker's strategy of their attack paths and an optimal defender's strategy of deployment on arcs.

In this chapter, we introduce a cyber deception defense approach and propose a scalable allocation algorithm to place honeypots over an attack graph. We formulate a two-person zero-sum strategic game between the network defender and an attacker. The developed game model captures the network topology and its characteristics. The game also counts for the cost associated with the defense action and the attack cost. Nash equilibrium defense strategies are analytically characterized and studied for a special game. The complexity of the general game is discussed and a scalable algorithm is proposed to overcome the game complexity. This chapter extends the model to a dynamic game formulation to better understand game evolution with players' actions. Finally, numerical results are presented to illustrate the effectiveness of the proposed cyber deception approach.

Mobile sensors, e.g., unmanned aerial vehicles (UAVs), are becoming increasingly important in security domains and can be used for tasks such as searching for poachers in conservation areas. Such mobile sensors augment human patrollers by assisting in surveillance and in signaling potentially deceptive information to adversaries, and their coordinated deployment could be modeled via the well-known security games framework. Unfortunately, real-world uncertainty in the sensor's detection of adversaries and adversaries' observation of the sensor's signals present major challenges in the sensors' use. This leads to significant detriments in security performance. We first discuss the current shortcomings in more detail, and then propose a novel game model that incorporates uncertainty with sensors. The defender strategy in this game model will consist of three interdependent stages: an allocation stage, a signaling stage, and a reaction stage.

Existing passive defence methods cannot effectively guarantee network security; to solve this problem, a novel method is proposed that selects the optimal defence strategy. The network attack-defence process is modelled based on the Bayesian game. The payoff is quantified from the impact value of the attack-defence actions. The optimal defence strategy is selected that takes defence effectiveness as the criterion. The rationality and feasibility of the method are verified through a representative example, and the general rules of network defence are summarised. Compared to the classic strategy selection methods based on game theory, the proposed method can select the optimal strategy in the form of pure strategy by quantifying defence effectiveness, which was proven to perform better.

Security games are used to deploy limited security resources. Much work on the topic assumes that attackers have the perfect knowledge of defenders' strategies. However, it is not always the case in real life because an attacker may worry he will be caught if he observes defender's strategy on all targets. To address the issue, this paper proposes a new game model in which the attacker just selects partial targets to observe according to his goal and observation cost. Moreover, our theoretical and experimental analyses show that our model reflects well the way that attackers make decisions, and in particular, the defender can gain significantly higher utility by considering the attacker can only conduct observations on partial targets.

Traditional proactive network defenses deploy security resources in the network based on probabilistic policies to confuse potential attackers. However, this strategy can be exploited by stealthy attackers, leading to reduced efficiency and higher vulnerability. Game theory has been shown to provide a sound mathematical approach to overcome these deficiencies and determine an optimal defense strategy. However, existing game theoretic models typically either assume additive utility functions, or that the attacker can attack only one target. While such assumptions lead to tractable analyses, they miss key inherent dependencies that exist among different targets in current complex networks. In this chapter, we generalize the traditional security game model to the network scenario. We examine such a general security game from a theoretical perspective and provide a unified theoretical framework. In particular, we show that each security game is equivalent to a combinatorial optimization problem over a set system, which consists of defender’s pure strategy space. The key technique we use is based on projection of a polytope based transformation, and the ellipsoid method. We also provide several important applications of our developed framework, and show that for several problem classes, optimal defense strategies can be developed in polynomial time. Our approach paves the way for a deeper investigation into using game theoretic techniques for solving designing security mechanisms in networks, and we conclude by outlining a number of important future directions that need to be investigated.

With the complication of attack means, the network security technology needs new changes. This study analyzed the establishment of the game model and strategy selection in the process of network security attack and defense confrontation. Firstly, the relevant theory of game theory was introduced; then the network attack and defense game model was established; the components of the model were analyzed; and finally, the Nash equilibrium of the hybrid strategy was solved to obtain the optimal defense strategy. The simulation results showed that the method could find the best attack and defense strategy {a3, d4} in the complex hybrid strategy. The calculation of payoff verified the correctness of the strategy. The experimental results show that the application of the attack‐defense confrontation in the network security field is feasible and it can effectively generate optimal attack‐defense strategy to realize network security.

This paper proposes a two-person multi-stage zero-sum game model considering the confrontation between cascading failures and control strategies in an AC/DC hybrid system to solve the blocking problem of DC systems caused by successive failures at the receiving end of an AC/DC system. A game model is established between an attacker (power grid failure) and a defender (dispatch side). From the attacker’s perspective, this study mainly investigates the problem of system line failures caused by AC or DC blockages. From the perspective of dispatch-side defense, the multiple-feed short-circuit ratio constraint method, output adjustment measures of the energy storage system, sensitivity control, and distance third-segment protection adjustment are used as strategies to reduce system losses. Using as many line return data as possible as samples, the deep Q-network (DQN), a deep reinforcement learning algorithm, is used to obtain the Nash equilibrium of the game model. The corresponding optimal dispatch and defense strategies are also obtained while obtaining the optimal sequence of tripping failures for AC/DC hybrid system cascading failures. Using the improved IEEE 39-node system as an example, the simulation results verify the appropriateness of the two-stage dynamic zero-sum game model to schedule online defense strategies and the effectiveness and superiority of the energy storage system participating in defense adjustment.

Rapidly-changing cloud environments that consist of heavily interconnected components are difficult to secure. Existing solutions often try to correlate many weak indicators to identify and reconstruct multi-step cyber attacks. The lack of a true, causal link between most of these indicators still leaves administrators with a lot of false-positives to browse through. We argue that cyber deception can improve the precision of attack detection systems, if used in a structured, and automatic way, i.e., in the form of so-called tripwires that ultimately span an attack graph, which assists attack reconstruction algorithms. This paper proposes an idea for a framework that combines cyber deception, automatic tripwire injection and attack graphs, which eventually enables us to reconstruct multi-step cyber attacks in modern cloud environments.

Intelligence and impact contests in systems with redundancy, false targets, and partial protection

The study develops a game-theoretic evaluation framework for cyber deception that quantifies deception benefit relative to an otherwise matched non-deceptive baseline and links strategic outcomes to information disclosure. A defender-attacker interaction is modeled through a paired design consisting of a baseline game without deception and a corresponding decoy-enabled deception game, enabling direct measurement of deception impact through two operational metrics: the value of deception, defined as the baseline-referenced change in defender equilibrium utility attributable to deception, and the price of transparency, defined as the marginal loss induced by increased observability of the true system state. The analysis characterizes defender-optimal deception strategies, derives interpretable bounds and break-even conditions under which deception becomes ineffective due to cost or detectability, and establishes approximation properties that support scalable allocation rules. To complement equilibrium-based evaluation, the study introduces an information-theoretic uncertainty construct that captures the extent to which deception preserves attacker uncertainty after observation, providing a mechanism-level interpretation of when and why value of deception degrades as transparency increases. Computational experiments across heterogeneous scenarios demonstrate consistent cross-setting comparability, reveal tradeoffs among decoy realism, budget, and attacker rationality, and identify regimes in which simplified allocation heuristics approach optimal performance.

Inspired by successful deployments of Stackelberg Security Game in real life, researchers are working hard to optimize the game models to make them more practical. Recent security game work on wildlife protection makes a step forward by taking the possible cooperation among attackers into consideration. However, it models attackers to have complete rationality, which is not always possible in practice given they are human beings. We aim to tackle attackers' bounded rationality in the complicated, cooperation-enabled and multi-round security game for wildlife protection. Specifically, we construct a repeated Stackelberg game, and propose a novel adaptive human behavior model for attackers based on it. Despite generating defender's optimal strategy requires to solve a non-linear and non-convex optimization problem, we are able to propose an efficient algorithm that approximately solve this problem. We perform extensive real-life experiments, and results from over 25,000 game plays show our solution effectively helps the defender to deal with attackers who might cooperate.

We present an efficient polynomial-time approximation scheme (EPTAS) for the problem of scheduling jobs on parallel uniform machines that improves all previously known EPTAS for the problem. Our algorithm uses a Mixed Integer Linear Program (MILP) formulation for a relaxed version of the problem. We simplify the MILP by repeatedly removing carefully selected sets of jobs and machines until all integer variables have been removed. Then, we build up the solution through the use of a dynamic programming approach, enumeration, and linear program solving. Notable about our approach is that our algorithm only uses an LP solver, different from previous EPTAS approaches where MILP solvers are necessary.