Artificial Intelligence and Game Theory Models for Defending Critical Networks with Cyber Deception

Abstract

Traditional cyber security techniques have led to an asymmetric disadvantage for defenders. The defender must detect all possible threats at all times from all attackers and defend all systems against all possible exploitation. In contrast, an attacker needs only to find a single path to the defender’s critical information. In this article, we discuss how this asymmetry can be rebalanced using cyber deception to change the attacker’s perception of the network environment, and lead attackers to false beliefs about which systems contain critical information or are critical to a defender’s computing infrastructure. We introduce game theory concepts and models to represent and reason over the use of cyber deception by the defender and the effect it has on attacker perception. Finally, we discuss techniques for combining artificial intelligence algorithms with game theory models to estimate hidden states of the attacker using feedback through payoffs to learn how best to defend the system using cyber deception. It is our opinion that adaptive cyber deception is a necessary component of future information systems and networks. The techniques we present can simultaneously decrease the risks and impacts suffered by defenders and dramatically increase the costs and risks of detection for attackers. Such techniques are likely to play a pivotal role in defending national and international security concerns.

The interaction of dark traits with the perceptions of apprehension

“…In that context, countering deception using sophisticated technologies and advanced tactics plays a crucial role in influencing the attacker's behaviors. The application of game theory and artificial intelligence algorithms has the potential to reduce the risks and increase the costs of attacker [24], which is the goal of the deterrence theory and the economics of crime model. The key to future prevention of privacy breaches will be a concerted effort of enforcement, monitoring, and education to quell what will undoubtedly be the continuing assault on privacy.…”

“…A likely perpetrator will commit a crime if the inequality presented in Figure 1 holds [22,23]. Game theory has been proposed as a mechanism to increase the negative returns and to decrease the positive returns to the perpetrator considering an illegal cybersecurity attack [24,25].…”

Informing Autonomous Deception Systems with Cyber Expert Performance Data

“…The deception action space is where the potential to really disrupt and learn from a cyber attacker comes into play [27]. Deception does not need to be complicated; the Tularosa Study was limited to static, low-interaction decoys.…”

“…An autonomous cyber deception solution can ease the burden on defenders and make intelligent, timely decisions on their behalf. A real-time, adaptive deception system, which can ingest inputs from defensive and deceptive sensors, can learn from adversarial activity in order to track and respond with customized deception to deter, delay, or misinform potential attackers [27]. Based on the defender's own terrain, this system would naturally be limited to data that is available to the defender, either through their own Intrusion Detection System (IDS) or security systems, or through deception tools such as decoys or tripwires planted in the network.…”

A Novel Attack-and-Defense Signaling Game for Optimal Deceptive Defense Strategy Choice

“…Duan et al [14] proposed an energy-aware trust derivation scheme using the game theoretic approach to manage overhead while maintaining adequate security of WSNs. Fugate and Ferguson [15] discussed techniques for combining artificial intelligence algorithms with game theory models to estimate hidden states of the attacker using feedback through payoffs to learn how to optimally defend the system using cyber deception. Additional works are listed in Table 1.…”