Defending Against Advanced Persistent Threats Using Game-Theory

Abstract

Advanced persistent threats (APT) combine a variety of different attack forms ranging from social engineering to technical exploits. The diversity and usual stealthiness of APT turns them into a central problem of contemporary practical system security, since information on attacks, the current system status or the attacker’s incentives is often vague, uncertain and in many cases even unavailable. Game theory is a natural approach to model the conflict between the attacker and the defender, and this work investigates a generalized class of matrix games as a risk mitigation tool for an advanced persistent threat (APT) defense. Unlike standard game and decision theory, our model is tailored to capture and handle the full uncertainty that is immanent to APTs, such as disagreement among qualitative expert risk assessments, unknown adversarial incentives and uncertainty about the current system state (in terms of how deeply the attacker may have penetrated into the system’s protective shells already). Practically, game-theoretic APT models can be derived straightforwardly from topological vulnerability analysis, together with risk assessments as they are done in common risk management standards like the ISO 31000 family. Theoretically, these models come with different properties than classical game theoretic models, whose technical solution presented in this work may be of independent interest.

A dynamic games approach to proactive defense strategies against Advanced Persistent Threats in cyber-physical systems

“…As an alternative to these detection methods, security game models [9], [10], [11] have provided quantitative risk management frameworks that allow the system to prepare for attacks proactively. FlipIt game [12] models the key leakage under APTs as a private takeover between the system operator and the attacker.…”

A Survey of Moving Target Defenses for Network Security

“…We found that many MTD works only consider (and show) the improvement in regards to security and either assuming that it has no impact on performance or ignore that aspect altogether. We will now discuss the details [62], [65], [75], [69], [127], [100], [70], [59], [146], [61], [65], [76], [66], [91], [71], [78], [79], [80], [147] [64], [94], [143] [72], [67] [85], [7], [58], [107], [68], [131], [118], [77], [141] [105], [109], [73] Works in bold explicitly consider diversity of configurations.…”

“…[62], [58], [59], [146], [61], [78], [79], [80], [94], [148], [147] [75], [69], [70], [107], [76], [71] [7], [68], [65], [66], [91], [131], [118], [143] Fig . 11: A Moving Target Defense is more effective if it considers the security and performance impacts of the system configurations, both in unison and also when placed in an ensemble of system configurations that the MTD leverages.…”

“…MTDs the consider some form of game-theoretic modeling, consider the security of individual defenses in the ensemble by representing them as a part of the defender's utility value [62], [79], [61], [91], [67], [79], [147], [80]. For most of these works, the security metrics considered for each action are obtained using scoring metrics designed by experts like the Common Vulnerability Scoring Services (CVSS) discussed earlier.…”

“…In that regard, authors in [67] model the security of a configuration as inversely proportional to the probability with which an adversary can come up with a new attack given the attacks it performed in the earlier time steps. In [147], the authors try to model zero-day attacks by asking security experts to annotate how effective they think a particular countermeasure or defense action will be against zero-day vulnerabilities. As the annotations might be inaccurate (due to lack of actual black-hat hackers who invent zero-day attacks in the set of security experts who annotate the defense methods), we believe the effectiveness of their MTD cannot be accurately determined.…”