Dynamic Information Flow Tracking Games for Simultaneous Detection of Multiple Attackers

Sahabandu, Dinuka; Moothedath, Shana; Allen, Joey; Clark, Andrew; Bushnell, Linda; Lee, Wenke; Poovendran, Radha

doi:10.1109/cdc40024.2019.9029836

Cited by 5 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Game-theoretic models for resource-efficient detection of APTs are given in [17], [18], [19], and [20]. DIFT models with fixed taint sink (trap) locations are introduced and analyzed in [17], [18].…”

Section: Related Workmentioning

confidence: 99%

“…Paper [19] extended the models in [17], [18] by considering a DIFT model which selects the trap locations in a dynamic manner rather than being fixed and proposed a min-cut based solution approach. Reference [20] considered the detection of APTs when the attack consists of multiple attackers possibly with different capabilities and analyzed the best responses of the players. Note that, the focus in [17], [18], and [19] is resource efficient detection of APTs and they do not consider the false-positives and false-negatives generated in the system.…”

Section: Related Workmentioning

confidence: 99%

“…Note that, the focus in [17], [18], and [19] is resource efficient detection of APTs and they do not consider the false-positives and false-negatives generated in the system. In other words, the game models in [17]- [20] assume that security analysis performed by DIFT can verify the authenticity of tagged information flows accurately. A stochastic game model for detecting APTs was recently introduced in [21].…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Dynamic Information Flow Tracking for Detection of Advanced Persistent Threats: A Stochastic Game Approach

Moothedath,

Sahabandu,

Allen

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

Advanced Persistent Threats (APTs) are stealthy customized attacks by intelligent adversaries. This paper deals with detection of APTs that infiltrate cyber systems and compromise specifically targeted data and/or infrastructures. Dynamic information flow tracking is an information trace-based detection mechanism against APTs that taints suspicious information flows in the system and generates security analysis for unauthorized use of tainted data. In this paper, we develop an analytical model for resource efficient detection of APTs using an information flow tracking game. The game is a nonzero-sum, turn-based, stochastic game with asymmetric information as the defender cannot distinguish whether an incoming flow is malicious or benign and hence has only partial state observation. We analyze equilibrium of the game and prove that a Nash equilibrium is given by a solution to the minimum capacity cut set problem on a flow-network derived from the system, where the edge capacities are obtained from the cost of performing security analysis. Finally, we implement our algorithm on the real-world dataset for a data exfiltration attack augmented with false-negative and false-positive rates and compute an optimal defender strategy.

show abstract