Game-Theoretic Foundations for the Strategic Use of Honeypots in Network Security

Kiekintveld, Christopher; Lisý, Viliam; Píbil, Radek

doi:10.1007/978-3-319-14039-1_5

Cited by 60 publications

(40 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…As a result, solving the insurer's problem (16) is equivalent to solving the following problem after plugging (40) into (16): (41) is a nonlinear programming problem and it is challenging to find the analytical solution. We can leverage numerical methods to compute s * and obtain T * with (40). We can then find p * d,n and p * a,n by plugging s * into Proposition 1, and further obtain the solution of the FlipIn-C game defined in Definition 5.…”

Section: Cyber Insurance: Defender-cmentioning

confidence: 99%

$\mathtt{FlipIn}$ : A Game-Theoretic Cyber Insurance Framework for Incentive-Compatible Cyber Risk Management of Internet of Things

Zhang

Zhu

2020

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Internet of Things (IoT) is highly vulnerable to emerging Advanced Persistent Threats (APTs) that are often operated by well-resourced adversaries. Achieving perfect security for IoT networks is often cost-prohibitive if not impossible. Cyber insurance is a valuable mechanism to mitigate cyber risks for IoT systems. In this work, we propose a bi-level game-theoretic framework called FlipIn to design incentivecompatible and welfare-maximizing cyber insurance contracts. The framework captures the strategic interactions among APT attackers, IoT defenders, and cyber insurance insurers, and incorporates influence networks to assess the systemic cyber risks of interconnected IoT devices. The FlipIn framework formulates a game over networks within a principal-agent problem of moral-hazard type to design a cyber risk-aware insurance contract. We completely characterize the equilibrium solutions of the bi-level games for a network of distributed defenders and a semi-homogeneous centralized defender and show that the optimal insurance contracts cover half of the defenders' losses. Our framework predicts the risk compensation of defenders and the Peltzman effect of insurance. We study a centralized security management scenario and its decentralized counterpart, and leverage numerical experiments to show that network connectivity plays an important role in the security of the IoT devices and the insurability of both distributed and centralized defenders.

show abstract

Section: Cyber Insurance: Defender-cmentioning

confidence: 99%

$\mathtt{FlipIn}$ : A Game-Theoretic Cyber Insurance Framework for Incentive-Compatible Cyber Risk Management of Internet of Things

Zhang

Zhu

2020

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…In cybersecurity, deception has been adopted across many security techniques with much success, for example, in the strategic allocation of honeypots [8] and masking the properties of systems [9]. Using deceptive signals in Stackelberg Security Games also has great potential for use in cybersecurity.…”

Section: Deceptive Signaling For Cybersecuritymentioning

confidence: 99%

Adaptive Cyber Deception: Cognitively Informed Signaling for Cyber Defense

Cranford¹,

González²,

Aggarwal³

et al. 2020

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

This paper improves upon recent game-theoretic deceptive signaling schemes for cyber defense using the insights emerging from a cognitive model of human cognition. One particular defense allocation algorithm that uses a deceptive signaling scheme is the peSSE (Xu et al., 2015). However, this static signaling scheme optimizes the rate of deception for perfectly rational adversaries and is not personalized to individuals. Here we advance this research by developing a dynamic and personalized signaling scheme using cognitive modeling. A cognitive model based on a theory of experiential-choice (Instance-Based Learning Theory; IBLT), implemented in a cognitive architecture (Adaptive Control of Thought -Rational; ACT-R), and validated using human experimentation with deceptive signals informs the development of a cognitive signaling scheme. The predictions of the cognitive model show that the proposed solution increases the compliance to deceptive signals beyond the peSSE. These predictions were verified in human experiments, and the results shed additional light on human reactions towards adaptive deceptive signals.

show abstract

“…The use of game theory in cybersecurity is not new [5,13]. For instance, [17,18] study different game models that address strategies for deploying honeypot networks. They define basic honeypot selection games where the defender chooses the properties of the network, plus an extension where the attacker can also probe the network, and a final version where the attacker strategies are represented by an attack graph.…”

Section: Related Workmentioning

confidence: 99%

Hybrid adversarial defense: Merging honeypots and traditional security methods1

Chakraborty

Jajodia

Park

et al. 2018

JCS

View full text Add to dashboard Cite

Most past work on honeypots has made two assumptions: (i) they assume that the only defensive measure used is a honeypot mechanism, and (ii) they do not consider both rational and subrational adversaries and do not reason with an adversary model when placing honeypots. However, real-world system security officers use a mix of instruments such as traditional defenses (e.g. firewalls, intrusion detection systems), and honeypots form only one portion of the strategy. Moreover, the placement of traditional defenses and honeypots cannot be done independently. In this paper, we consider a Stackelbergstyle game situation where the defender models the attacker and uses that model to identify the best placement of traditional defenses and honeypots. We provide a formal definition of undamaged asset value (i.e. the value that is not compromised by the attacker) under a given defensive strategy and show that the problem of finding the best placement so as to maximize undamaged asset value is NP-hard. We propose a greedy algorithm and show via experiments, both on real enterprise networks and on ones generated by the well-known network simulation tool NS-2, that our algorithm quickly computes near optimal placements. As such, our method is both practical and effective.

show abstract

Game-Theoretic Foundations for the Strategic Use of Honeypots in Network Security

Cited by 60 publications

References 16 publications

$\mathtt{FlipIn}$ : A Game-Theoretic Cyber Insurance Framework for Incentive-Compatible Cyber Risk Management of Internet of Things

$\mathtt{FlipIn}$ : A Game-Theoretic Cyber Insurance Framework for Incentive-Compatible Cyber Risk Management of Internet of Things

Adaptive Cyber Deception: Cognitively Informed Signaling for Cyber Defense

Hybrid adversarial defense: Merging honeypots and traditional security methods1

Contact Info

Product

Resources

About