Mitigation of Targeted and Non-targeted Covert Attacks as a Timing Game

Lászka, Áron; Johnson, Benjamin; Großklags, Jens

doi:10.1007/978-3-319-02786-9_11

Cited by 22 publications

(13 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Laszka et al [6,7] have investigated the influence of including non-targeted attackers in the FlipIt model. Feng et al [8] and Hu et al [9] modified the game by considering insider threat actors.…”

Section: Related Workmentioning

confidence: 99%

Time-Dependent Strategies in Games of Timing

Merlevede

Johnson

Großklags

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Timing, a central aspect of decision-making in security scenarios, is a subject of growing academic interest; frequently in the context of stealthy attacks, or advanced persistent threats (APTs). A key model in this research landscape is FlipIt [1]. However, a limiting simplifying assumption in the FlipIt literature is that costs and gains are not subject to discounting, which contradicts the typical treatment of decision-making over time in most economically relevant contexts. Our recent work [2] introduces an adaptation of the FlipIt model that applies time-based exponential discounting to the value of a protected resource, while allowing players to choose from among the same canonical strategies as in the original game. This paper extends the study of games of timing by introducing two new classes of strategies that are fundamentally motivated by a time-discounted world view. Within our game model, we compute player utilities, best responses and give a partial characterization of the game's Nash equilibria. Our model allows us to re-interpret the APT model using a finite total valuation, and a finite time horizon. By applying time-based discounting to the entire decision-making framework, we increase the level of realism as well as applicability to organizational security management.

show abstract

Section: Related Workmentioning

confidence: 99%

Time-Dependent Strategies in Games of Timing

Merlevede

Johnson

Großklags

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…We consider first an opponent playing periodically with random phase. Previous work has focused primarily on analyzing P δ strategies in a non-adaptive context [3,15,14,6]. We first show theoretically that QFlip eventually learns to play optimally against a Periodic opponent when the future discount γ is set at 0.…”

Section: Theoretical Analysis For Periodic Opponentmentioning

confidence: 97%

“…All of this work uses exclusively non-adaptive players, often limiting analysis to solely opponents playing periodically. The only previous work that considers adaptive strategies is by Laszka et al [15,14], but in a modification of the original game with non-stealthy defenders. QFlip can generalize to play adaptively in these extensions, which we leave to future work.…”

Section: Related Workmentioning

confidence: 99%

$$\mathsf {QFlip}$$ : An Adaptive Reinforcement Learning Strategy for the $$\mathsf {FlipIt}$$ Security Game

Oakley

Oprea

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

A rise in Advanced Persistent Threats (APTs) has introduced a need for robustness against long-running, stealthy attacks which circumvent existing cryptographic security guarantees. FlipIt is a security game that models attacker-defender interactions in advanced scenarios such as APTs. Previous work analyzed extensively non-adaptive strategies in FlipIt, but adaptive strategies rise naturally in practical interactions as players receive feedback during the game. We model the FlipIt game as a Markov Decision Process and introduce QFlip, an adaptive strategy for FlipIt based on temporal difference reinforcement learning. We prove theoretical results on the convergence of our new strategy against an opponent playing with a Periodic strategy. We confirm our analysis experimentally by extensive evaluation of QFlip against specific opponents. QFlip converges to the optimal adaptive strategy for Periodic and Exponential opponents using associated state spaces. Finally, we introduce a generalized QFlip strategy with composite state space that outperforms a Greedy strategy for several distributions including Periodic and Uniform, without prior knowledge of the opponent's strategy. We also release an OpenAI Gym environment for FlipIt to facilitate future research.

show abstract

“…In addition, the usefulness of the FlipIt game has been investigated for various application scenarios [47]. More recent work investigates the impact on different modeling assumptions about the attacker, i.e., how does the defender's behavior change when faced with different populations of targeting and non-targeting attackers [32], [33].…”

Section: B Flipit: Modeling Targeted Attacksmentioning

confidence: 99%

How Task Familiarity and Cognitive Predispositions Impact Behavior in a Security Game of Timing

Großklags

Reitter

2014

2014 IEEE 27th Computer Security Foundations Symposium

Self Cite

View full text Add to dashboard Cite

This paper addresses security and safety choices that involve a decision on the timing of an action. Examples of such decisions include when to check log files for intruders and when to monitor financial accounts for fraud or errors. To better understand how performance in timing-related security situations is shaped by individuals' cognitive predispositions, we effectively combine survey measures with economic experiments. Two behavioral experiments are presented in which the timing of online security actions is the critical decision-making factor. The feedback modality in the decision-environment is varied between visual feedback with history (Experiment 1), and temporal feedback without history (Experiment 2). Using psychometric scales, we study the role of individual difference variables, specifically risk propensity and need for cognition. The analysis is based on the data from over 450 participants. We find that risk propensity is not a hindrance in timing tasks. Participants of average risk propensity generally benefit from a reflective disposition (high need for cognition), particularly when visual feedback is given. Overall, participants benefit from need for cognition; however, in the more difficult, temporal-estimation task, this requires familiarity with the task.

show abstract

Mitigation of Targeted and Non-targeted Covert Attacks as a Timing Game

Cited by 22 publications

References 10 publications

Time-Dependent Strategies in Games of Timing

Time-Dependent Strategies in Games of Timing

$$\mathsf {QFlip}$$ : An Adaptive Reinforcement Learning Strategy for the $$\mathsf {FlipIt}$$ Security Game

How Task Familiarity and Cognitive Predispositions Impact Behavior in a Security Game of Timing

Contact Info

Product

Resources

About