Preventive and Reactive Cyber Defense Dynamics Is Globally Stable

Abstract

Abstract-The recently proposed cybersecurity dynamics approach aims to understand cybersecurity from a holistic perspective by modeling the evolution of the global cybersecurity state. These models describe the interactions between the various kinds of cyber defenses and the various kinds of cyber attacks. We study a particular kind of cybersecurity dynamics caused by the interactions between preventive and reactive defenses (e.g., filtering and malware detection) against push-and pull-based cyber attacks (e.g., malware spreading and "drive-by download" attacks). The dynamics was previously shown to be globally stable in a special regime of the parameter universe, but little is known beyond this special regime. In this paper, we resolve an open problem in this domain by proving that the dynamics is globally stable in the entire parameter universe (i.e., the dynamics always converges to a unique equilibrium). We discuss the cybersecurity meanings and implications of this theoretic result. We also prove that the dynamics converges exponentially to the equilibrium except for a special parameter regime, in which case the dynamics converges polynomially. Since it is often difficult to compute the equilibrium, we propose new bounds of the equilibrium and numerically show that these bounds are tighter than those proposed in the literature.

Moving Target Defense Techniques: A Survey

“…Consequently, multiobjective reinforcement learning algorithm is designed to obtain the optimal security strategy so as to minimize attack surface and maximize configuration diversity. For the high computational complexity of optimal strategy generation, Zheng et al [50] proposed a novel of a method to analyze different MTD strategies. By analyzing the defensive computational complexity in known special parameter domain and the entire parameter domain, it shows optimal defensive strategy in known special parameter domain convergences in polynomial complexity and defensive strategy formulation in remaining parameter domain convergences in an exponential complexity.…”

Metrics Towards Measuring Cyber Agility

“…For example, the effectiveness of antimalware tools (e.g., the false positive rate or false negative rate) is often measured based on malware samples collected during a period of time (e.g., one year), while ignoring their instantaneous evolution over time. Taking one step further from static metrics, time-dependent security metrics have been studied to characterize and quantify system states at different times, such as the proportion of compromised computers in a network [6], [7], [8], [9], [10], [11], [33], [34], [35], [36], [37], [38], [39], [40], [41], [42].…”

Defending against the Advanced Persistent Threat: An Optimal Control Approach

“…The individual-level epidemic modeling technique has been successfully applied to areas such as the epidemic spreading [34][35][36][37], the malware spreading [38][39][40][41][42][43], and the rumor spreading [44]. In particular, a number of APT attack-defense models have recently been proposed by employing this technique [45][46][47][48].…”