Security from the Adversary’s Inertia–Controlling Convergence Speed When Playing Mixed Strategy Equilibria

Abstract

Game-theoretic models are a convenient tool to systematically analyze competitive situations. This makes them particularly handy in the field of security where a company or a critical infrastructure wants to defend against an attacker. When the optimal solution of the security game involves several pure strategies (i.e., the equilibrium is mixed), this may induce additional costs. Minimizing these costs can be done simultaneously with the original goal of minimizing the damage due to the attack. Existing models assume that the attacker instantly knows the action chosen by the defender (i.e., the pure strategy he is playing in the i-th round) but in real situations this may take some time. Such adversarial inertia can be exploited to gain security and save cost. To this end, we introduce the concept of information delay, which is defined as the time it takes an attacker to mount an attack. In this period it is assumed that the adversary has no information about the present state of the system, but only knows the last state before commencing the attack. Based on a Markov chain model we construct strategy policies that are cheaper in terms of maintenance (switching costs) when compared to classical approaches. The proposed approach yields slightly larger security risk but overall ensures a better performance. Furthermore, by reinvesting the saved costs in additional security measures it is possible to obtain even more security at the same overall cost.

Computing mixed strategies equilibria in presence of switching costs by the solution of nonconvex QP problems

“…This intuition is indeed right [15], but for a rigorous problem statement, let us briefly recap the derivation given independently later by [24] to formally state the problem.…”

Computing mixed strategies equilibria in presence of switching costs by the solution of nonconvex QP problems

“…Expression (3) will in practice be only an approximate identity, since we assumed that the game, viewed as a stochastic process, has already converged to stationarity (so that the equilibrium outcome u is actually rewarded). The speed of convergence, indeed, can itself be of interest to be controlled in security applications using moving target defenses [32]. The crucial point of modeling a longer lasting effect of the current action like described above, however, lies in the avoidance of complexity: expression (3) has no issues with large k, while more direct methods of modeling a game over k rounds, or including a dependency on the last k moves, is relatively more involved (indeed, normal stochastic games consider a first-order Markov chain, where the next state of the game depends on the last state; the setting just described would correspond to an order k chain, whose conversion into a first order chain is also possible, but complicates matters significantly).…”

“…being player 1 in the following, plays "against itself", since the losses are implied by its own behavior. While the expected payoffs in a matrix game under mixed strategies ∈ (S 1 ), ∈ (S 2 ) are expressible by the bilinear functional T , the same logic leads to the hypothesis that the switching cost should on average be given by the quadratic functional T , where the switching cost matrix is given, like the payoff matrix above, as This intuition is indeed right [26], but for a rigorous problem statement, we will briefly recap the derivation given independently later by [32] to formally state the problem.…”

Repeated Games with Switching Costs: Stationary vs History Independent Strategies

“…Another natural method to include switching costs in the payoff is by considering some weighted average between the stage payoff and the switching costs. This was done by Rass and Rainer [2014] and others [Rass et al, 2017, Wachter et al, 2018, Liuzzi et al, 2020, who studied a model where players use static strategies and the payoff is a weighted average of the switching costs and the costs of the game itself: αx T Ay p1 ´αqy T Sy, with α P r0, 1s. This is slightly different from our model.…”

“…This poses a computational challenge. Second, in some applications such as cybersecurity, there is an additional requirement that the mixed actions of the minimizing player (defender) should be the same for every state [Rass et al, 2017, Wachter et al, 2018. Otherwise, they would deem the behavior of the defender predictable by the attacker.…”