Strategic aspects of cyberattack, attribution, and blame

Edwards, Benjamin; Furnas, Alexander C.; Forrest, Stephanie; Axelrod, Robert

doi:10.1073/pnas.1700442114

Cited by 43 publications

(24 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Central among these is the attribution problem: the potential difficulty in determining who is responsible for an attack or even if an attack occurred at all. 1 Attribution problems weaken deterrence: multiplying a penalty by the probability of correct attribution reduces the expected penalty (Clark and Landau 2010;Edwards et al 2017;Goldsmith 2013;Kello 2017;Lindsay 2015;Nye 2011). But the implications of imperfect attribution for deterrence are much richer than this, and the precise effects-as well as how a state can optimally deter attacks under imperfect attributionhave yet to be studied.…”

mentioning

confidence: 99%

Deterrence with Imperfect Attribution

Baliga¹,

Mesquita

Wolitzky

2020

Am Polit Sci Rev

View full text Add to dashboard Cite

Motivated by recent developments in cyberwarfare, we study deterrence in a world where attacks cannot be perfectly attributed to attackers. In the model, each of $$ n $$ attackers may attack the defender. The defender observes a noisy signal that probabilistically attributes the attack. The defender may retaliate against one or more attackers and wants to retaliate against the guilty attacker only. We note an endogenous strategic complementarity among the attackers: if one attacker becomes more aggressive, that attacker becomes more “suspect” and the other attackers become less suspect, which leads the other attackers to become more aggressive as well. Despite this complementarity, there is a unique equilibrium. We identify types of improvements in attribution that strengthen deterrence—namely, improving attack detection independently of any effect on the identifiability of the attacker, reducing false alarms, or replacing misidentification with non-detection. However, we show that other improvements in attribution can backfire, weakening deterrence—these include detecting more attacks where the attacker is difficult to identify or pursuing too much certainty in attribution. Deterrence is improved if the defender can commit to a retaliatory strategy in advance, but the defender should not always commit to retaliate more after every signal.

show abstract

mentioning

confidence: 99%

Deterrence with Imperfect Attribution

Baliga¹,

Mesquita

Wolitzky

2020

Am Polit Sci Rev

View full text Add to dashboard Cite

show abstract

“…Then they proved the existence of several Bayesian-Nash Equilibriums and huieventually derive optimal strategies for both sides. Edwards et al [21] presented a game-theoretic model, where the attacker's vulnerability, the knowledge level of the victim, payoffs for different outcomes, and the beliefs about their opponent are taken into account to obtain the best strategic choice.…”

Section: Related Workmentioning

confidence: 99%

Anti-Honeypot Enabled Optimal Attack Strategy for Industrial Cyber-Physical Systems

Xiao

Shi

et al. 2020

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Honeypots have been widely used in the security community to understand the cyber threat landscape, for example to study unauthorized penetration attempts targeting industrial cyber-physical systems (ICPS) and observing the behaviors in such activities. However, some better-resourced cyber attackers may attempt to identify honeypots and develop strategies to compromise them, aka anti-honeypot. In this paper, we present an anti-honeypot enabled optimal attack strategy for ICPS, by employing a novel game-theoretical approach. Specifically, the interactions between the attacker and ICPS defender are captured with a proposed hybrid signaling and repeated game, i.e., a non-cooperative two-player one-shot game with incomplete information. By taking into account both various possible defenses of an ICPS and diverse offensive acts of attackers, a Nash equilibrium is derived, which exhibits an optimal attack strategy for attackers with varying technical sophistication. Extensive simulation experiments on multiple test cases demonstrate that, the derived strategy offers the attackers an optimal tactic to compromise the target ICPS protected by honeypots, while having only incomplete knowledge of the defensive mechanisms.

show abstract

“…8 Since the first rigorous threat intelligence report in 2013 which sought to attribute a collection of cyber intrusions of U.S. companies to the Chinese military, there has been a growing body of literature concerning the technical challenges of attributing a cyber incident to an individual or government entity (Rid and Buchanan, 2015;Lin, 2016). In addition, other scholarship has addressed particular strategic, legal and ethical issues that arise when entities seek to attribute cyber events (Anderson, 2018;Eichensehr, 2017;Guerrero-Saade, 2015;Edwards et al 2017). The current state of affairs is complicated enough that there have even been numerous proposals to standardize attribution reports or even create new international or private-sector led organizations whose mission is to attribute malicious cyber activity (Davis et al, 2017;Microsoft's Cyber IAEA 9 ; Atlantic Council Attribution Council 10 ).…”

Section: What Is Attribution Of Cyber Incidents?mentioning

confidence: 99%

Private Sector Attribution of Cyber Incidents: Benefits and Risks to the U.S. Government

Romanosky¹,

Boudreaux²

2019

View full text Add to dashboard Cite

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited. Permission is given to duplicate this document for personal use only, as long as it is unaltered and complete. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial use. For information on reprint and linking permissions, please visit www.rand.org/pubs/permissions.html. The RAND Corporation is a research organization that develops solutions to public policy challenges to help make communities throughout the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.

show abstract

Strategic aspects of cyberattack, attribution, and blame

Cited by 43 publications

References 13 publications

Deterrence with Imperfect Attribution

Deterrence with Imperfect Attribution

Anti-Honeypot Enabled Optimal Attack Strategy for Industrial Cyber-Physical Systems

Private Sector Attribution of Cyber Incidents: Benefits and Risks to the U.S. Government

Contact Info

Product

Resources

About