Toward an integrated dynamic defense system for strategic detecting attacks in cloud networks using stochastic game

Kandoussi, El Mehdi; Hanini, Mohamed; Mir, Iman El; Haqiq, Abdelkrim

doi:10.1007/s11235-019-00616-1

Cited by 12 publications

(9 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(1) Reconnaissance attacks have technical advantage [20]. Network scanning techniques and tools, such as the ICMP ping and the NMap, provide the attacker with mature tactics to study information and configuration (i.e., IP blocks, OS fingerprinting, and software vulnerabilities).…”

Section: Reconnaissance Attacks In the Cloud Tenant Networkmentioning

confidence: 99%

“…Game theory and attack graphs are often studied in developing the deception strategy [30]. In defending cloud networks, Kandoussi et al [20] used stochastic games to allocate honeypots and detect stealthy attackers. Almohri et al [31] developed a digraph-based strategy to place fake services in the cloud to delay remote attackers.…”

Section: Defensive Deception For the Cloudmentioning

confidence: 99%

See 1 more Smart Citation

Defensive deception framework against reconnaissance attacks in the cloud with deep reinforcement learning

Guo

Huo

et al. 2022

Sci. China Inf. Sci.

View full text Add to dashboard Cite

Implementing defensive deception in the cloud is promising to proactively counter reconnaissance attack. This technique presents decoys to camouflage cloud assets and distracts attack resource. However, the major challenge is to develop an effective deception strategy to orchestrate digital decoys. To address this issue, we propose a deep reinforcement learning (DRL)-based defensive deception framework. First, we formulate a utility function, which mathematically models underlying threats associated with common vulnerabilities among virtual machines in the cloud. Then, we customize training interfaces and the neural networks for a DRL agent. The reward function reflects the effectiveness of asset concealment and the waste of attack resources, referring to a comprehensive defense goal. Finally, the well-trained DRL agent generates the optimal defense strategy. It specifies a more granular deception strategy than existing proposals. Simulation results show that the proposed framework leads to a 7.87% average advantage in realizing the comprehensive defense goal. Moreover, it can stably improve the concealment degree of cloud assets up to 20.58%, and increase the attack cost up to 40.40%. This study shows that it is promising to improve cloud security with deception defense and artificial intelligence techniques.

show abstract

Section: Reconnaissance Attacks In the Cloud Tenant Networkmentioning

confidence: 99%

Section: Defensive Deception For the Cloudmentioning

confidence: 99%

Defensive deception framework against reconnaissance attacks in the cloud with deep reinforcement learning

Guo

Huo

et al. 2022

Sci. China Inf. Sci.

View full text Add to dashboard Cite

show abstract

“…e attacker and defender enter a stalemate stage at t ∈ [7, 63], both adopt medium-intensity strategies, and both can achieve a balance between attack and defense. At t ∈ [22,26], the attacker attempts a high-intensity attack. Although the defender adopts certain countermeasures, it is successfully attacked, and some normal nodes are infected.…”

Section: Trajectory Analyses Of Optimal Dynamic Strategies Of the Attacker And Defendermentioning

confidence: 99%

“…(2) It can be seen from Figure 3 that, in the case of relatively weak random disturbances, the trajectories of the dynamic strategies of the attacker and defender are similar to those without random disturbance. e defense stage exists at t ∈ [0, 7], the stalemate stage at t ∈ [7,26], and the penetration stage at t > 26 s. e main intensities of strategies in the defense, stalemate, and penetration stages are high, medium, and low, respectively. However, under the influence of random factors, the elapsed time of stalemate is significantly reduced, from 56 s to 19 s. In this stage, the two sides have achieved certain results.…”

Section: Trajectory Analyses Of Optimal Dynamic Strategies Of the Attacker And Defendermentioning

confidence: 99%

“…Liu et al [25] analyzed the impact of threat propagation on the security of a network system, evaluated system states through a stochastic game model, and provided enhanced defense strategies based on the Nash equilibrium. Kandoussi et al [26] combined stochastic game theory with attack graphs to model attack-defense interactions, analyzed potential attack paths, and deployed corresponding security measures.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Optimal Network Defense Strategy Selection Method: A Stochastic Differential Game Model

Mao

Zhang

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

In a real-world network confrontation process, attack and defense actions change rapidly and continuously. The network environment is complex and dynamically random. Therefore, attack and defense strategies are inevitably subject to random disturbances during their execution, and the transition of the network security state is affected accordingly. In this paper, we construct a network security state transition model by referring to the epidemic evolution process, use Gaussian noise to describe random effects during the strategy execution, and introduce a random disturbance intensity factor to describe the degree of random effects. On this basis, we establish an attack-defense stochastic differential game model, propose a saddle point equilibrium solution method, and provide an algorithm to select the optimal defense strategy. Our method achieves real-time defense decision-making in network attack-defense scenarios with random disturbances and has better real-time performance and practicality than current methods. Results of a simulation experiment show that our model and algorithm are effective and feasible.

show abstract

Enhancing cloud security: harnessing bayesian game theory for a dynamic defense mechanism

Kandoussi,

Houmairi,

El Mir

et al. 2024

Cluster Comput

View full text Add to dashboard Cite

Toward an integrated dynamic defense system for strategic detecting attacks in cloud networks using stochastic game

Cited by 12 publications

References 16 publications

Defensive deception framework against reconnaissance attacks in the cloud with deep reinforcement learning

Defensive deception framework against reconnaissance attacks in the cloud with deep reinforcement learning

Optimal Network Defense Strategy Selection Method: A Stochastic Differential Game Model

Enhancing cloud security: harnessing bayesian game theory for a dynamic defense mechanism

Contact Info

Product

Resources

About