Stealthy attacks with insider information: A game theoretic model with asymmetric feedback

Abstract

Advanced Persistent Threats (APT) are highly motivated and persistent, and they often operate in a stealthy way to avoid detection. Moreover, an advanced attacker may choose to approach insiders within the organization. Insider information can not only reduce the attack cost significantly but also make the attack more covert. Although stealthy attacks and insider threats have been considered separately in previous works, the coupling of the two is not well understood. As both types of threats are incentive driven, game theory is an appropriate tool to reason about the strategic behavior for each participant. We propose a non-zero sum three-player game model to study the interplay between APT and insider threats. Our model is built upon the two-player FlipIt game model for stealthy takeover with two extensions. First, we consider an asymmetric feedback structure where the defender is observable, while the attacker is stealthy and obtains delayed feedback about the defender's security updates. Second, we consider a three-player setting by introducing an insider with a double role, where it can help either the attacker or the defender according to the payoffs. We characterize the subgame perfect equilibria of a sequential game with the defender as the leader, and the insider and the attacker as the followers. We derive various insights from the game model, and discuss approaches for achieving more efficient defense in the face of both a stealthy attacker and an insider with double roles.