Attack-defense Game Model Research Articles

A probabilistic automata-based network attack-defense game model for data security by using security service chain

A probabilistic automata-based network attack-defense game model for data security by using security service chain

Defense strategy selection based on incomplete information game for the false data injection attack

With the rapid development and wide application of sensing devices and communication networks, the traditional power system has transformed into a cyber physical power system (CPPS) gradually. The constant interaction of information flow and power flow exposes the grid to potential cyber-attack risks. In this paper, the defense strategy selection approaches are proposed based on incomplete information game against false data injection attack (FDIA) in different scenarios. Firstly, the attack-defense tree model containing economic indicators and a measure of attack is established, and the expected revenues of both attacker and defender are calculated in detail. Secondly, the static Bayesian attack-defense game model in which the defender grasps incomplete information is constructed, considering two cases of low-tech attacker and high-tech attacker. Then, the zero-sum attack-defense game model in which the attacker masters incomplete information is structured, considering the changing attack space. Finally, the simulations are carried out on the IEEE 30-bus system, and the optimal defense strategies in the case of two incomplete information are obtained by solving the equilibrium point. The simulation results demonstrate that the proposed method is effective in cyber security defense system, and can provide guiding ideology and theoretical basis for operators to deploy defense measures.

Control modeling and optimization of network information security system based on deep learning data interaction

Control modeling and optimization of network information security system based on deep learning data interaction

Security risk assessment of projects in high-risk areas based on attack-defense game model

Assessing the security risk of projects in high-risk areas is particularly important. This paper develops a security risk assessment model for projects in high-risk areas based on the target loss probability model and Bayesian game model. This model is modeled from the perspective of attack-defense confrontation and addresses the issue that traditional risk assessment focuses on the analysis of the attacker yet neglects to analyze the defender—the defender’s optimum defensive information is not quantitatively determined. The risk level, optimum defensive resource value, and optimum defensive strategy of the project are determined through the analysis of a project in the high-risk area. This enables the project’s risk manager to adjust the defensive resources reasonably and optimally, confirming the objectivity and feasibility of the model and offering a new benchmark for security risk assessment, which has significant practical implications.

A method for analyzing Stackelberg attack–defense game model in 5G by tCPSO

A method for analyzing Stackelberg attack–defense game model in 5G by tCPSO

Attack-Defense Game Model with Multi-Type Attackers Considering Information Dilemma.

Today, people rely heavily on infrastructure networks. Attacks on infrastructure networks can lead to significant property damage and production stagnation. The game theory provides a suitable theoretical framework for solving the problem of infrastructure protection. Existing models consider only the beneficial effects that the defender obtains from information gaps. If the attacker's countermeasures are ignored, the defender will become passive. Herein, we consider that a proficient attacker with a probability in the game can fill information gaps in the network. First, we introduce the link-hiding rule and the information dilemma. Second, based on the Bayesian static game model, we establish an attack-defense game model with multiple types of attackers. In the game model, we consider resource-consistent and different types of distributions of the attacker. Then, we introduce the solution method of our model by combining the Harsanyi transformation and the bi-matrix game. Finally, we conduct experiments using a scale-free network. The result shows that the defender can be benefited by hiding some links when facing a normal attacker or by estimating the distribution of the attacker correctly. The defender will experience a loss if it ignores the proficient attacker or misestimates the distribution.

Mixed Strategy Analysis in Attack-Defense Game Model Based on 5G Heterogeneous Network of CPS Using ncPSO

The development of the 5th Generation Mobile Communication Technology not only brings convenience to people but also brings many network security problems. Based on the static game theory of complete information, a game model of attack and defense with limited resources in heterogeneous networks of Cyber Physical Systems is established. This model analyzes the basic rules of the offensive and defensive strategies of both parties when the offensive and defensive resources are limited in the 5th Generation Mobile Communication Technology network environment. The model can also describe the interaction between attackers and defenders. A novel compact particle swarm optimization algorithm is proposed to solve the difficult problem of solving the Nash equilibrium of this game model. The simulation experiment proves that novel compact particle swarm optimization algorithm has good optimization ability and shows that the algorithm can effectively solve the Nash equilibrium of the model. The simulation experiment provides a strategic reference for the attack-defense game with limited resources.

An attack-defense game model in infrastructure networks under link hiding.

Our increasing dependence on infrastructure networks leads to growing concerns over the protection of these networks. Many methods have been proposed to select protective strategies by combining complex network theory and game theory. However, the misleading effect of hidden links is not considered in previous methods. This work creates an information gap between attackers and defenders by partly hiding network links to mislead the attacker in the game. We first introduce the rule of link hiding that depends on the nodes' property, where the number of hidden links has a maximum value. Additionally, based on the Stackelberg game model, we establish an attack-defense game model with link hiding strategies considering node property and cost constraints. Finally, we conduct experiments in a scale-free network and an existing power grid. The experimental results show that the defender tends to combine first-mover advantage and link hiding to get a better payoff under more different costs of the nodes. Hiding half of the links in the existing power grid can effectively reduce network damage by about 22.8% on average, with the two sides investing the same resources. The effect of link hiding could be more obvious when the attacker owns more resources than the defender. When an attacker employs the high-degree attacking strategy, the proposed link hiding method can help the defender reduce the damage to the network by 12.2% compared to the link reconnecting method.

A Defense Strategy Selection Method Based on the Cyberspace Wargame Model

Network defenders always face the problem of how to use limited resources to make the most reasonable decision. The network attack-defense game model is an effective means to solve this problem. However, existing network attack-defense game models usually assume that defenders will no longer change defense strategies after deploying them. However, in an advanced network attack-defense confrontation, defenders usually redeploy defense strategies for different attack situations. Therefore, the existing network attack-defense game models are challenging to accurately describe the advanced network attack-defense process. To address the above challenges, this paper proposes a defense strategy selection method based on the network attack-defense wargame model. We model the advanced network attack-defense confrontation process as a turn-based wargame in which both attackers and defenders can continuously adjust their strategies in response to the attack-defense posture and use the Monte Carlo tree search method to solve the optimal defense strategy. Finally, a network example is used to illustrate the effectiveness of the model and method in selecting the optimal defense strategy.

Industrial Control System Defense Decision-Making Method Based on Dynamic Attack-Defense Game

Industrial control systems are different from traditional information systems and require extremely high system availability. In the face of potential attack incidents, blind defense deployment may affect system performance and efficiency, which is counterproductive. For this reason, this paper proposes a defense decision-making method for industrial control systems based on dynamic attack-defense games. This method first analyzes the actual attack-defense confrontation scenarios in the industrial control system, and constructs a dynamic attack-defense game model based on this. After that, an industrial control system attack-defense game tree defined on this model is constructed, and the game tree is used to describe the specific attack-defense confrontation process. Then the backward induction method is used in the game tree to find the equilibrium path. The information on this path is of great reference value for defenders to choose a reasonable and efficient defense plan, maintain system stability and reduce defense costs. At the end of this paper, this method is applied to a real limestone powder preparation system for experiments. The experimental results verify the effectiveness of the method in actual scenarios.

Epidemic Analysis of Wireless Rechargeable Sensor Networks Based on an Attack-Defense Game Model.

Energy constraint hinders the popularization and development of wireless sensor networks (WSNs). As an emerging technology equipped with rechargeable batteries, wireless rechargeable sensor networks (WRSNs) are being widely accepted and recognized. In this paper, we research the security issues in WRSNs which need to be addressed urgently. After considering the charging process, the activating anti-malware program process, and the launching malicious attack process in the modeling, the susceptible–infected–anti-malware–low-energy–susceptible (SIALS) model is proposed. Through the method of epidemic dynamics, this paper analyzes the local and global stabilities of the SIALS model. Besides, this paper introduces a five-tuple attack–defense game model to further study the dynamic relationship between malware and WRSNs. By introducing a cost function and constructing a Hamiltonian function, the optimal strategies for malware and WRSNs are obtained based on the Pontryagin Maximum Principle. Furthermore, the simulation results show the validation of the proposed theories and reveal the influence of parameters on the infection. In detail, the Forward–Backward Sweep method is applied to solve the issues of convergence of co-state variables at terminal moment.

Study on cybersecurity attack-defense visualization method based on intelligent connected vehicle

Attack test and defense verification are important ways to effectively evaluate the cybersecurity performance of Intelligent Connected Vehicle (ICV). This paper investigates the problem of attack-defense visualization in ICV cybersecurity. For the purpose of promoting cybersecurity research capabilities, a novel Cybersecurity Attack-Defense Visualization method based on Intelligent Connected Vehicle (CADV-ICV) is proposed. In this scheme, an Attack-Defense Game model (ADG) is designed so that the logical relationship between the attack and defense can be studied through a system architecture. Then, the CADV-ICV method is implemented through three layers that are hardware layer, software layer and visualization layer. Finally, through an Intelligent Connected Vehicle, two TV monitors, a computer and a server, a real experimental environment is built to test the CADV-ICV method. The experimental results show that CADV-ICV can realize the visual display of attack-defense process, attack messages, defense state, real-time message monitoring, and attack-defense principle for 10 car’s components.

Optimal attack strategy selection of an autonomous cyber-physical micro-grid based on attack-defense game model

The security of cyber-physical systems (CPS) has become an active research area in recent years. Autonomous micro-grid, an important component of smart grid and essentially a cyber-physical system, extends the attack surface and undermines system security. This paper proposes a game-theoretic approach to describe the plausible attack-defense dynamics for autonomous micro-grid. The game is a kind of two-player, one shot, non-cooperative, and Zero-sum game, where the goal of attackers in this game is to gain the maximum payoff under a certain cost. The behavior of attackers includes two steps, intrusion and disruption, whereas the defenders can improve their defense performance by updation or reinforcement of cyber component. The optimal strategy of attackers is deduced based on the dynamic model. Finally, the case studies validate the proposed method and demonstrate its feasibility.

Malware propagation model in wireless sensor networks under attack–defense confrontation

Malware propagation model in wireless sensor networks under attack–defense confrontation

Optimal Timing Selection Approach to Moving Target Defense: A FlipIt Attack-Defense Game Model

The centralized control characteristics of software-defined networks (SDNs) make them susceptible to advanced persistent threats (APTs). Moving target defense, as an effective defense means, is constantly developing. It is difficult to effectively characterize an MTD attack and defense game with existing game models and effectively select the defense timing to balance SDN service quality and MTD decision-making benefits. From the hidden confrontation between the actual attack and defense sides, existing attack-defense scenarios are abstractly characterized and analyzed. Based on the APT attack process of the Cyber Kill Chain (CKC), a state transition model of the MTD attack surface based on the susceptible-infective-recuperative-malfunctioned (SIRM) infectious disease model is defined. An MTD attack-defense timing decision model based on the FlipIt game (FG-MTD) is constructed, which expands the static analysis in the traditional game to a dynamic continuous process. The Nash equilibrium of the proposed method is analyzed, and the optimal timing selection algorithm of the MTD is designed to provide decision support for the selection of MTD timing under moderate security. Finally, the application model is used to verify the model and method. Through numerical analysis, the timings of different types of attack-defense strategies are summarized.

CLOSURE: A cloud scientific workflow scheduling algorithm based on attack–defense game model

CLOSURE: A cloud scientific workflow scheduling algorithm based on attack–defense game model

Defensive Strategy Selection based on Attack-Defense Game Model in Network Security

Defensive Strategy Selection based on Attack-Defense Game Model in Network Security

Modeling cyber-physical attacks based on probabilistic colored Petri nets and mixed-strategy game theory

Modeling cyber-physical attacks based on probabilistic colored Petri nets and mixed-strategy game theory

Game-Theory-Based Active Defense for Intrusion Detection in Cyber-Physical Embedded Systems

Cyber-Physical Embedded Systems (CPESs) are distributed embedded systems integrated with various actuators and sensors. When it comes to the issue of CPES security, the most significant problem is the security of Embedded Sensor Networks (ESNs). With the continuous growth of ESNs, the security of transferring data from sensors to their destinations has become an important research area. Due to the limitations in power, storage, and processing capabilities, existing security mechanisms for wired or wireless networks cannot apply directly to ESNs. Meanwhile, ESNs are likely to be attacked by different kinds of attacks in industrial scenarios. Therefore, there is a need to develop new techniques or modify the current security mechanisms to overcome these problems. In this article, we focus on Intrusion Detection (ID) techniques and propose a new attack-defense game model to detect malicious nodes using a repeated game approach. As a direct consequence of the game model, attackers and defenders make different strategies to achieve optimal payoffs. Importantly, error detection and missing detection are taken into consideration in Intrusion Detection Systems (IDSs), where a game tree model is introduced to solve this problem. In addition, we analyze and prove the existence of pure Nash equilibrium and mixed Nash equilibrium. Simulations show that the proposed model can both reduce energy consumption by up to 50% compared with the existing All Monitor (AM) model and improve the detection rate by up to 10% to 15% compared with the existing Cluster Head (CH) monitor model.

Analysis Method based on Rough Attack-defense Bayes Game Model

In order to solve the strategic interdependence question during the attack and defense process in a complex network, the dissertation proposes an analysis method based on rough attack-defense Bayes game model. After defining the inner structure of attacking agent and defense agent, the dissertation extends traditional object Petri Net and introduces rough set theory into node domain and transition domain, then propose the network attack-defense confrontation model. By dividing domain attack strategy set into equivalence classes, the extraction method of characteristic attack strategy set is given. Then the rough game model and utility function of attack and defense agents are defined, accordingly, the solution of Bayes equilibrium strategy and maximal attack and defense strategy set are proposed. The analysis method can reduce the scale of strategic space of the game model, and suitable for researching on complex network attack and defense action.