Attack-defense Game Research Articles

Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack–Defense Game

This paper presents a novel multi-dimensional asymmetric game model for network attack–defense decision-making, called “Catch the Cyber Thief”. The model is built upon the concept of partially observable stochastic games (POSG) and is designed to systematically incorporate multi-dimensional asymmetry into network attack–defense problems. The attack agent is called a “thief” who wants to control a key host by exploring the unfamiliar network environment, and the defense agent is called a “police” who needs to catch the opponent before its goal is accomplished. The results indicate that the asymmetry of network attack and defense is not only influenced by attack and defense strategies but also by spatio-temporal factors such as the attacker’s initial position, network topology, and defense lag time. In addition, we have found that there may exist the “attack rhythm,” which makes “how to maintain a good attack rhythm” and “how to generate a robust defense strategy against different attackers” worth exploring. Compared with existing attack–defense game models, our game model can better generate a direct mapping relationship with real elements, enabling us to understand network attack and defense interactions better, recognize security risks, and design defense strategies that can directly serve real-world decision-making.

Stochastic Evolutionary Analysis of an Aerial Attack–Defense Game in Uncertain Environments

Aiming at the problem of random environment interference in the process of strategy interaction and the behavioral evolution of an aerial attack–defense game, this paper considers the influence of the difference in the performance and value between both game players in terms of strategy evolution; explores the randomness of the complex battlefield environment, the uncertainty of the behavioral state of game players, and the limitations of the emergent situation; constructs a mathematical model of the stochastic evolution of an aerial-coordinated attack–defense game in uncertain environments; and studies the stability of the strategy interaction and behavioral decision-making process of both players of the aerial attack–defense game. Simulation results show that many factors of the performance and value between both game players have a greater impact on the strategy evolution trend in both game players, which not only causes changes in the results of the strategy selection but also affects the rate of strategy evolution for the game players. In addition, random environmental factors cause a certain degree of interference to the strategy evolution process of the game players, which usually accelerates the game players’ strategy evolution rate and greatly affects the evolution process of the game players’ strategy. This study can provide a theoretical basis and feasible reference for improving mission decision-making, response mechanisms, and system modeling of an aerial attack–defense game, which has important theoretical value and practical significance.

Defense strategy selection based on incomplete information game for the false data injection attack

With the rapid development and wide application of sensing devices and communication networks, the traditional power system has transformed into a cyber physical power system (CPPS) gradually. The constant interaction of information flow and power flow exposes the grid to potential cyber-attack risks. In this paper, the defense strategy selection approaches are proposed based on incomplete information game against false data injection attack (FDIA) in different scenarios. Firstly, the attack-defense tree model containing economic indicators and a measure of attack is established, and the expected revenues of both attacker and defender are calculated in detail. Secondly, the static Bayesian attack-defense game model in which the defender grasps incomplete information is constructed, considering two cases of low-tech attacker and high-tech attacker. Then, the zero-sum attack-defense game model in which the attacker masters incomplete information is structured, considering the changing attack space. Finally, the simulations are carried out on the IEEE 30-bus system, and the optimal defense strategies in the case of two incomplete information are obtained by solving the equilibrium point. The simulation results demonstrate that the proposed method is effective in cyber security defense system, and can provide guiding ideology and theoretical basis for operators to deploy defense measures.

Markov game based on reinforcement learning solution against cyber–physical attacks in smart grid

The rapid expansion of information networks has amplified vulnerabilities in cyberspace, particularly within the power grid and communication layers of smart grid systems. Safeguarding smart grid security has become imperative for users concerned about both online and offline privacy. Detecting attacks in smart grids is crucial for ensuring the safety and continuity of the electrical network. This paper introduces a novel stealth attack-defense game that examines the impact of these invasions on the availability, confidentiality, and integrity of phasor measurement units. The proposed system considers both attack and defense perspectives. Attackers focus on key parameters to covertly infiltrate system layers while defending the smart grid system requires advanced knowledge of data flow and critical insights to establish robust protections. To address this cybersecurity challenge, we propose a game approach based on a partially observed Markov game with an improved Shapley Q-value and a multi-agent reinforcement learning framework, implemented in cooperative, communicative, and dynamic environments. The evaluation results demonstrate the robustness of the proposed approach against coordinated attacks in smart grid environments. Additionally, the results emphasize the significance of attack distribution as a crucial trace for identifying the attack source. Our approach shows promise for addressing various types of attacks against smart grid systems.

Control modeling and optimization of network information security system based on deep learning data interaction

In order to solve the problem of poor network security protection performance of traditional network information security protection systems, the author proposes a network information security system control modeling based on deep learning data interaction. Adopt CY8C2453 type processor to improve system data exchange and data processing speed, enhance system stability through peripheral backplane, and evaluate network information security, at the same time, the authority management mechanism is set, and the general strategy form of the network attack and defense game is defined as a triple, calculate the attacked path in a certain network area and the defense strategy that the defender should choose, so as to complete the network information security protection based on the attack-defense game model. Experimental results show that: The number of attacked information of the system is 58 less than that of the traditional system; In the webpage attack, the number of attacked information of the designed system is 82 less than that of the traditional system; In the data interception attack, the number of attacked information of the designed system is 77 less than that of the traditional system. ConclusionUnder different attack behaviors, the number of successful attacks on the network information security protection system based on the attack-defense game model designed this time is less than the number of successful attacks on the traditional system, which improves the security of network information.

A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning

Faced with the challenges of security strategy design brought about by the complexity of attack behavior and the dynamism of network structure, dynamic hierarchical intelligent defense methods have shown their effectiveness. However, in complex network environments, their application requires a higher level of coordination mechanisms. Therefore, this paper proposes a hierarchical multi-agent reinforcement learning network attack and defense game and cooperative defense decision-making method, which autonomously and efficiently completes the formulation of defense strategies and defense behavior responses. Firstly, we construct a Stackelberg hypergame model of cyberspace conflicts, and under the condition of information loss, characterize the multi-layer dynamic defense coordination response mechanism. Secondly, By utilizing a hierarchical multi-agent reinforcement learning method as the driving force for game evolution, we sequentially solve the Nash equilibrium of the game, and form a dynamic autonomous defense strategy. Finally, we construct a hierarchical multi-agent reinforcement learning framework, which decouples the defense decision problem, reduces the dimension of the defense action space and the exploration difficulty of the strategy space, and learns coordinated defense strategies more efficiently. We used the CybORG (Cyber Operations Research Gym) environment for simulation. We compared and analyzed the autonomously generated cyber defense strategies with other related works, verifying the superior coordination performance of our method in defense strategy generation and control.

Attack–Defense Confrontation Analysis and Optimal Defense Strategy Selection Using Hybrid Game Theoretic Methods

False data injection attacks are executed in the electricity markets of smart grid systems for financial benefits. The attackers can maximize their profits through modifying the estimated transmission power and changing the prices of market electricity. As a response, defenders need to minimize expected load losses and generator trips through load and power generation adjustments. The selection of strategies of the attacking and defending sides turns out to be a symmetric game process. This article proposes a hybrid game theory method for analyzing the attack–defense confrontation: firstly, a micro-grid-based power market model considering false data injection attacks is established using the Nash equilibrium method; secondly, the attack–defense game function is constructed and solved via the Stackelberg equilibrium algorithm. The Markov game algorithm and distributed learning algorithm are used to update equilibrium function; finally, a dynamic game behavior model of the two players is constructed through simulating the attack–defense probability. The evolutionary game method is used to select the optimal defense strategy for dynamic probability changes. Modified IEEE standard bus systems are illustrated to certify the effectiveness of the proposed model.

Security-Oriented Cyber-Physical Risk Assessment for Cyberattacks on Distribution System

With the increasing deployment of advanced sensing and measurement devices, the modern distribution system is evolved into a cyber-physical power distribution system (CPPDS). Due to the extensive application of information and communication technology, CPPDS is prevalently exposed to a wide range of cybersecurity threats. In this paper, a novel security-oriented cyber-physical risk assessment method for CPPDS is proposed. Based on the information model composed of logical nodes, an attack graph of privilege promotion by exploiting the cyber vulnerabilities is constructed. The physical consequence caused by cyberattack is analyzed in detail. By using the Markov decision process (MDP) theory, the cyber-physical risk index (CPRI) is calculated. Furthermore, considering the allocation of the finite defense resource, the modified MDP approach with an attack–defense game is presented. The effectiveness of the proposed method is demonstrated with case studies on a four-feeder IEEE-RTBS test system.

Attack–Defense Game in Interdependent Networks: A Functional Perspective

Attack–Defense Game in Interdependent Networks: A Functional Perspective

Security risk assessment of projects in high-risk areas based on attack-defense game model

Assessing the security risk of projects in high-risk areas is particularly important. This paper develops a security risk assessment model for projects in high-risk areas based on the target loss probability model and Bayesian game model. This model is modeled from the perspective of attack-defense confrontation and addresses the issue that traditional risk assessment focuses on the analysis of the attacker yet neglects to analyze the defender—the defender’s optimum defensive information is not quantitatively determined. The risk level, optimum defensive resource value, and optimum defensive strategy of the project are determined through the analysis of a project in the high-risk area. This enables the project’s risk manager to adjust the defensive resources reasonably and optimally, confirming the objectivity and feasibility of the model and offering a new benchmark for security risk assessment, which has significant practical implications.

A method for analyzing Stackelberg attack–defense game model in 5G by tCPSO

The development of 5G brings convenience to people, but it also brings threats. It is particularly important to analyze attack–defense confrontation from a macro perspective. Network security of graph is an important research problem in current network environment. A Stackelberg game model based on 5G network graph is established to analyze the attack–defense confrontation in this paper. In order to solve the Nash equilibrium, a compact particle swarm optimization based on t-Location-Scale distribution (tCPSO) is proposed. The tCPSO uses less memory space and has better optimization performance. The experiments prove that tCPSO has better optimization performance than other heuristic algorithms on CEC2013. The clustering experiments further show that tCPSO has better optimization ability than other heuristic algorithms. The optimal defense strategies under different attack–defense resources are analyzed in this paper. It is concluded that increasing the successful defense rate is more effective for the defender to obtain greater profit than reducing the successful attack rate. Using intelligent computing to solve Nash equilibrium is a new idea for researchers to analyze attack–defense confrontation.

Attack-Defense Game Model with Multi-Type Attackers Considering Information Dilemma.

Today, people rely heavily on infrastructure networks. Attacks on infrastructure networks can lead to significant property damage and production stagnation. The game theory provides a suitable theoretical framework for solving the problem of infrastructure protection. Existing models consider only the beneficial effects that the defender obtains from information gaps. If the attacker's countermeasures are ignored, the defender will become passive. Herein, we consider that a proficient attacker with a probability in the game can fill information gaps in the network. First, we introduce the link-hiding rule and the information dilemma. Second, based on the Bayesian static game model, we establish an attack-defense game model with multiple types of attackers. In the game model, we consider resource-consistent and different types of distributions of the attacker. Then, we introduce the solution method of our model by combining the Harsanyi transformation and the bi-matrix game. Finally, we conduct experiments using a scale-free network. The result shows that the defender can be benefited by hiding some links when facing a normal attacker or by estimating the distribution of the attacker correctly. The defender will experience a loss if it ignores the proficient attacker or misestimates the distribution.

Attack-Defense game analysis of critical infrastructure network based on Cournot model with fixed operating nodes

In recent years, some game models were proposed to protect critical infrastructure networks. But they mainly focused on the protection of key nodes, and there are rarely models to consider the fixed-point use of resources. Hence, in this paper, we propose a non-zero-sum simultaneous game model based on the Cournot model. Meanwhile, we presented a novel method of critical node centrality identification based on the Technique for Order Preference by Similarity to Ideal Solution (TOPSIS). Simulating the game analysis on scale-free networks, small-world networks and random networks, it is found that the fixed operating nodes and the network topology are key factors in payoffs considering the constraints of resources. Besides, robustness analysis of networks on various sensitivity parameters is given and some effective optimal strategies are acquired to provide decision support for policy-makers.

Mixed Strategy Analysis in Attack-Defense Game Model Based on 5G Heterogeneous Network of CPS Using ncPSO

The development of the 5th Generation Mobile Communication Technology not only brings convenience to people but also brings many network security problems. Based on the static game theory of complete information, a game model of attack and defense with limited resources in heterogeneous networks of Cyber Physical Systems is established. This model analyzes the basic rules of the offensive and defensive strategies of both parties when the offensive and defensive resources are limited in the 5th Generation Mobile Communication Technology network environment. The model can also describe the interaction between attackers and defenders. A novel compact particle swarm optimization algorithm is proposed to solve the difficult problem of solving the Nash equilibrium of this game model. The simulation experiment proves that novel compact particle swarm optimization algorithm has good optimization ability and shows that the algorithm can effectively solve the Nash equilibrium of the model. The simulation experiment provides a strategic reference for the attack-defense game with limited resources.

An attack-defense game model in infrastructure networks under link hiding.

Our increasing dependence on infrastructure networks leads to growing concerns over the protection of these networks. Many methods have been proposed to select protective strategies by combining complex network theory and game theory. However, the misleading effect of hidden links is not considered in previous methods. This work creates an information gap between attackers and defenders by partly hiding network links to mislead the attacker in the game. We first introduce the rule of link hiding that depends on the nodes' property, where the number of hidden links has a maximum value. Additionally, based on the Stackelberg game model, we establish an attack-defense game model with link hiding strategies considering node property and cost constraints. Finally, we conduct experiments in a scale-free network and an existing power grid. The experimental results show that the defender tends to combine first-mover advantage and link hiding to get a better payoff under more different costs of the nodes. Hiding half of the links in the existing power grid can effectively reduce network damage by about 22.8% on average, with the two sides investing the same resources. The effect of link hiding could be more obvious when the attacker owns more resources than the defender. When an attacker employs the high-degree attacking strategy, the proposed link hiding method can help the defender reduce the damage to the network by 12.2% compared to the link reconnecting method.

OD1NF1ST: True Skip Intrusion Detection and Avionics Network Cyber-attack Simulation

MIL-STD-1553 is a communication bus that has been used by many military avionics platforms, such as the F-15 and F-35 fighter jets, for almost 50 years. Recently, it has become clear that the lack of security on MIL-STD-1553 and the requirement for internet communication between planes has revealed numerous potential attack vectors for malicious parties. Prevention of these attacks by modernizing the MIL-STD-1553 is not practical due to the military applications and existing far-reaching installations of the bus. We present a software system that can simulate bus transmissions to create easy, replicable, and large datasets of MIL-STD-1553 communications. We also propose an intrusion detection system (IDS) that can identify anomalies and the precise type of attack using recurrent neural networks with a reinforcement learning true-skip data selection algorithm. Our IDS outperforms existing algorithms designed for MIL-STD-1553 in binary anomaly detection tasks while also performing attack classification and minimizing computational resource cost. Our simulator can generate more data with higher fidelity than existing methods and integrate attack scenarios with greater detail. Furthermore, the simulator and IDS can be combined to form a web-based attack-defense game.

Differential Game Approach for Attack-Defense Strategy Analysis in Internet of Things Networks

Internet of Things (IoT) is vulnerable to various cyber attacks due to the massive deployment of IoT devices and the openness of wireless environments. In this article, taking IoT devices as the network resources competed between an attacker and a defender, we study the modeling and analysis of network resource competition in an attack-defense game. The attacker and defender inject different competition strength in each IoT device as their strategies. As a result, the security state of each IoT device will change, which is captured by differential equations. To study the interaction between the attacker and defender and the evolution of the system security states, a zero-sum differential game is formulated by modeling the competition of IoT devices. To achieve the equilibrium of the formulated differential game, optimal control theory is employed to solve the optimization problems of players. Further, a Gauss–Seidel-like implicit finite-difference method is utilized to obtain the saddle point strategy. Finally, numerical results are provided to demonstrate the evolution of network resource competition between the attacker and defender. The results show that our formulated model can effectively and accurately characterize the evolution of the system security states with strategic interactions between the attacker and defender.

Cyber-Physical Coordinated Risk Mitigation in Smart Grids Based on Attack-Defense Game

Since modern smart grids have various and deeply coupled cyber-physical components, they are vulnerable to malicious cyber attacks. Although regular defenses including firewall and IDS are deployed, they may be weakened by zero-day vulnerabilities and sophisticated attack schemes. Therefore, defense strategies to mitigate the risk of blackouts during cyber attacks are necessary. This paper proposes a cyber-physical coordinated defense strategy to overcome the disruption and minimize the risk as much as possible. At the cyber layer, a zero-sum multilevel Markovian Stackelberg game is proposed to model sequential actions of the attacker and the defender. The defender distributes defensive resources to protect lines in a real-time manner, according to the attacker's action. If cyber attacks should result in physical outages, defense at the physical layer is then employed. A security-constrained optimal power flow reserving security margin of critical components will be performed to minimize the blackout scale and potential future risk. To solve the corresponding optimization problem and further get the optimal defense strategy, this paper devises a novel “water-pouring” algorithm. Lastly, test results show that the proposed dynamic defense strategy mitigates risk significantly and outperforms existing methods.

A Defense Strategy Selection Method Based on the Cyberspace Wargame Model

Network defenders always face the problem of how to use limited resources to make the most reasonable decision. The network attack-defense game model is an effective means to solve this problem. However, existing network attack-defense game models usually assume that defenders will no longer change defense strategies after deploying them. However, in an advanced network attack-defense confrontation, defenders usually redeploy defense strategies for different attack situations. Therefore, the existing network attack-defense game models are challenging to accurately describe the advanced network attack-defense process. To address the above challenges, this paper proposes a defense strategy selection method based on the network attack-defense wargame model. We model the advanced network attack-defense confrontation process as a turn-based wargame in which both attackers and defenders can continuously adjust their strategies in response to the attack-defense posture and use the Monte Carlo tree search method to solve the optimal defense strategy. Finally, a network example is used to illustrate the effectiveness of the model and method in selecting the optimal defense strategy.

Industrial Control System Defense Decision-Making Method Based on Dynamic Attack-Defense Game

Industrial control systems are different from traditional information systems and require extremely high system availability. In the face of potential attack incidents, blind defense deployment may affect system performance and efficiency, which is counterproductive. For this reason, this paper proposes a defense decision-making method for industrial control systems based on dynamic attack-defense games. This method first analyzes the actual attack-defense confrontation scenarios in the industrial control system, and constructs a dynamic attack-defense game model based on this. After that, an industrial control system attack-defense game tree defined on this model is constructed, and the game tree is used to describe the specific attack-defense confrontation process. Then the backward induction method is used in the game tree to find the equilibrium path. The information on this path is of great reference value for defenders to choose a reasonable and efficient defense plan, maintain system stability and reduce defense costs. At the end of this paper, this method is applied to a real limestone powder preparation system for experiments. The experimental results verify the effectiveness of the method in actual scenarios.