Attack Resources Research Articles

Security Game with Non-additive Utilities and Multiple Attacker Resources

There has been significant interest in studying security games for modeling the interplay of attacks and defenses on various systems involving critical infrastructure, financial system security, political campaigns, and civil safeguarding. However, existing security game models typically either assume additive utility functions, or that the attacker can attack only one target. Such assumptions lead to tractable analysis, but miss key inherent dependencies that exist among different targets in current complex networks. In this paper, we generalize the classical security game models to allow for non-additive utility functions. We also allow attackers to be able to attack multiple targets. We examine such a general security game from a theoretical perspective and provide a unified view. In particular, we show that each security game is equivalent to a combinatorial optimization problem over a set system ε, which consists of defender's pure strategy space. The key technique we use is based on the transformation, projection of a polytope, and the ellipsoid method. This work settles several open questions in security game domain and extends the state-of-the-art of both the polynomial solvable and NP-hard class of the security game.

DDoS attacks on data plane of software‐defined network: are they possible?

AbstractWith software‐defined networking (SDN) becoming the leading technology for large‐scale networks, it is definitely expected that SDN will suffer various types of distributed denial‐of‐service (DDoS) attacks because of its centralized control logic. However, almost all of existing works concentrate on the controller overloading DDoS attacks, while vulnerabilities exposed by data plane of SDN for DDoS attacks are largely ignored. In this paper, we firstly investigate a flow rule flooding DDoS attack. By thoroughly analyzing the flow table size and miss rate, we find that attackers are able to inflict significant performance degradation over the system with limited volume of attack resource. We then prove that it is possible for attackers to maximize the performance degradation and minimize the attack rate at the same time. Besides the flooding DDoS attack, we also study a novel DDoS attack targeting data plane of SDN. By utilizing the entry lifetime management mechanism of flow tables, this attack almost never exhibits an intensive controller access behavior. It flies under the radar by inflicting non‐notable performance impact on the system, while it creates heavy long‐term financial burden on the target application. Finally, we present a potential countermeasure for this stealthy DDoS attack. Through extensive experiments, we conclude that DDoS attacks targeting data plane are possible. Copyright © 2016 John Wiley & Sons, Ltd.

Multiple cyber attacks against a target with observation errors and dependent outcomes: Characterization and optimization

In this paper we investigate a cybersecurity model: An attacker can launch multiple attacks against a target with a termination strategy that says that the attacker will stop after observing a number of successful attacks or when the attacker is out of attack resources. However, the attacker's observation of the attack outcomes (i.e., random variables indicating whether the target is compromised or not) has an observation error that is specified by both a false-negative and a false-positive probability. The novelty of the model we study is the accommodation of the dependence between the attack outcomes, because the dependence was assumed away in the literature. In this model, we characterize the monotonicity and bounds of the compromise probability (i.e., the probability that the target is compromised). In addition to extensively showing the impact of dependence on quantities such as compromise probability and attack cost, we give methods for finding the optimal strategy that leads to maximum compromise probability or minimum attack cost. This study highlights that the dependence between random variables cannot be assumed away, because the results will be misleading.

Vulnerability Analysis and Consequences of False Data Injection Attack on Power System State Estimation

An unobservable false data injection (FDI) attack on AC state estimation (SE) is introduced and its consequences on the physical system are studied. With a focus on understanding the physical consequences of FDI attacks, a bi-level optimization problem is introduced whose objective is to maximize the physical line flows subsequent to an FDI attack on DC SE. The maximization is subject to constraints on both attacker resources (size of attack) and attack detection (limiting load shifts) as well as those required by DC optimal power flow (OPF) following SE. The resulting attacks are tested on a more realistic non-linear system model using AC state estimation and ACOPF, and it is shown that, with an appropriately chosen sub-network, the attacker can overload transmission lines with moderate shifts of load.

Physical System Consequences of Unobservable State-and-Topology Cyber-Physical Attacks

This paper studies the physical consequences of a class of unobservable state-and-topology cyber-physical attacks in which both state and topology data for a sub-network of the network are changed by an attacker to mask a physical attack. The problem is formulated as a two-stage optimization problem, which aims to cause overload in a line of the network with limited attack resources. It is shown that unobservable state-and-topology cyber-physical attacks as studied in this paper can make the system operation more vulnerable to line outages and failures.

Defending a single object against an attacker trying to detect a subset of false targets

Deployment of false targets can be a very important and effective measure for enhancing the survivability of an object subjected to intentional attacks. Existing papers have assumed that false targets are either perfect or can be detected with a constant probability. In practice, the attacker may allocate part of its budget into intelligence actions trying to detect a subset of false targets. Analogously, the defender can allocate part of its budget into disinformation actions to prevent the false targets from being detected. In this paper, the detection probability of each false target is assumed to be a function of the intelligence and disinformation efforts allocated on the false target. The optimal resource distribution between target identification/disinformation and attack/protection efforts is studied as solutions of a non-cooperative two period min–max game between the two competitors for the case of constrained defense and attack resources.

Designing Seasonal Initial Attack Resource Deployment and Dispatch Rules Using a Two-Stage Stochastic Programming Procedure

Initial attack dispatch rules can help shorten fire suppression response times by providing easy-to-follow recommendations based on fire weather, discovery time, location, and other factors that may influence fire behavior and the appropriate response. A new procedure is combined with a stochastic programming model and tested in this study for designing initial attack dispatch rules integrated with development of seasonal suppression resource deployment decisions to support initial attack. Historical fires are spatially simulated according to historical weather and actual fire locations to provide fire samples that capture the stochastic nature of this problem. Constraints are added to a two-stage stochastic programming resource deployment and dispatch model to enforce a requirement that the same combination of initial attack resources be dispatched to all fires in any given dispatch category. A post-optimization procedure is used to check the resulting solution, potentially leading to refinements of candidate solutions before a model solution is accepted. Our test results indicate that not accounting for the use of standard response dispatch rules where they are typically implemented could lead planners to underestimate initial attack resource requirements and costs.

How to deal with an intelligent adversary

Traditionally, the design of network protection strategies is based on the answers of a protector and an adversary to the question “How?”: how should the protector allocate its protection resources, and how should the adversary allocate its attacking resources? This paper considers a more sophisticated adversary, who, planning its malicious activities, considers two questions: “What for?” and “How?”. Namely, what is the motivation for the attack? and how to attack based on the chosen motivation? To study this problem, a simple game-theoretic network protection model is considered, in which the adversary decides whether to intrude on the network to inflict maximal damage or to perform a reconnaissance mission, and based on this decision an intrusion strategy is designed. The solution to this game shows that such an adversary may try a feint to draw the protector’s efforts away from the nodes that the adversary intends to attack. Taking into account this feature of the adversary’s behavior allows improvements in the reliability of a protection strategy.

A Chance-Constrained Programming Model to Allocate Wildfire Initial Attack Resources for a Fire Season

This research developed a chance-constrained two-stage stochastic programming model to support wildfire initial attack resource acquisition and location on a planning unit for a fire season. Fire growth constraints account for the interaction between fire perimeter growth and construction to prevent overestimation of resource requirements. We used this model to examine daily resource stationing budget requirements and suppression resource types and deployments within a fire planning unit. A chance constraint ensures the conditional probability of one or more fire escapes on days with ignitions below a predefined threshold. This chance-constrained approach recognizes that funding for local resources is unlikely to be sufficient for containing all fires in initial attack. For test cases, we used 1,655 fires occurring over 935 historical fire days from the Black Hills Fire Planning Unit in South Dakota. We tested our model under a variety of fire suppression assumptions to estimate appropriate daily stationing budget levels and resource allocations.

Attack, Defence, and Contagion in Networks

Connections between individuals facilitate the exchange of goods, resources, and information and create benefits. These connections may be exploited by adversaries to spread their attacks as well. What is the optimal way to design and defend networks in the face of attacks? We develop a model with a Designer and an Adversary. The Designer moves first and chooses a network and an allocation of defence resources across nodes. The Adversary then allocates attack resources on nodes; if an attack succeeds then the Adversary decides on how successful resources should navigate the network. We obtain two principal results. One, we show that in a wide variety of circumstances a star network with all defence resources allocated to the central node is optimal for the Designer. Two, we identify conditions on the technology of conflict, network value function, and the resource configuration for which networks with multiple hubs/components are optimal.

DDoS defense system for web services in a cloud environment

Recently, a new kind of vulnerability has surfaced: application layer Denial-of-Service (DoS) attacks targeting web services. These attacks aim at consuming resources by sending Simple Object Access Protocol (SOAP) requests that contain malicious XML content. These requests cannot be detected on the network or transportation (TCP/IP) layer, as they appear as legitimate packets. Until now, there is no web service security specification that addresses this problem. Moreover, the current WS-Security standard induces crucial additional vulnerabilities threatening the availability of certain web service implementations. First, this paper introduces an attack-generating tool to test and confirm previously reported vulnerabilities. The results indicate that the attacks have a devastating impact on the web service availability, even whilst utilizing an absolute minimum of attack resources. Since these highly effective attacks can be mounted with relative ease, it is clear that defending against them is essential, looking at the growth of cloud and web services. Second, this paper proposes an intelligent, fast and adaptive system for detecting against XML and HTTP application layer attacks. The intelligent system works by extracting several features and using them to construct a model for typical requests. Finally, outlier detection can be used to detect malicious requests. Furthermore, the intelligent defense system is capable of detecting spoofing and regular flooding attacks. The system is designed to be inserted in a cloud environment where it can transparently protect the cloud broker and even cloud providers. For testing its effectiveness, the defense system was deployed to protect web services running on WSO2 with Axis2: the defacto standard for open source web service deployment. The proposed defense system demonstrates its capability to effectively filter out the malicious requests, whilst generating a minimal amount of overhead for the total response time.

Optimal spatial allocation of initial attack resources for firefighting in the republic of Korea using a scenario optimization model

This study explores the optimal spatial allocation of initial attack resources for firefighting in the Republic of Korea. To improve the effectiveness of Korean initial attack resources with a range of policy goals, we create a scenario optimization model that minimizes the expected number of fires not receiving a predefined response. In this study, the predefined response indicates the number of firefighting resources that must arrive at a fire before the fire escapes and becomes a large fire. We use spatially explicit GIS-based information on the ecology, fire behavior, and economic characterizations important in Korea. The data include historical fire events in the Republic of Korea from 1991 to 2007, suppression costs, and spatial information on forest fire extent. Interviews with forest managers inform the range of objective functions and policy goals we address in the decision model. Based on the geographic data, we conduct a sensitivity analysis by varying the parameters systematically. Information on the relative importance of the components of the settings helps us to identify “rules of thumb” for initial attack resource allocations in particular ecological and policy settings.

From the Editors

From the Editors

Localization in Wireless Sensor Networks: Byzantines and Mitigation Techniques

Wireless Sensor Networks (WSNs) are vulnerable to Byzantine attacks in which malicious sensors send falsified information to the Fusion Center (FC) with the goal of degrading inference performance. In this paper, we consider Byzantine attacks for the location estimation task in WSNs using binary quantized data. Posterior Cramer-Rao Lower Bound (PCRLB) is used to characterize the performance of the network. Two kinds of attack strategies are considered: Independent and Collaborative attacks. We determine the fraction of Byzantine attackers in the network that make the FC incapable of utilizing sensor information to estimate the target location. Optimal attacking strategies for given attacking resources are also derived. Furthermore, we propose two schemes for the mitigation of Byzantine attacks. The first scheme is based on a Byzantine Identification method under the assumption of identical local quantizers. We show with simulations that the proposed scheme identifies most of the Byzantines. In order to improve the performance, we propose a second scheme in conjunction with our identification scheme where dynamic non-identical threshold quantizers are used at the sensors. We show that it not only reduces the location estimation error but also makes the Byzantines `ineffective' in their attack strategy.

Deploying initial attack resources for wildfire suppression: spatial coordination, budget constraints, and capacity constraints

We combine a scenario-based, standard-response optimization model with stochastic simulation to improve the efficiency of resource deployment for initial attack on wildland fires in three planning units in California. The optimization model minimizes the expected number of fires that do not receive a standard response — defined as the number of resources by type that must arrive at the fire within a specified time limit — subject to budget and station capacity constraints and uncertainty about the daily number and location of fires. We use the California Fire Economics Simulator to predict the number of fires not contained within initial attack modeling limits. Compared with the current deployment, the deployment obtained with optimization shifts resources from the planning unit with highest fire load to the planning unit with the highest standard response requirements but leaves simulated containment success unchanged. This result suggests that, under the current budget and capacity constraints, a range of deployments may perform equally well in terms of fire containment. Resource deployments that result from relaxing constraints on station capacity achieve greater containment success by encouraging consolidation of resources into stations with high dispatch frequency, thus increasing the probability of resource availability on high fire count days.

Recovery and Resource Allocation Strategies to Maximize Mobile Network Survivability by Using Game Theories and Optimization Techniques

With more and more mobile device users, an increasingly important and critical issue is how to efficiently evaluate mobile network survivability. In this paper, a novel metric called Average Degree of Disconnectivity (Average DOD) is proposed, in which the concept of probability is calculated by the contest success function. The DOD metric is used to evaluate the damage degree of the network, where the larger the value of the Average DOD, the more the damage degree of the network. A multiround network attack-defense scenario as a mathematical model is used to support network operators to predict all the strategies both cyber attacker and network defender would likely take. In addition, the Average DOD would be used to evaluate the damage degree of the network. In each round, the attacker could use the attack resources to launch attacks on the nodes of the target network. Meanwhile, the network defender could reallocate its existing resources to recover compromised nodes and allocate defense resources to protect the survival nodes of the network. In the approach to solving this problem, the “gradient method” and “game theory” are adopted to find the optimal resource allocation strategies for both the cyber attacker and mobile network defender.

Defending majority voting systems against a strategic attacker

Voting systems used in technical and tactical decision making in pattern recognition and target detection, data handling, signal processing, distributed and secure computing etc. are considered. A maxmin two period game is analyzed where the defender first protects and chooses units for participation in voting. The attacker thereafter attacks a subset of units. It is shown that when the defender protects all the voting units, the optimal number of units chosen for voting is either one or the maximal possible odd number. When the defender protects only the units chosen for voting, the optimal number of chosen units increases with the defender resource superiority (i.e., more resources than the attacker) and with probability of providing correct output by any unit. The system success probability always increases in the total number of voting units, the defender–attacker resource ratio, and the probability that each voting unit produces a correct output. The system success probability increases in the attacker–defender contest intensity if the defender achieves per-unit resource superiority, and otherwise decreases in the contest intensity. The presented model and enumerative algorithm allow obtaining optimal voting system defense strategy for any combination of parameters: total number of units, attack and defense resources, unit success probability and contest intensity.

Revisiting the Security of the ALRED Design and Two of Its Variants: Marvin and LetterSoup

The Alred construction is a lightweight strategy for constructing message authentication algorithms from an underlying iterated block cipher. Even though this construction's original analyses show that it is secure against some attacks, the absence of formal security proofs in a strong security model still brings uncertainty on its robustness. In this paper, aiming to give a better understanding of the security level provided by different authentication algorithms based on this design strategy, we formally analyze two Alred variants—the Marvin message authentication code and the LetterSoup authenticated-encryption scheme,—bounding their security as a function of the attacker's resources and of the underlying cipher's characteristics.

Optimal alloc ation of initial attack resources to multiple wildfire events

Increased scrutiny of federally funded programs combined with changes in fire management reflects a demand for new fire program analysis tools. We formulated an integer linear programming (ILP) model for initial attack resource allocation that operates in a performance-based, cost-effectiveness analysis (CEA) environment. The model optimizes the deployment of initial attack resources for a user-defined set of fires that a manager would like to be prepared for across alternative budget levels. The model also incorporates fire spread, multiple ignitions, simultaneous ignitions, and monitoring of resources on a landscape. It also evaluates the cost effectiveness of alternate firefighting resources and alternative pre-positioning locations. Fires that escape initial attack are costly during the extended attack phase of fire management. To address this within the scope of initial attack, we constructed and analyzed alternative objective functions that incorporate a proxy for internalizing the cost of fires that escape initial attack. This type of model can provide the basis for a wider scale formulation with the potential to measure an organization's performance and promote a higher level of accountability and efficiency in fire programs. Keywords fire escape, initial attack, integer linear programming, optimal deployment, performance, wildland fire Language: en

Defending Against a Terrorist Who Accumulates Resources

I n this paper we study a two-period game between a government and a terrorist, where the terrorist decides whether to stockpile attack resources from the first to the second period. Our results show that the terrorist chooses stockpiling when: (a) the following parameters are in intermediate ranges: the government’s asset valuation, the terrorist’s first-period resource, the government’s unit defense cost, and the terrorist’s unit attack cost; (b) the terrorist’s secondperiod resource is small; and (c) the terrorist’s resource growth factor or discount factor is large. We also compare our model with the one that does not allow terrorist stockpiling. For moderate growth factors and secondperiod resources for the terrorist, the terrorist does not prefer the option of stockpiling. The terrorist prefers stockpiling for the more uncommon case that the growth factor for the terrorist’s stockpiled resource is very large and the second-period resource is very small. In contrast, the government always prefers that the terrorist has the stockpiling option.