Optimal Defense Strategy Research Articles

Mitigating adversarial cascades in large graph environments

A significant amount of society’s infrastructure can be modeled using graph structures, from electric and communication grids, to traffic networks, to social networks. Each of these domains are also susceptible to unwanted cascades, whether this be overloaded devices in the power grid or the reach of a social media post containing misinformation. The potential harm of a cascade is compounded when considering a malicious attack by an adversary that is intended to maximize the cascade impact. However, by exploiting knowledge of the cascading dynamics, targets with the largest cascading impact can be preemptively prioritized for defense, and the damage an adversary can inflict can be mitigated. While game theory provides tools for finding an optimal preemptive defense strategy, existing methods struggle to scale to the context of large graph environments because of the combinatorial explosion of possible actions with the size of the graph. Data-driven deep learning approaches can fill this gap, but they demand a large amount of data that is often costly to obtain. We propose a novel data generation approach for the cascading failure security problem that uses counterfactual data augmentation and a sub-game data querying strategy to generate both high quality and a high quantity of training data. We demonstrate that our data generation approach creates up to an order of magnitude more data than naïve querying with double the efficiency. We also introduce a deep learning model based embedding node pairs, and train it on our generated data, showing that it effectively defends from cascades on graphs as large as 1000 nodes. Our deep learning approach achieves a closer approximation to the Nash Equilibrium than existing heuristic methods, for graphs where the ground-truth equilibrium can be calculated.

NIGA: A Novel Method for Investigating the Attacker–Defender Model within Critical Infrastructure Networks

The field of infrastructure security has garnered significant research attention. By integrating complex network theory with game theory, researchers have proposed many methods for studying the interactions between the attacker and the defender from a macroscopic viewpoint. We constructed a game model of infrastructure networks to analyze attacker-defender confrontations. To address the challenge of finding the Nash equilibrium, we developed a novel algorithm—node-incremental greedy algorithm (NIGA)—which uses less strategy space to solve the problem. The experiments performed further showed that NIGA has better optimization ability than other traditional algorithms. The optimal defense strategies under different conditions of initial strategy ratios and attacker-defender resources were analyzed in this study. Using intelligent computing to solve the Nash equilibrium is a new approach by which for researchers to analyze attacker-defender confrontations.

Defense strategy selection based on incomplete information game for the false data injection attack

With the rapid development and wide application of sensing devices and communication networks, the traditional power system has transformed into a cyber physical power system (CPPS) gradually. The constant interaction of information flow and power flow exposes the grid to potential cyber-attack risks. In this paper, the defense strategy selection approaches are proposed based on incomplete information game against false data injection attack (FDIA) in different scenarios. Firstly, the attack-defense tree model containing economic indicators and a measure of attack is established, and the expected revenues of both attacker and defender are calculated in detail. Secondly, the static Bayesian attack-defense game model in which the defender grasps incomplete information is constructed, considering two cases of low-tech attacker and high-tech attacker. Then, the zero-sum attack-defense game model in which the attacker masters incomplete information is structured, considering the changing attack space. Finally, the simulations are carried out on the IEEE 30-bus system, and the optimal defense strategies in the case of two incomplete information are obtained by solving the equilibrium point. The simulation results demonstrate that the proposed method is effective in cyber security defense system, and can provide guiding ideology and theoretical basis for operators to deploy defense measures.

PPSO and Bayesian game for intrusion detection in WSN from a macro perspective

The security of wireless sensor networks is a hot topic in current research. Game theory can provide the optimal selection strategy for attackers and defenders in the attack-defense confrontation. Aiming at the problem of poor generality of previous game models, we propose a generalized Bayesian game model to analyze the intrusion detection of nodes in wireless sensor networks. Because it is difficult to solve the Nash equilibrium of the Bayesian game by the traditional method, a parallel particle swarm optimization is proposed to solve the Nash equilibrium of the Bayesian game and analyze the optimal action of the defender. The simulation results show the superiority of the parallel particle swarm optimization compared with other heuristic algorithms. This algorithm is proved to be effective in finding optimal defense strategy. The influence of the detection rate and false alarm rate of nodes on the profit of defender is analyzed by simulation experiments. Simulation experiments show that the profit of defender decreases as false alarm rate increases and decreases as detection rate decreases. Using heuristic algorithm to solve Nash equilibrium of Bayesian game provides a new method for the research of attack-defense confrontation. Predicting the actions of attacker and defender through the game model can provide ideas for the defender to take active defense.

Construction of Power System Network Security Defense Behavior Decision-making Model based on Artificial Intelligence Technology

According to the needs of power grid monitoring architecture and information security cooperation protection, this project builds a multi-level, deeply distributed active security cooperation defense mode. A complete implementation method is proposed from the perspective of model architecture and function mechanism. The optimal defense strategy based on grey correlation is studied according to the characteristics of cooperation between regions. In this way, the coordination between the equipment is realized to achieve multi-level protection from the host layer to the security equipment layer and then to the network layer. Multiple detection mechanisms are used to realize the comprehensive detection and integrated judgment of abnormal documents in the cloud environment. This provides maximum protection for cloud users. Experiments show that this method can effectively suppress the malicious attacks of malicious users and reduce the damage caused by viruses. In this way, both the cloud and the customer are protected.

An extensive study of security games with strategic informants

Over the past years, game-theoretic modeling for security and public safety issues (also known as security games) have attracted intensive research attention and have been successfully deployed in many real-world applications for fighting, e.g., illegal poaching, fishing and urban crimes. However, few existing works consider how information from local communities would affect the structure of these games. In this paper, we systematically investigate how a new type of players – strategic informants who are from local communities and may observe and report upcoming attacks – affects the classic defender-attacker security interactions. Characterized by a private type, each informant has a utility structure that drives their strategic behaviors.For situations with a single informant, we capture the problem as a 3-player extensive-form game and develop a novel solution concept, Strong Stackelberg-perfect Bayesian equilibrium, for the game. To find an optimal defender strategy, we establish that though the informant can have infinitely many types in general, there always exists an optimal defense plan using only a linear number of patrol strategies; this succinct characterization then enables us to efficiently solve the game via linear programming. For situations with multiple informants, we show that there is also an optimal defense plan with only a linear number of patrol strategies that admits a simple structure based on plurality voting among multiple informants.Finally, we conduct extensive experiments to study the effect of the strategic informants and demonstrate the efficiency of our algorithm. Our experiments show that the existence of such informants significantly increases the defender's utility. Even though the informants exhibit strategic behaviors, the information they supply holds great value as defensive resources. Compared to existing works, our study leads to a deeper understanding on the role of informants in such defender-attacker interactions.

A generic approach for network defense strategies generation based on evolutionary game theory

The generation of optimal defense strategies in dynamic adversarial environments is crucial for cybersecurity. Recently, defense approaches based on evolutionary game theory have gained significant achievements. However, they would fail when facing complex networks and sophisticated attack strategies, due to the fatal drawbacks of defense strategy generation considering atomic attacks only. To relieve this issue, a generic approach for generating defense strategies using evolutionary game theory is proposed in this paper. Initially, a novel payoff quantification method for network attack-defense games based on attack graphs is designed. Innovatively, two factors concerning the decision-maker's degree of irrationality (DI) and the level of environmental security (LES) are introduced into the replicator dynamics equation to model the impacts on equilibrium solutions. Noting that Active Directory (AD) domain service is one of the most used and representative information security management system in Windows domains, from which attack graphs and paths can be plainly extracted and analyzed. Therefore, it is necessary and imperative to anchor AD to unfold the theoretical analyses and experiments validation based on a real environment. Case studies on a real-world AD network demonstrate that the proposed approach is effective and can generate stable and efficient defense strategies.

Mean-Field Stackelberg Game-Based Security Defense and Resource Optimization in Edge Computing

Edge computing brings computation and storage resources to the edge of the mobile network to solve the problems of low latency and high real-time demand. However, edge computing is more vulnerable to malicious attacks due to its open and dynamic environments. In this article, we investigate security defense strategies in edge computing systems, focusing on scenarios with one attacker and multiple defenders to determine optimal defense strategies with minimal resource allocation. Firstly, we formulate the interactions between the defenders and the attackers as the mean-field Stackelberg game model, where the state and the objective functions of the defenders are coupled through the mean-field term, and are strongly influenced by the strategy of the attacker. Then, we analyze the local optimal strategies of the defenders given an arbitrary strategy of the attackers. We demonstrate the Nash equilibrium and the mean-field equilibrium for both the defenders and the attackers. Finally, simulation analysis will illustrate the dynamic evolution of the defense strategy of the defenders and the trajectory of the attackers based on the proposed Stackelberg game model.

Generation of security system defense strategies based on evolutionary game theory

The physical protection systems of Nuclear Power Plant are utilized to safeguard targets against intrude by attacker. As the methods employed by attackers to intrude Nuclear Power Plant become increasingly complex and diverse, there is an urgent need to identify optimal defense strategies to interrupt adversary intrusions. This paper focuses on studying the defense of security personnel against adversary intrusions and utilizes an evolutionary game approach to select the optimal defense decisions for physical protection systems. Under the assumption of bounded rationality for both the attacker and defender, the paper constructs replication dynamic equations for attack and defense strategies, investigating the process of strategy selection and the stability of evolution. Finally, a minimal model is proposed to validate the feasibility of utilizing the evolutionary game model for defense strategy selection.

A Game-Theoretical Self-Adaptation Framework for Securing Software-Intensive Systems

Security attacks present unique challenges to the design of self-adaptation mechanism for software-intensive systems due to the adversarial nature of the environment. Game-theoretical approaches have been explored in security to model malicious behaviors and design reliable defense for the system in a mathematically grounded manner. However, modeling the system as a single player, as done in prior works, is insufficient for the system under partial compromise and for the design of fine-grained defensive policies where the rest of the system with autonomy can cooperate to mitigate the impact of attacks. To address such issues, we propose a new self-adaptation framework incorporating Bayesian game theory and model the defender (i.e., the system) at the granularity of components. Under security attacks, the architecture model of the system is automatically translated, by the proposed translation process with designed algorithms, into a multi-player Bayesian game. This representation allows each component to be modelled as an independent player, while security attacks are encoded as variant types for the components. By solving for pure equilibrium (i.e., adaptation response), the system’s optimal defensive strategy is dynamically computed, enhancing system resilience against security attacks by maximizing system utility. We validate the effectiveness of our framework through two sets of experiments using generic benchmark tasks tailored for the security domain. Additionally, we exemplify the practical application of our approach through a real-world implementation in the Secure Water Treatment System to demonstrates the applicability and potency in mitigating security risks.

Which Link Matters? Maintaining Connectivity of Uncertain Networks Under Adversarial Attack

This paper studies connectivity maintenance in uncertain networks under adversarial attack, where a defender conceals crucial links to prevent the largest connected component from being decomposed by an attacker. In contrast with its static counterpart, connectivity maintenance in uncertain networks involves additional probing on links to determine their existence. Therefore, by modeling an uncertain network as a random graph with each link associated with an existence probability and a probing cost, our goal is to design a defensive strategy for link selection that maximizes the expected size of the largest remaining connected component with the minimum expected probing cost, and moreover, the strategy should be independent of the attacking patterns. To this end, we first unravel the computational complexity of the problem by proving its NP-hardness, and then propose optimal defensive strategies based on dynamic programming and multi-objective optimization. Due to the prohibitive computational cost of optimality, two approximate defensive strategies are further designed to pursue decent performance with quasilinear complexity, in which the first one is a heuristic approach that quantifies the link vulnerability through an analogy from the degree centrality of a vertex in static networks to the connectivity weight of a link in uncertain networks, and the second one is an adaptive greedy policy incorporating the minimax rule from game theory, which minimizes the possible loss suffered by the defender in a worst-case scenario and has a constant approximation ratio. Extensive experiments on both synthetic and real-world network datasets under diverse attacking patterns demonstrate the superiority of the proposed strategies over baselines.

MTTEGDM: A Moving Target Evolutionary Game Defense Model Based on Three-Way Decisions

Aiming at the fact that the moving target defense game model fails to accurately portray attack and defense gains, resulting in bias in attack and defense games and the inability to select effective defense strategies, we construct the moving target three-way evolutionary game defense model (MTTEGDM). Firstly, the model is defined and analyzed theoretically under the premise of uncertainty and irrationality. Then, combined with the three-way decisions, the attack intention is introduced into the target network loss calculation, and a dynamic weight adjustment algorithm based on the three-way decisions is proposed to accurately characterize the attack and defense gains from a multi-attribute perspective. Finally, the evolutionary game model is used to analyze the evolution trend of the multi-stage defense strategy, so as to carry out feasible and effective defense behavior. The simulation results show that the model can accurately predict the optimal defense strategy of moving targets in different stages. Through a Monte Carlo simulation experiment, the proposed algorithm is compared with the traditional evolutionary game model, and the effectiveness and security of the proposed algorithm are verified.

Attack–Defense Confrontation Analysis and Optimal Defense Strategy Selection Using Hybrid Game Theoretic Methods

False data injection attacks are executed in the electricity markets of smart grid systems for financial benefits. The attackers can maximize their profits through modifying the estimated transmission power and changing the prices of market electricity. As a response, defenders need to minimize expected load losses and generator trips through load and power generation adjustments. The selection of strategies of the attacking and defending sides turns out to be a symmetric game process. This article proposes a hybrid game theory method for analyzing the attack–defense confrontation: firstly, a micro-grid-based power market model considering false data injection attacks is established using the Nash equilibrium method; secondly, the attack–defense game function is constructed and solved via the Stackelberg equilibrium algorithm. The Markov game algorithm and distributed learning algorithm are used to update equilibrium function; finally, a dynamic game behavior model of the two players is constructed through simulating the attack–defense probability. The evolutionary game method is used to select the optimal defense strategy for dynamic probability changes. Modified IEEE standard bus systems are illustrated to certify the effectiveness of the proposed model.

Optimal defense strategies against intelligent cyber attacks

We propose a comprehensive game-theoretic model pertaining to the security of computer networks, specifically addressing the interaction between defenders and attackers. The model incorporates attack graphs to outline potential attacker strategies and defender responses. To account for the attacker's capacity to execute multiple attempts, we introduce a probabilistic element, wherein the success or failure at any arc of the attack graph is treated as stochastic. This characterization gives rise to a multi-stage stochastic network-interdiction problem. In this problem formulation, the defender strategically interdicts a set of arcs in anticipation of the likely actions of the attacker, who, in turn, can make multiple attempts to traverse the network. We mathematically articulate this scenario as a stochastic bilevel mixed-integer program with a "min-max" objective. The defender's aim is to minimize the probability of the attacker's success, while the attacker seeks to maximize the probability of successfully traversing the network across multiple attempts. The defender's stochastic bilevel optimization model is solved using the integer L-shaped method. Upon analyzing the defender's perspective, we observe the anticipated trend that the overall success probability of the attacker diminishes with an increasing level of defense. Notably, in the sensitivity analysis involving relatively small attack graphs, we discover that the optimal defense strategy against a myopic attacker often aligns with that against a non-myopic attacker. Furthermore, in instances where deviations exist, the disparity in performance is generally marginal. However, our findings demonstrate a potential divergence in optimal defense strategies when the available attack paths share numerous common arcs.

A Cross-Layer Game-Theoretic Approach to Resilient Control of Networked Switched Systems Against DoS Attacks.

This article investigates the resilient control strategies of networked switched systems (NSSs) against denial-of-service (DoS) attacks and external disturbance. In the network layer, both the defender and the attacker allocate energy over multiple channels. Considering the impact of switching characteristic in the physical layer on the network layer, a dynamic regulating factor is proposed to adjust the total energy of the defender. To optimize the signal-to-interference-noise ratio and energy consumption simultaneously at each player's side, a multiobjective game problem is formulated. Furthermore, a nondominated sorting genetic algorithm framework is employed, incorporating the knee point selection mechanism to attain the Pareto-Nash equilibrium, based on which the optimal defense strategy can be derived to achieve resilience against DoS attacks. In the physical-layer, taking the dynamic packet loss caused by DoS attacks and external disturbance into account, an H∞ minimax controller containing control inputs and the switching signal is designed to guarantee the optimal performance for NSSs through the dynamic game-theoretic approach. Finally, the networked continuous stirred tank reactor system is provided to verify the effectiveness of the proposed method.

Resilient Optimal Defensive Strategy of Micro-Grids System via Distributed Deep Reinforcement Learning Approach Against FDI Attack.

The ever-increasing false data injection (FDI) attack on the demand side brings great challenges to the energy management of interconnected microgrids. To address those aspects, this article proposes a resilient optimal defensive strategy with the distributed deep reinforcement learning (DRL) approach. To evaluate the FDI attack on demand response (DR), an online evaluation approach with the recursive least-square (RLS) method is proposed to evaluate the extent of supply security or voltage stability of the microgrids system is affected by the FDI attack. On the basis of evaluated security confidence, a distributed actor network learning approach is proposed to deduce optimal network weight, which can generate an optimal defensive scheme to ensure the economic and security issue of the microgrids system. From the methodology's view, it can also enhance the autonomy of each microgrid as well as accelerate DRL efficiency. According to those simulation results, it can reveal that the proposed method can evaluate FDI attack impact well and an improved distributed DRL approach can be a viable and promising way for the optimal defense of microgrids against the FDI attack on the demand side.

Binary observation‐based FIR system identification under sequence denial of service attacks

AbstractDue to the close interaction between computing, sensing, communication, and driving of the cyber‐physical system (CPS), which makes it highly vulnerable to cyber attacks, the security of CPS has attracted wide attention. In the article, we discuss the system identification problem of the finite impulse response system under sequence denial of service attacks. The identification algorithm of the unknown parameter is designed under binary observations, and its convergence performance is analyzed. The optimal attack strategy problem is modeled as a optimized problem with constraints based on the covariance matrix of estimation error, the solution method and implementation algorithm are given. From the perspective of the defender, an encryption‐type defense algorithm is designed, and then the optimal defense strategy is presented. The numerical simulation is used to verify the validity of the proposed method.

Stackelberg Security Game for Optimizing Cybersecurity Decisions in Cloud Computing

As it is difficult to cover all cybersecurity threats, an optimal defense strategy is one of the focal issues in cloud computing due to its dynamic abstraction and scalability. On this basis, Stackelberg security games (SSG) have received significant attention for their better deployment of limited security. To deal with uncertainty and incomplete information, we introduce a modified quantal response (Mod-QR) approach that incorporates bounded rationality and preference into the decision-making process. Formally, this can be done by using the quantal response equilibrium (QRE) framework to find a trade-off between the effectiveness and operating costs of cloud computing. In this case, the most effective countermeasures to defend the cloud can be viewed as a mixed strategy in which all the actions of the defender are played with a nonzero probability. This framework has been evaluated using an experimental study on MATLAB optimization toolbox to understand the behavioral aspects of cybersecurity actors and then to proactively protect cloud computing.

Understanding elite rugby league players’ experience of collision, effective contact coaching techniques, and player contact psychology: A focus group study

ABSTRACT The current study performed a series of online focus groups to understand elite rugby league players’ experiences of collision. Eighteen rugby league players comprising different playing positions from four teams were recruited to participate in a series of online focus groups, via the Microsoft Team’s platform, facilitated by a moderator. Players were competing in Europe’s elite rugby league competition, the European Super League (ESL), during the 2021 season. All focus group data were transcribed, coded and analysed using reflexive thematic analysis guide to ensure robust exploring, interpreting and reporting through pattern-based analysis. The findings are split into five key themes: 1) the three-man tackle – the perceived optimal defensive strategy with simultaneous contact, 2) not all collisions are the same; matchplay events change the collision intensity, 3) bracing and blindsiding – two factors that influence experiences of collision and concussion, 4) coaching philosophies and orientations, 5) psychological readiness for collision. Collision sports have an inherent risk of injury; however, in some players’ subjective experiences, there are collision types that have a greater association with risk or intensity (blind-sided collisions or long closing distances). It is essential that future research comprehends the effects of these collision types and the further themes.

A Game Model for Analyzing Wireless Sensor Networks of 5G Environment Based on Adaptive Equilibrium Optimizer Algorithm.

Wireless sensors networks (WSNs) play an important role in life. With the development of 5G, its security issues have also raised concerns. Therefore, it is an important topic to study the offense and defense confrontation in WSNs. A complete information static game model is established to analyze the offense and defense confrontation problem of WSNs in 5G. An adaptive equilibrium optimizer algorithm (AEO) based on parameter adaptive strategy is proposed, which can jump out of the local optimal solution better. Experiments show that the optimization ability of AEO outperforms other algorithms on at least 80% of the 23 classical test functions of CEC. The convergence speed of AEO is better in the early stage of population iteration. The optimal offensive and defensive strategy under different offense and defense resources through simulation experiments is analyzed. The conclusion shows that when the offensive resources are large, the offender takes an indiscriminate attack. When the defense resources are small, the defender should defend the most important elements, and when the defense resources are large, the defender should allocate the same resources to defend each element to obtain the maximum benefit. This paper provides new solution ideas for the security problems under the offense and defense game in WSNs.