Optimal Defense Strategy Research Articles

Optimal Decision Making Approach for Cyber Security Defense Using Evolutionary Game

At present, there are many techniques for cyber security defense such as firewall, intrusion detection and cryptography. Despite decades of studies and experiences on this issue, there still exists a problem that we always pay great attention to technology while overlooking strategy. In the traditional warfare, the level of decision-making and the formulation of optimal strategies have a great effect on the warfare result. Similarly, the timeliness and quality of decision-making in cyber attack-defense also make great significance. Since the attackers and defenders are oppositional, the selection of optimal defense strategy with the maximum payoff is difficult. To solve this problem, the stochastic evolutionary game model is utilized to simulate the dynamic adversary of cyber attack-defense. We add the parameter $\lambda $ to the Logit Quantal Response Dynamics (LQRD) equation to quantify the cognitive differences of real-world players. By calculating the evolutionary stable equilibrium, the best decision-making approach is proposed, which makes a balance between defense cost and benefit. Cases studies on ransomware indicate that the proposed approach can help the defender predict possible attack action, select the related optimal defense strategy over time, and gain the maximum defense payoff.

Optimal defense strategy model based on differential game in edge computing

Edge computing extends the cloud computing paradigm to the edge of the network to offset the shortcomings of traditional cloud computing in mobile support, low delay, and location awareness. However, traditional complicated encryption algorithms, access control measures, identification protocols, and privacy protection methods are inapplicable to security defense of edge computing given the multisource data fusion characteristics of edge computing, superposition of mobile and the Internet, and resource limitations in storage, computing, and battery capacity of edge terminals. Therefore, a reasonable defense model for complicated dynamic edge computing environment must be established. In accordance with the characteristics of limited resources of edge devices, combined with dynamic game theory, this study proposes an optimal defense strategy model based on a differential game and solves the optimal defense strategy of edge nodes in infinite and finite-horizons. The optimal defense strategy of the edge nodes was simulated under different conditions, and the simulation verifies that the edge nodes can obtain the optimal defense effect with minimum resource consumption when cooperating to form the defense system.

Modeling multi-target defender-attacker games with quantal response attack strategies

Due to the growing interest in incorporating behavioral models within the defender-attacker game literature, the perfect rationality assumption of adversaries has been relaxed in many recent works. This paper studies four multi-target defensive resource allocation in defender-attacker games by using a quantal response model, in which the attacker might be bounded rational. We compare the results from the proposed models with the traditional game theoretic model where the attacker behaves rationally. Moreover, we studied the impacts of the attacker’s rationality level on the defender’s optimal defense strategies. Real data from the Urban Areas Security Initiative (UASI) and the Global Terrorism Database (GTD) are employed to estimate the rationality parameter as well as numerically illustrate the model. The results show that: (a) in the quantal response model, the defender’s expected loss at equilibrium increases with the attacker’s rationality parameter and the expected loss approach the results from the game theoretic model; (b) when the attacker’s rationality parameter in the quantal response model approaches infinity, both the equilibrium defensive allocation and expected loss approach to the results from the game theoretic model; (c) when the attacker uses quantal response while the defender falsely believes that the attacker uses game theoretic response, the expected loss will be similar to the model where both players utilize game theoretic response, but higher than the expected loss from the model where both players use quantal response; (d) when the attacker uses game theoretic response while the defender falsely believes that the attacker uses quantal response, the expected equilibrium loss will be higher than the ones from the other three scenarios; and (e) the quantal response model gives a closer resource allocation to the real allocation than the game theoretic model does. This paper provides some novel insights to defensive resource allocation when considering that the attacker is bounded rationality.

Defending a series system with individual protection, overarching protection, and disinformation

This research addresses the use of individual protection, overarching protection, and disinformation to defend a series system against intentional attacks. The attacker can allocate resources to intelligence actions to distinguish false targets from genuine targets. Analogously, the defender can expend efforts on disinformation actions to prevent the false targets from being detected. The probability that a target is detected depends on the effort exerted by both parties. In this defense and attack model, the defender moves first and allocates its resources to overarching protection, disinformation actions, and individual protection to minimize system destruction probability, assuming that the attacker has full knowledge of its actions and will always employ the most harmful attack strategy. The attacker allocates its resources to overarching protection penetration, intelligence actions, and individual attacks to maximize system destruction probability. We formulate the defense and attack model as a two-stage minmax game and analyze the optimal defense strategy. The proposed model is illustrated by a signaling system. This study demonstrates how the defender and attacker should respond under different contest intensities and amounts of resources.

Differential Security Game in Heterogeneous Device-to-Device Offloading Network Under Epidemic Risks

Cooperative computation among peer mobile devices via device-to-device (D2D) links, a.k.a. D2D offloading, is a promising technology to enhance mobile computing performance and reduce core wireless network traffic. However, D2D offloading also creates new security risks as malware can relatively easily compromise mobile devices participating in D2D offloading and propagate across the entire network. In this article, we build an epidemic model to understand the malware propagation process in the D2D offloading-enabled mobile network where devices have heterogeneous computation demand and new devices can enter the system over time. This model also allows mobile devices to intentionally enter a “non-cooperative” state as a preventive defense strategy to thwart malware propagation. We prove a thresholding result of the malware propagation similar to that in classic epidemic models under given static defender (i.e. the network operator) and attacker strategies. We further model the strategic interaction between the defender and the attacker as a zero-sum differential game. The existence of a saddle-point equilibrium is proved, and the optimal dynamic defense and attack strategies are derived based on the Pontryagin's maximum principle, which are proven to be a bang-bang control strategy. Simulation results validate the proposed model and show that the dynamic optimal strategies significantly improve the system utility compared with baseline strategies.

Study on Stochastic Differential Game Model in Network Attack and Defense

In recent years, evolutionary game theory has been gradually applied to analyze and predict network attack and defense for maintaining cybersecurity. The traditional deterministic game model cannot accurately describe the process of actual network attack and defense due to changing in the set of attack-defense strategies and external factors (such as the operating environment of the system). In this paper, we construct a stochastic evolutionary game model by the stochastic differential equation with Markov property. The evolutionary equilibrium solution of the model is found and the stability of the model is proved according to the knowledge of the stochastic differential equation. And we apply the explicit Euler numerical method to analyze the evolution of the strategy selection of the players for different problem situations. The simulation results show that the stochastic evolutionary game model proposed in this paper can get a steady state and obtain the optimal defense strategy under the action of the stochastic disturbance factor. In addition, compared with other kinds of literature, we can conclude that the return on security investment of this model is better, and the strategy selection of the attackers and defenders in our model is more suitable for actual network attack and defense.

Markov Game for Securing Wide-Area Damping Control Against False Data Injection Attacks

While wide-area communication networks facilitate the exchange of measurements and control signals for wide-area damping controllers, they bring in new threats of cyberattacks. This article formulates the dynamic interaction between an intelligent spoof attacker and the wide-area damping control (WADC) center as a zero-sum two-player Markov game. In this Markov game, the attacker intelligently spoofs the communication links sending wide-area control signals to selected generators while the WADC selectively encrypts transmitted control signals with limited cyberresources. The successful spoof of specific communication links leads to the degradation of the WADC performance and even to system instability indicated by the real part of the targeted interarea oscillation mode. The potential performance degradation in the physical layer is uniquely included in the cost function of this game while the other two parts of the cost function are the cybersecurity investments of both the attacker and the WADC (defender). The minimax Q-learning approach is used to obtain the optimal defense and attack strategies. Simulation results show that the strategies for the attacker and the WADC converge within 3000 iterations by using the minimax Q-learning approach. The proposed Markov game provides a cyberphysical framework to make the optimal defense strategy for the WADC.

Optimal resource allocation for defending k-out-of-n systems against sequential intentional and unintentional impacts

Existing literature on system defense mainly considers single or multiple intentional impacts. However, intentional impacts (strategic attacks) and unintentional impacts (natural disasters) can happen sequentially in practice. To overcome this limitation, we conduct a study that considers the optimal resource allocation for defending a k-out-of-n system against sequential intentional and unintentional impacts, which is motivated by the defense of a solar power grid system against the sequential hacker's attack and solar storm. We study the optimal defense strategies under different occurrence orders of intentional and unintentional impacts and analyze the impact of critical parameters on the defender's optimal defense strategy by a case study. We also investigate the scenario in which the defender offers supplemental protection to the elements that survive the first impact. The case study indicates that deploying as many elements as possible in the first stage may not be the optimal strategy for the defender no matter the unintentional impact comes first or the intentional impact comes first. Providing supplemental protection can reduce the expected loss of the system when the unintentional impact comes first.

Bayesian Stackelberg game model for water supply networks against interdictions with mixed strategies

We address a problem of preventing an interdiction on water supply networks by building a Bayesian Stackelberg game model involving stakeholders of a defender and an interdictor. The defender initiates to allocate resource to network components to make a trade-off between network resilience measured by water satisfaction rate and the defender's cost, whereas the interdictor follows to interdict a component with the objectives of maximising the destruction level on the network structure and minimising the interdictor's cost. Specifically, the defender adopts mixed defence strategies, which implies that the interdictor is uncertain of the defender's resource allocation. Moreover, we propose sufficient conditions for the elimination of the dominated defence and interdiction strategies. A decomposed iterative learning algorithm (DILA) and a smallest-depth binary-partition based hierarchical algorithm (SBHA) are developed to reduce the sizes of the defence and interdiction strategy sets, respectively, thus analysing the optimal mixed defence strategies. Finally, a real case study with private information is conducted, thus providing valuable suggestions for the defender's resource allocation against interdictions.

Cognitive Networks With In-Band Full-Duplex Radios: Jamming Attacks and Countermeasures

Although in-band full-duplex (IBFD) radios promise to double the throughput of a wireless link, they are more vulnerable to jamming attacks than their out-of-band full-duplex (OBFD) counterparts. For two communicating OBFD nodes, a jammer needs to attack both the uplink and the downlink channels to completely break the communication link. In contrast, only one common channel needs to be jammed in the case of two IBFD nodes. Even worse, a jammer with self-interference suppression (SIS) capabilities (the underlying technique of IBFD radios) can learn the transmitters' activity while injecting interference, allowing it to react instantly to the transmitter's strategies. In this work, we consider a power-constrained IBFD “reactive-sweep” jammer that sweeps through the set of channels by jamming a subset of them simultaneously. We model the interactions between the IBFD radios and the jammer as a stochastic constrained zero-sum Markov game in which nodes adopt the frequency hopping (FH) technique as their strategies to counter jamming attacks. Beside the IBFD transmission-reception (TR) mode, we introduce an additional operation mode, called transmission-detection (TD), in which an IBFD radio transmits and leverages its SIS capability to detect jammers. The aim of the TD mode is to make IBFD radios more cognitive to jamming. The nodes' optimal defense strategy that guides them when to hop and which operational mode (TD or TR) to use is then established from the equilibrium of the stochastic Markov game. We prove that this optimal policy has a threshold structure, in which IBFD nodes stay on the same channel up to a certain number of time slots before hopping. Simulation results show that our policy significantly improves the throughput of IBFD nodes under jamming attacks.

Game theoretic resource allocation model for designing effective traffic safety solution against drunk driving

To reduce the number of deaths and injuries due to drunk driving (also referred to as drink driving, driving while intoxicated, and driving under the influence of alcohol in the literature), many countries have deployed public safety resources to inspect traffic network. However, challenges remain in allocating limited public safety resources to the significantly large traffic networks. In this paper, we propose an optimal public safety resource allocation scheme to inspect drunk driving. To highlight the utilization of limited public safety resources, first, we model the issue of drunk driving as a defender-attacker Stackelberg game. In the game, the law enforcement agency (the defender) allocates public safety resources in a traffic network to arrest drunk drivers (the attackers), and the attacker seeks to choose a feasible route given the defender's strategy to maximize the escape probability. Second, we develop an effective approach to compute the optimal defender strategy based on a double oracle framework. Third, we analyze the complexity of the defender oracle problem. Then, we conduct simulations on directed graphs, which are abstracted from the city traffic network in Dalian, China, to demonstrate that our scheme achieves a robust solution and higher utility, and is capable of scaling up to handle realistic-sized drunk-driving problems.

Intrusion Detection System for IoT Heterogeneous Perceptual Network

With the acceleration of the Internet of things (IoT) construction, the security and energy consumption of IoT will become an import factor restricting the overall development of the IoT. In order to reduce the energy consumption of the IoT heterogeneous perceptual network in the attack-defense process, the placement strategy of the intrusion detection system (IDS) described in this paper is to place the IDS on the cluster head nodes selected by the clustering algorithm called ULEACH, which we have proposed in this paper. By optimizing the calculation of the node threshold, the ULEACH clustering algorithm will comprehensively consider the heterogeneity of the perceptual nodes and take the residual energy, energy consumption rate, and overall performance of the nodes into account. As a result, the strategy improves the utilization of the nodes to enhance the performance of heterogeneous perceptual network and extend the lifetime of the system. Furthermore, the paper proposes a intrusion detection system framework and establishes dynamic intrusion detection model for IoT heterogeneous perceptual network based on game theory, by applying modified particle swarm optimization, the optimal defense strategy that could balance the detection efficiency and energy consumption of the system is obtained. Finally, the experiment results show that proposed strategy not only effectively detects multiple network attacks, but also reduces energy consumption.

Target-oriented utility for interdiction of transportation networks

Optimal resource allocation in security has been a significant challenge for critical infrastructure protection. We study an optimal resource-allocation model for more cost-effective protection of critical targets on a transportation network. We apply target-oriented utility theory and use mixed-integer programming to determine the optimal level of investment needed to interdict an attacker on a transportation network. We assume that the attacker will choose one target among multiple targets to attack based on factors such as the attractiveness of targets to the attacker and the attack success probabilities, and will be deterred for sufficiently low attack success probabilities. Sensitivity analyses are conducted to illustrate how the optimal defensive strategy depends on parameters such as attacker success probabilities, attacker deterrence, target values, number of targets, and effectiveness of defensive investment.

Optimal network defense strategy selection based on Bayesian game

Existing passive defence methods cannot effectively guarantee network security; to solve this problem, a novel method is proposed that selects the optimal defence strategy. The network attack-defen...

Defense Strategy for Resilient Shipboard Power Systems Considering Sequential Attacks

To increase the resilience of shipboard power systems, this paper presents an optimal defense strategy to protect critical lines against attacks. In the modeling, an attack is considered to destroy one critical bus, which may result in that all lines are connected to this bus will be out of service unless protection is enabled. Furthermore, after one true attack occurs, the network restoration is performed as soon as possible to pick up the critical loads and maintain system operation. To address the uncertain location of the attacks, a tri-level robust optimal defense strategy is set up to protect the critical lines under the worst attack. Moreover, a nested column-constraint generation method is employed to solve this model. A 60-bus shipboard power system is studied to demonstrate the effectiveness of the proposed model and the defense method.

Optimal network defense strategy selection based on Bayesian game

Optimal network defense strategy selection based on Bayesian game

Attack and Defense Strategies for Intrusion Detection in Autonomous Distributed IoT Systems

In this paper, we develop a methodology to capture and analyze the interplay of attack-defense strategies for intrusion detection in an autonomous distributed Internet of Things (IoT) system. In our formulation, every node must participate in lightweight intrusion detection of a neighbor target node. Consequently, every good node would play a set of defense strategies to faithfully defend the system while every bad node would play a set of attack strategies for achieving their own goals. We develop an analytical model based on Stochastic Petri Net (SPN) modeling techniques. Our methodology allows the optimal defense strategies to be played by good nodes to maximize the system lifetime when given a set of parameter values characterizing the distributed IoT system operational environment. We conduct a detailed performance evaluation based on an experiment dataset deriving from a reference autonomous distributed IoT system comprising 128 sensor-carrying mobile nodes and show how IDS defense mechanisms can counter malicious attack mechanisms under the ADIoTS system while considering multiple failure conditions.

A practical application of game theory to optimize selection of hardware Trojan detection strategies

A wide variety of Hardware Trojan countermeasures have been developed, but less work has been done to determine which are optimal for any given design. To address this, we consider not only metrics related to the performance of the countermeasure, but also the likely action of an adversary given their goals. Trojans are inserted by an adversary to accomplish an end, so these goals must be considered and quantified in order to predict these actions. The model presented here builds upon a security economic approach that models the adversary and defender motives and goals in the context of empirically derived countermeasure efficacy metrics. The approach supports formation of a two-player strategic game to determine optimal strategy selection for both adversary and defender. A game may be played in a variety of contexts, including consideration of the entire design lifecycle or only a step in product development. As a demonstration of the practicality of this approach, we present an experiment that derives efficacy metrics from a set of countermeasures (defender strategies) when tested against a taxonomy of Trojans (adversary strategies). We further present a software framework, GameRunner, that automates not only the solution to the game but also mathematical and graphical exploration of “what if” scenarios in the context of the game. GameRunner can also issue “prescriptions,” a set of commands that allows the defender to automate the application of the optimal defender strategy to their circuit of concern. Finally, we include a discussion of ongoing work to include additional software tools, a more advanced experimental framework, and the application of irrationality models to account for players who make subrational decisions.

Optimal Decision-Making Approach for Cyber Security Defense Using Game Theory and Intelligent Learning

Existing approaches of cyber attack-defense analysis based on stochastic game adopts the assumption of complete rationality, but in the actual cyber attack-defense, it is difficult for both sides of attacker and defender to meet the high requirement of complete rationality. For this aim, the influence of bounded rationality on attack-defense stochastic game is analyzed. We construct a stochastic game model. Aiming at the problem of state explosion when the number of network nodes increases, we design the attack-defense graph to compress the state space and extract network states and defense strategies. On this basis, the intelligent learning algorithm WoLF-PHC is introduced to carry out strategy learning and improvement. Then, the defense decision-making algorithm with online learning ability is designed, which helps to select the optimal defense strategy with the maximum payoff from the candidate strategy set. The obtained strategy is superior to previous evolutionary equilibrium strategy because it does not rely on prior data. By introducing eligibility trace to improve WoLF-PHC, the learning speed is further improved and the defense timeliness is significantly promoted.

Optimal Network Defense Strategy Selection Based on Markov Bayesian Game

Existing passive defence methods cannot effectively guarantee network security; to solve this problem, a novel method is proposed that selects the optimal defence strategy. The network attack-defence process is modelled based on the Bayesian game. The payoff is quantified from the impact value of the attack-defence actions. The optimal defence strategy is selected that takes defence effectiveness as the criterion. The rationality and feasibility of the method are verified through a representative example, and the general rules of network defence are summarised. Compared to the classic strategy selection methods based on game theory, the proposed method can select the optimal strategy in the form of pure strategy by quantifying defence effectiveness, which was proven to perform better.