Security Game Research Articles

Equilibrium analysis for multi-defender Stackelberg security games under a logit tie-breaking rule

We introduce a general multi-defender Stackelberg security game where multiple independent defenders jointly protect a same set of targets from being attacked by a common attacker. In the game, Strong Stackelberg Equilibrium is fundamentally problematic, because the notion of ‘breaking ties in defender's favour’ is no longer well defined, as we must specify which defender will receive the favour. To address this issue, we define a new equilibrium concept under a newly defined tie-breaking rule. We characterise Logit Stackelberg Multi-Defender Equilibrium, corresponding to a logit tie-breaking rule, as well as an equivalent Nash Equilibrium among defenders, and exhibit algorithms for computing the equilibrium solutions. We find that Logit Stackelberg Multi-Defender Equilibrium and its' equivalent Nash Equilibrium may not exist, which motivates us to find an approximate equilibrium. We design a revised exclusion algorithm to find the approximate ε-Nash Equilibrium in which no defender gains more than ε by deviating.

Security defense strategy algorithm for Internet of Things based on deep reinforcement learning

Currently, important privacy data of the Internet of Things (IoT) face extremely high risks of leakage. Attackers persistently engage in continuous attacks on terminal devices to obtain private data of crucial importance. Although significant progress has been made in recent years in deep reinforcement learning defense strategies, most defense methods still face problems such as low defense resource allocation efficiency and insufficient defense coordination capabilities. To solve the above problems, this paper constructs a novel adversarial security scenario and proposes a security game model that integrates defense resource allocation and patrol inspection. Regarding the above game model, this paper designs a deep reinforcement learning algorithm named SDSA to calculate its security defense strategy. SDSA calculates the allocation strategy of the best patrolling strategy that is most suitable for the defender by searching the policy on a multi-dimensional discrete action space, and enables multiple defense agents to cooperate efficiently by training a multi-intelligent Dueling Double Deep Q-Network (D3QN) with prioritized experience replay. Finally, the experimental results show that the SDSA-learned security defense strategy can provide a feasible and effective security protection strategy for defenders against attacks compared to the MADDPG and OptGradFP methods.

Interdependent security games in a unidirectional network.

We consider directed tree networks with a single source, where there exists a positive probability of a disruptive event at any node. Such networks model security considerations in pipelines as well as in unidirectional digital networks. If a disruptive event occurs at a certain node, that node and its downstream nodes incur economic losses. Users thus have an incentive to invest in upstream locations as well as their own sites to reduce the probability of a disruptive event. The initial model we develop to reduce the expected investment plus disruption costs is a multiplicative model for which closed-form solutions cannot be obtained in general. We overcome this problem with an additive model that we show closely approximates the initial formulation. This model reduces the security problem to a public goods setting where we minimize the total expected cost at each node. The users then need to share these costs in an equitable fashion, which gives rise to a set of cooperative games. For the case where disutilities to all users are identical, the Shapley value can be computed efficiently, along the lines of an Airport Game. We also treat the case where risk reduction and disutility vary across the network. Finally, we prove that the cooperative game is concave in this general case, which guarantees that the core of the game is nonempty and that the Shapley value is an element of the core.

Duel-based neuroevolutionary method for Stackelberg Security Games with boundedly rational Attacker

This paper considers the problem of finding optimal strategies in Stackelberg Security Games when playing against a non-perfectly rational Attacker. To this end, a novel Duel-based NeuroEvolutionary approach to Security Games (DNESG) is proposed, which utilizes the Strategy Comparison Neural Network (SCNN) as a surrogate model to compare pairs of Defender’s strategies. SCNN is trained on historical data (past attack attempts) and does not require any direct information about the Attacker’s preferences regarding targets, payoff distribution, or decision-making model. SCNN is embedded in the Evolutionary Algorithm framework and implements a tournament-based selection method in place of a time-consuming direct strategy evaluation. The effectiveness of DNESG is assessed on a set of 90 benchmark Deep Packet Inspection games inspired by real cybersecurity scenarios. The proposed method provides high-quality solutions and outperforms state-of-the-art approaches (both exact and approximate) with statistical significance when playing against non-perfectly rational Attacker. Moreover, DNESG offers excellent time scalability, being two orders of magnitude faster than the state-of-the-art Mixed-Integer Linear Programming method.

Zero-determinant strategy in stochastic Stackelberg asymmetric security game

In a stochastic Stackelberg asymmetric security game, the strong Stackelberg equilibrium (SSE) strategy is a popular option for the defender to get the highest utility against an attacker with the best response (BR) strategy. However, the attacker may be a boundedly rational player, who adopts a combination of the BR strategy and a fixed stubborn one. In such a condition, the SSE strategy may not maintain the defensive performance due to the stubbornness. In this paper, we focus on how the defender can adopt the unilateral-control zero-determinate (ZD) strategy to confront the boundedly rational attacker. At first, we verify the existence of ZD strategies for the defender. We then investigate the performance of the defender’s ZD strategy against a boundedly rational attacker, with a comparison of the SSE strategy. Specifically, when the attacker’s strategy is close to the BR strategy, the ZD strategy admits a bounded loss for the defender compared with the SSE strategy. Conversely, when the attacker’s strategy is close to the stubborn strategy, the ZD strategy can bring higher defensive performance for the defender than the SSE strategy does.

Cloud security game theory scoring from predation models in simulation

Cloud security game theory scoring from predation models in simulation

Behavioral Learning in Security Games: Threat of Multi-Step Manipulative Attacks

This paper studies the problem of multi-step manipulative attacks in Stackelberg security games, in which a clever attacker attempts to orchestrate its attacks over multiple time steps to mislead the defender's learning of the attacker's behavior. This attack manipulation eventually influences the defender's patrol strategy towards the attacker's benefit. Previous work along this line of research only focuses on one-shot games in which the defender learns the attacker's behavior and then designs a corresponding strategy only once. Our work, on the other hand, investigates the long-term impact of the attacker's manipulation in which current attack and defense choices of players determine the future learning and patrol planning of the defender. This paper has three key contributions. First, we introduce a new multi-step manipulative attack game model that captures the impact of sequential manipulative attacks carried out by the attacker over the entire time horizon. Second, we propose a new algorithm to compute an optimal manipulative attack plan for the attacker, which tackles the challenge of multiple connected optimization components involved in the computation across multiple time steps. Finally, we present extensive experimental results on the impact of such misleading attacks, showing a significant benefit for the attacker and loss for the defender.

OPRADI: Applying Security Game to Fight Drive under the Influence in Real-World

OPRADI: Applying Security Game to Fight Drive under the Influence in Real-World

Stackelberg Security Games with Contagious Attacks on a Network: Reallocation to the Rescue

In the classic network security games, the defender distributes defending resources to the nodes of the network, and the attacker attacks a node, with the objective of maximizing the damage caused. In this paper, we consider the network defending problem against contagious attacks, e.g., the attack at a node u spreads to the neighbors of u and can cause damage at multiple nodes. Existing works that study shared resources assume that the resource allocated to a node can be shared or duplicated between neighboring nodes. However, in the real world, sharing resource naturally leads to a decrease in defending power of the source node, especially when defending against contagious attacks. Therefore, we study the model in which resources allocated to a node can only be transferred to its neighboring nodes, which we refer to as a reallocation process. We show that the problem of computing optimal defending strategy is NP-hard even for some very special cases. For positive results, we give a mixed integer linear program formulation for the problem and a bi-criteria approximation algorithm. Our experimental results demonstrate that the allocation and reallocation strategies our algorithm computes perform well in terms of minimizing the damage due to contagious attacks.

CROSS: A framework for cyber risk optimisation in smart homes

This work introduces a decision support framework, called Cyber Risk Optimiser for Smart homeS (CROSS), which advises both smart home users and smart home service providers on how to select an optimal portfolio of cyber security controls to counteract cyber attacks in a smart home including traditional cyber attacks and adversarial machine learning attacks. CROSS is based on a multi-objective bi-level two-stage optimisation. In stage-one optimisation, the problem is modelled as a multi-leader-follower game that considers both security and economic objectives, where the provider selects a security portfolio to protect both itself and its users, while rational attackers target the weakest path. Stage-two optimisation is a Stackelberg security game that focuses on additional user security controls under the remit of smart home users. While CROSS can potentially be applied to other similar use cases, in this paper, our aim is to address threats against artificial intelligence (AI) applications as the use of AI in smart Internet of Things (IoT) devices introduces new cyber threats to home environments. Specifically, we have implemented and assessed CROSS in a smart heating use case in a prototypical AI-enabled IoT environment that combines characteristics and vulnerabilities currently present on existing commercial off-the-shelf (COTS) devices, demonstrating the selection of optimal decisions.

Coevolution of players strategies in security games

Coevolution of players strategies in security games

Information Design for Multiple Interdependent Defenders: Work Less, Pay Off More

This paper studies the problem of information design in a general security game setting in which multiple self-interested defenders attempt to provide protection simultaneously for the same set of important targets against an unknown attacker. A principal, who can be one of the defenders, has access to certain private information (i.e., attacker type), whereas other defenders do not. We investigate the question of how that principal, with additional private information, can influence the decisions of the defenders by partially and strategically revealing her information. In particular, we develop a polynomial time ellipsoid algorithm to compute an optimal private signaling scheme. Our key finding is that the separation oracle in the ellipsoid approach can be carefully reduced to bipartite matching. Furthermore, we introduce a compact representation of any ex ante persuasive signaling schemes by exploiting intrinsic security resource allocation structures, enabling us to compute an optimal scheme significantly faster. Our experiment results show that by strategically revealing private information, the principal can significantly enhance the protection effectiveness for the targets.

Strateška odbrana kao igra sajber bezbednosti

Currently, both assaulters and perservers strive to be in a position of access to information, and also control in the field of economics, warfare, and society. Describe in military terms, data has become a virtual 'high ground' from which a more knowledgeable opponent can be influenced. Strategic defence became a cyber security game. However, despite the numerous technological solutions introduced to address system vulnerabilities, the human factor remains the greatest threat to system security. On the example of Ukraine-Russia conflict, this paper promotes the implementation of military strategy concepts to cyberconflict in order to better address the dynamical challenges of continual interaction between conformable and intelligent opponents. It begins by arguing for the adaptability of a military paradigm in cyberspace, though, without a desire for cyberspace's militarization. The conclusion is that the military mindset, which is predicated on clashes with dynamic, adaptable opponents, is a more dependable strategy than the prevalent cyber-hygiene paradigm. Five levels of strategic thought were described in order to connect objectives to policy, strategy, campaigns and operations, tactics, and instruments. Each level of strategic thinking was applied to a hypothetical defence script. Finally, the paper showed a substitute to technocentric strategies that are insufficient to combat the opponent by incorporating strategic thinking into digital defence.

Playing Stackelberg Security Games in Perfect Formulations

Playing Stackelberg Security Games in Perfect Formulations

A Complete Analysis on the Risk of Using Quantal Response: When Attacker Maliciously Changes Behavior under Uncertainty

In security games, the defender often has to predict the attacker’s behavior based on some observed attack data. However, a clever attacker can intentionally change its behavior to mislead the defender’s learning, leading to an ineffective defense strategy. This paper investigates the attacker’s imitative behavior deception under uncertainty, in which the attacker mimics a (deceptive) Quantal Response behavior model by consistently playing according to a certain parameter value of that model, given that it is uncertain about the defender’s actual learning outcome. We have three main contributions. First, we introduce a new maximin-based algorithm to compute a robust attacker deception decision under uncertainty, given the defender is unaware of the attacker deception. Our polynomial algorithm is built via characterizing the decomposability of the attacker deception space as well optimal deception behavior of the attacker against the worst case of uncertainty. Second, we propose a new counter-deception algorithm to tackle the attacker’s deception. We theoretically show that there is a universal optimal defense solution, regardless of any private knowledge the defender has about the relation between their learning outcome and the attacker deception choice. Third, we conduct extensive experiments in various security game settings, demonstrating the effectiveness of our proposed counter-deception algorithms to handle the attacker manipulation.

Indefinite Mean-Field Stochastic Cooperative Linear-Quadratic Dynamic Difference Game With Its Application to the Network Security Model.

In this article, we show how to obtain all of the Pareto optimal decision vectors and solutions for the finite horizon indefinite mean-field stochastic cooperative linear-quadratic (LQ) difference game. First, the equivalence between the solvability of the introduced N coupled generalized difference Riccati equations (GDREs) and the solvability of the multiobjective optimization problem is established. However, it is difficult to obtain Pareto optimal decision vectors based on the N coupled GDREs because the optimal joint strategy adopted by all players to optimize the performance criterion of some players in the game is different from the strategies of other players, which rely on the weighted matrices of cost functionals that may be different among players. Second, a necessary and sufficient condition is developed to guarantee the convexity of the costs, which makes the weighting technique not only sufficient but also necessary for searching Pareto optimal decision vectors. It is then shown that the mean-field Pareto optimality algorithm (MF-POA) is presented to identify, in principle, all of the Pareto optimal decision vectors and solutions via the solutions to the weighted coupled GDREs and the weighted coupled generalized difference Lyapunov equations (GDLEs), respectively. Finally, a cooperative network security game is reported to illustrate the results presented. Simulation results validate the solvability, correctness, and efficiency of the proposed algorithm.

Deception in multi-attacker security game with nonfuzzy and fuzzy payoffs

Deception in multi-attacker security game with nonfuzzy and fuzzy payoffs

Learning attack-defense response in continuous-time discrete-states Stackelberg Security Markov games

ABSTRACT Researchers have become interested in security games in recent decades as a result of its successful application in real-world security issues. The security model is based on the Stackelberg Security Game (SSG), in which defenders (leaders) select a defensive strategy based on the optimal reaction of attackers (followers), who, at equilibrium, select the predicted assaulting strategy as a response. These applications, on the other hand, do not account for the time constraints posed by the game’s players’ journey time. Furthermore, players should be able to cope with dynamic settings in which their knowledge of the environment changes on a regular basis, allowing them to perform more effectively. This research proposes a security model based on a continuous-time Reinforcement Learning (RL) approach implemented using a temporal difference method that takes prior information into account to address these issues. We use a controlled, ergodic continuous-time Markov game to model the SSG. The game framework model assumes that all information is available. We calculate the number of transitions over a time interval divided by the entire value of the holding time to estimate the transition rates. The arithmetic mean of the observed cost of the individual players is used to estimate the cost for defenders and attackers. An iterated proximal/gradient approach is used to calculate the SSG equilibrium point. We offer a continuous-time random walk method for game implementation. In a numerical case relevant to rain-forest hazards, we analyze the performance of the suggested RL security solution and discuss the problems that should be considered in future.

Defense coordination in security games: Equilibrium analysis and mechanism design

Real-world security scenarios sometimes involve multiple defenders: security agencies of two or more countries might patrol the same border areas, and domestic security agencies might also operate in the same locations when their areas of jurisdiction overlap. Motivated by these scenarios and the observation that uncoordinated movements of the defenders may lead to an inefficient defense, we introduce a model of multi-defender security games and explore the possibility of improving efficiency by coordinating the defenders — specifically, by pooling the defenders' resources and allocating them jointly. The model generalizes the standard model of Stackelberg security games, where a defender (now a group of defenders) allocates security resources to protect a set of targets, and an attacker picks the best target to attack. In particular, we are interested in the situation with heterogeneous defenders, who may value the same target differently. Our task is twofold. First, we need to develop a good understanding of the uncoordinated situation, as the baseline to be improved. To this end we formulate a new equilibrium concept, and prove that an equilibrium under this concept always exists and can be computed efficiently. Second, to coordinate the heterogeneous defenders we take a mechanism design perspective and aim to find a mechanism to generate joint resource allocation strategies. We seek a mechanism that improves the defenders' utilities upon the uncoordinated baseline, achieves Pareto efficiency, and incentivizes the defenders to report their true incentives and execute the recommended strategies. Our analysis establishes several impossibility results, which indicate the intrinsic difficulties of defense coordination. Specifically, we show that even the basic properties listed above are in conflict with each other: no mechanism can simultaneously satisfy them all, or even some proper subsets of them. In terms of positive results, we present mechanisms that satisfy all combinations of the properties that are not ruled out by our impossibility results, thereby providing a comprehensive profile of the mechanism design problem with respect to the properties considered.

Counter Mode of the Shannon Block Cipher Based on MPF Defined over a Non-Commuting Group

In this paper, we present a counter mode of a Shannon block cipher based on the matrix power function. We make use of the matrix power function to define a single round symmetric cipher. Continuing our previous research, we implement a non-commuting group the order of which is a power of two in order to define a CTR mode in its most classic interpretation. We explore the security of the newly defined scheme, first, by showing that our block cipher is perfectly secure and does not leak any information about the initial plaintext based on the ciphertext. Then, we define a sequence of security games that show how the CTR mode of our cipher can resist all passive attacks.