Game Theory Based Network Security

Yi Luo, Ferenc Szidarovszky, Youssif Al-Nashif, Salim Hariri
DOI: 10.4236/jis.2010.11005                

Abstract

The interactions between attackers and network administrator are modeled as a non-cooperative non-zero-sum dynamic game with incomplete information, which considers the uncertainty and the special properties of multi-stage attacks. The model is a Fictitious Play approach along a special game tree when the attacker is the leader and the administrator is the follower. Multi-objective optimization methodology is used to predict the attacker’s best actions at each decision node. The administrator also keeps tracking the attacker’s actions and updates his knowledge on the attacker’s behavior and objectives after each detected attack, and uses it to update the prediction of the attacker’s future actions. Instead of searching the entire game tree, appropriate time horizons are dynamically determined to reduce the size of the game tree, leading to a new, fast, adaptive learning algorithm. Numerical experiments show that our algorithm has a significant reduction in the damage of the network and it is also more efficient than other existing algorithms.

Keywords

Multi-Stage Attack, Dynamic Game, Multi-Objective Optimization, Adaptive Learning

Conflicts of Interest

The authors declare no conflicts of interest.

References

[1]	K. Lye and J. Wing, “Game Strategies in Network Secu-rity,” International Journal of Information Security, Vol. 4, 2005, pp. 71-86.
[2]	D. Shen, G. Chen, E. Blasch and G. Tadda, “Adaptive Markov Game Theoretic Data Fusion Approach for Cyber Network Defense,” IEEE Military Communications Conference (MILCOM 2007), Orlando, 2007.
[3]	L. Carin, G. Cybenko and J. Hughes, “Cybersecurity Strategies: The QuERIES Methoddology,” Computer, Vol. 41, No. 8, 2008, pp. 20-26.
[4]	Z. Zhang and P. Ho, “Janus: A Dual-Purpose Analytical Model for Understanding, Characterizing and Counter-mining Multi-Stage Collusive Attacks in Enterprise Net-works” Journal of Network and Computer Applications, Vol. 32, No. 3, 2009, pp. 710-720.
[5]	P. Liu and W. Zang, “Incentive-Based Modeling and Inference of Attack Intent, Objectives, and Strategies,” CCS’03, Washington, DC, 2003.
[6]	W. M. Siever, A. Miller and D. R. Tauritz, “Blueprint for Iteratively Hardening Power Grids Employing Unified Power Flow Controllers,” SoSE’07, IEEE International Conference on System of Systems Engineering, Tampa, 2007.
[7]	Y. Luo, F. Szidarovszky, Y. Al-Nashif and S. Hariri, “Game Tree Based Partially Observable Stochastic Game Model for Intrusion Defense Systems (IDS),” IIE Annual Conference and Expo (IERC 2009), Miami, 2009.
[8]	F. Forgo, J. Szep and F. Szidarovszky, “Introduction to the Theory of Games,” Kluwer Academic Publishers, Dordrecht, 1999.
[9]	B. T. Richardson and L. Chavez, “National SCADA Test Bed Consequence Modeling Tool,” Sandia National La- boratory Report, SAND2008-6098, Albuquerque, 2008.
[10]	F. Szidarovszky, M. Gershon and L. Duckstein, “Tech-niques for Multiobjective Decision Making in Systems Management,” Elsevier, Amsterdam, 1986.