A Stochastic Network-interdiction Model for Cyber Security
Author:
Publisher:
Published: 2014
Total Pages: 81
ISBN-13:
DOWNLOAD EBOOKWe propose a general defender-attacker model for security of computer networks, using attack graphs to represent the possible attacker strategies and defender options. The defender's objective is to maximize the security of the network under a limited budget. In the literature, most network-interdiction models allow the attacker only one attempt; other models allow multiple attempts, but assume that any subsequent attempt begins at the point where the previous attempt failed. By contrast, in computer security, the attacker could be operating from the safety of a foreign country, and the cost of changing attack strategies may be quite low, so a new model is needed. To capture the ability of the attacker to launch multiple attempts, we represent the attacker's success on each arc of the attack graph probabilistically, and formulate the resulting problem as a multiple-stage stochastic network-interdiction problem. In the resulting game, the defender anticipates both the attacker's strategy choices, and their probabilities of success, and chooses which arcs in the attack graph to protect in order to defend against multiple attempted attacks. The attacker then launches an optimal attack against the system, knowing which arcs have been protected. If the attacker fails at the first attempt, a second-stage optimal strategy is chosen, based on a revised attack graph showing which arcs have been successfully traversed (with success probabilities of 1), and which arc failed (assumed to have success probability 0). We solve the resulting problem using multi-stage stochastic optimization with recourse, and explore the attacker's strategies.
