A dynamic games approach to proactive defense strategies against Advanced Persistent Threats in cyber-physical systems

Abstract

Advanced Persistent Threats (APTs) have recently emerged as a significant security challenge for Cyber-Physical Systems (CPSs) due to APTs' stealthy, dynamic and adaptive nature. The proactive dynamic defense provides a strategic and holistic security mechanism to increase costs of attacks and mitigate risks. This work proposes a dynamic game framework to model the long-term interaction between the stealthy attacker and the proactive defender. The stealthy and deceptive behaviors are captured by the multistage game of incomplete information, where each player has his own private information unknown to the other. Both players act strategically according to their beliefs which are formed by multistage observation and learning. The solution concept of Perfect Bayesian Nash Equilibrium (PBNE) provides a useful prediction of both players' policies because no players benefit from unilateral deviations from the equilibrium. We propose an iterative algorithm to compute the PBNE and use Tennessee Eastman process as a benchmark case study. Our numerical experiment corroborates the analytical results and provides further insights into the design of proactive defense-in-depth strategies.

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

“…We plot the feedback Bayesian learning process in Fig. 2 and elaborate each element in the following subsections based on our previous work [5].…”

“…Next, we update the belief at each stage based on the computed equilibrium strategy. We iterate the above update on the equilibrium strategy and belief until they satisfy condition C1 as demonstrated in [5]. If the type space is continuous, then the Bayesian update can be simplified into a parametric update under the conjugate prior assumption.…”

“…In this chapter, we illustrate three active defense schemes in our previous works, which are designed based on the new cyber security principle. They are defensive deception for detection and counter-deception [3,4,5] in Section 2, feedback-driven Moving Target Defense (MTD) [6] in Section 3, and adaptive honeypot engagement [7] in Section 4. All three schemes is of incomplete information, and we arrange them based on three progressive levels of information restrictions as shown in the left part of Fig.…”

Coordinated Cyber-Attack Detection Model of Cyber-Physical Power System Based on the Operating State Data Link

“…(2) Attack detection methods based on physical power grid data ignore the impact of cyber network attacks on the performance of smart grids. The effects of power grid failures and cyber-attacks on the physical side are similar, and it is difficult to distinguish them based on data characteristics (Liu et al, 2016;Huang and Zhu, 2020). (3) A cyber-attack is characterized by unbalanced attack samples, high data dimensionality, and noise, and data with a long tail are common.…”

Switched-Based Resilient Control of Cyber-Physical Systems

“…Another strategy is to use game-theoretic approaches such as [15] and [16]. These approaches have the advantage of providing proactive dynamic defenses.…”