A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

Abstract

With limited computing resources and a lack of physical lines of defense, the Internet of Things (IoT) has become a focus of cyberattacks. In recent years, outbreak propagation attacks against the IoT have occurred frequently, and these attacks are often strategical. In order to detect the outbreak propagation as soon as possible, t embedded Intrusion Detection Systems (IDSs) are widely deployed in the IoT. This paper tackles the problem of outbreak detection in adversarial environment in the IoT. A dynamic scheduling strategy based on specific IDSs monitoring of IoT devices is proposed to avoid strategic attacks. Firstly, we formulate the interaction between the defender and attacker as a Stackelberg game in which the defender first chooses a set of device nodes to activate, and then the attacker selects one seed (one device node) to spread the worms. This yields an extremely complex bilevel optimization problem. Our approach is to build a modified Column Generation framework for computing the optimal strategy effectively. The optimal response of the defender's problem is expressed as mixed-integer linear programming (MILPs). It is proved that the solution of the defender's optimal response is a NP-hard problem. Moreover, the optimal response of defenders is improved by an approximate algorithm-a greedy algorithm. Finally, the proposed scheme is tested on some randomly generated instances. The experimental results show that the scheme is effective for monitoring optimal scheduling.Sensors 2020, 20, 804 2 of 20 with IoT devices, such as the medical systems [7]. To detect the worm outbreak propagation as soon as possible, we can collect potential threat data by deploying specific embedded Intrusion Detection Systems (IDSs) in the IoT [8,9]. Therefore, the rapid detection of the worm outbreak propagation in the IoT with limited resources by IDS has become an urgent problem to be solved. Herein, such IoT devices with embedded IDS are collectively referred to as "sensors". The "scheduling strategy" mentioned in the following chapters of this paper is mainly aimed at methods of "sensor" combination opening. MotivationGenerally, the initiator of outbreak propagation is a malicious party, and our goal is to detect the outbreak propagation as soon as possible. For example, in a water network, the problem is where should we place a limited number of sensors to quickly detect contaminants [10][11][12][13][14], while in smart power grids, what is concerned about is finding the failure node in a short time [15]. It is natural in these scenarios to consider the problem of adversarial outbreak detection (AOD), where the defender can first select a set of nodes to deploy sensors, and subsequently the attacker can choose the source of infection to spread malicious information. Although there have been many studies on the AOD problem [11,15], the scenario setting of these works (e.g., a water network setting) is different from our scenario and assumptions (e.g., cybersecurity settings and parameters). A common assumption in the e...

Dynamic threshold strategy optimization for security protection in Internet of Things: An adversarial deep learning‐based game‐theoretical approach

“…Therefore, when defining the relevant income and objective function, we retain the form of previous work. 39 Given the mixed strategy of the defender and the pure strategy of the attacker, the expected defender's utility U D (x, A) is…”

“…27 CG algorithm can shorten the time to seek the optimal solution for enhancing the utility. In our previous work, 39 we also used the CG algorithm to solve similar problems. The following description and objective function construction will base on our previous work.…”

“…The following description and objective function construction will base on our previous work. 39 The following section describes the overall framework of the algorithm.…”

Strategic Remote Attestation: Testbed for Internet-of-Things Devices and Stackelberg Security Game for Optimal Strategies

“…For example, Wahab et al developed a Bayesian Stackelberg game that helps the defender to determine optimal detection load distribution strategy among virtual machines within a cloud environment [19]. As another example, Chen et al develops an SSG model that detects adversarial outbreak in an IoT environment through determining strategic dynamic scheduling of intrusion detection systems [6].…”

Bi-Layer Shortest-Path Network Interdiction Game for Internet of Things

“…NIP is also a useful model for researching the protection of IoT, e.g., the defensive resource allocation [15] and adversarial outbreak detection [19]. Numerous variations of NIP have been proposed and studied to meet different hypotheses under particular scenarios [16,17,[20][21][22][23][24].…”