Computing the Nash Equilibria of Intruder Classification Games

Dritsoula, Lemonia; Loiseau, Patrick; Musacchio, John

doi:10.1007/978-3-642-34266-0_5

Cited by 10 publications

(10 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Section: Introductionmentioning

confidence: 77%

“…A subset of our results appeared in earlier versions of this paper [19], [20], in a simplified setting. Indeed, in [19], [20] we consider that the attack is characterized by a scalar quantity rather than a vector and impose the use of threshold strategies for the defender. Instead, here, we allow more flexibility by considering attack vectors of arbitrary dimension and considering the set of all possible classifiers and we prove that, at Nash equilibrium, the defender uses only threshold strategies on the attacker's reward (which is one of our main result).…”

Section: Introductionmentioning

confidence: 77%

See 1 more Smart Citation

A Game-Theoretic Analysis of Adversarial Classification

Dritsoula

Loiseau

Musacchio

2017

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

Attack detection is usually approached as a classification problem. However, standard classification tools often perform poorly because an adaptive attacker can shape his attacks in response to the algorithm. This has led to the recent interest in developing methods for adversarial classification, but to the best of our knowledge, there have been very few prior studies that take into account the attacker's tradeoff between adapting to the classifier being used against him with his desire to maintain the efficacy of his attack. Including this effect is key to derive solutions that perform well in practice.In this investigation we model the interaction as a game between a defender who chooses a classifier to distinguish between attacks and normal behavior based on a set of observed features and an attacker who chooses his attack features (class 1 data). Normal behavior (class 0 data) is random and exogenous. The attacker's objective balances the benefit from attacks and the cost of being detected while the defender's objective balances the benefit of a correct attack detection and the cost of false alarm. We provide an efficient algorithm to compute all Nash equilibria and a compact characterization of the possible forms of a Nash equilibrium that reveals intuitive messages on how to perform classification in the presence of an attacker. We also explore qualitatively and quantitatively the impact of the non-attacker and underlying parameters on the equilibrium strategies.

show abstract

Section: Introductionmentioning

confidence: 77%

Section: Introductionmentioning

confidence: 77%

A Game-Theoretic Analysis of Adversarial Classification

Dritsoula

Loiseau

Musacchio

2017

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

show abstract

“…The authors investigate the existence of a unique Nash equilibrium and best-response strategies under specific cost functions, and analyze long-term interactions using repeated games and a dynamic model. As another example, Dritsoula et al consider the problem of setting a threshold for classifying an attacker into one of two categories, spammer and spy, based on its intrusion attempts [32]. They give a characterization of the Nash equilibria in mixed strategies, and show that the equilibria can be computed in polynomial time.…”

Section: Configuration Of Detectorsmentioning

confidence: 99%

Detection and mitigation of attacks on transportation networks as a multi-stage security game

Lászka

Abbas

Vorobeychik

et al. 2019

Computers & Security

View full text Add to dashboard Cite

In recent years, state-of-the-art traffic-control devices have evolved from standalone hardware to networked smart devices. Smart traffic control enables operators to decrease traffic congestion and environmental impact by acquiring real-time traffic data and changing traffic signals from fixed to adaptive schedules. However, these capabilities have inadvertently exposed traffic control to a wide range of cyber-attacks, which adversaries can easily mount through wireless networks or even through the Internet. Indeed, recent studies have found that a large number of traffic signals that are deployed in practice suffer from exploitable vulnerabilities, which adversaries may use to take control of the devices. Thanks to the hardware-based failsafes that most devices employ, adversaries cannot cause traffic accidents directly by setting compromised signals to dangerous configurations. Nonetheless, an adversary could cause disastrous traffic congestion by changing the schedule of compromised traffic signals, thereby effectively crippling the transportation network. To provide theoretical foundations for the protection of transportation networks from these attacks, we introduce a game-theoretic model of launching, detecting, and mitigating attacks that tamper with traffic-signal schedules. We show that finding optimal strategies is a computationally challenging problem, and we propose efficient heuristic algorithms for finding near optimal strategies. We also introduce a Gaussian-process based anomaly detector, which can alert operators to ongoing attacks. Finally, we evaluate our algorithms and the proposed detector using numerical experiments based on the SUMO traffic simulator.

show abstract

“…[19] & [20] discuss such scenarios where the inquiry into the nature and motivation of the attacker are discussed.…”

Section: Game Analysismentioning

confidence: 99%

“…For better visualization purpose we plot rewards for 10 strategies (whose results are representative of the results with larger range) to cover the aggression, with steps of 0.1 from 0 to 0.9 in Figures 8-10. 20 The simulation was conducted with three user profiles in terms of skill, sophistication and effectiveness as Below_Average, Average and Above_Average users. When in Low_Privilege_State, the Average user would attack and the Administrator defends, playing the perfect antagonizing, there is 0.5 probability that attack succeeds.…”

Section: Simulationmentioning

confidence: 99%

On a Generic Security Game Model

Shandilya¹,

Shiva²

2017

IJCNS

View full text Add to dashboard Cite

To protect the systems exposed to the Internet against attacks, a security system with the capability to engage with the attacker is needed. There have been attempts to model the engagement/interactions between users, both benign and malicious, and network administrators as games. Building on such works, we present a game model which is generic enough to capture various modes of such interactions. The model facilitates stochastic games with imperfect information. The information is imperfect due to erroneous sensors leading to incorrect perception of the current state by the players. To model this error in perception distributed over other multiple states, we use Euclidean distances between the outputs of the sensors. We build a 5-state game to represent the interaction of the administrator with the user. The states correspond to 1) the user being out of the system in the Internet, and after logging in to the system; 2) having low privileges; 3) having high privileges; 4) when he successfully attacks and 5) gets trapped in a honeypot by the administrator. Each state has its own action set. We present the game with a distinct perceived action set corresponding to each distinct information set of these states. The model facilitates stochastic games with imperfect information. The imperfect information is due to erroneous sensors leading to incorrect perception of the current state by the players. To model this error in perception distributed over the states, we use Euclidean distances between outputs of the sensors. A numerical simulation of an example game is presented to show the evaluation of rewards to the players and the preferred strategies. We also present the conditions for formulating the strategies when dealing with more than one attacker and making collaborations.

show abstract

Computing the Nash Equilibria of Intruder Classification Games

Cited by 10 publications

References 6 publications

A Game-Theoretic Analysis of Adversarial Classification

A Game-Theoretic Analysis of Adversarial Classification

Detection and mitigation of attacks on transportation networks as a multi-stage security game

On a Generic Security Game Model

Contact Info

Product

Resources

About