Cyber Camouflage Games for Strategic Deception

Abstract

The rapid increase in cybercrime, causing a reported annual economic loss of $600 billion (Lewis 2018), has prompted a critical need for effective cyber defense. Strategic criminals conduct network reconnaissance prior to executing attacks to avoid detection and establish situational awareness via scanning and fingerprinting tools. Cyber deception attempts to foil these reconnaissance efforts by camouflaging network and system attributes to disguise valuable information. Game-theoretic models can identify decisions about strategically deceiving attackers, subject to domain constraints. For effectively deploying an optimal deceptive strategy, modeling the objectives and the abilities of the attackers, is a key challenge. To address this challenge, we present Cyber Camouflage Games (CCG), a general-sum game model that captures attackers which can be diversely equipped and motivated. We show that computing the optimal defender strategy is NP-hard even in the special case of unconstrained CCGs, and present an efficient approximate solution for it. We further provide an MILP formulation accelerated with cut-augmentation for the general constrained problem. Finally, we provide experimental evidence that our solution methods are efficient and effective.

Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

“…Thakoor et al [132] introduced a general-sum game, named Cyber Camouflage Games (CCGs), to model the interactions between a defender and an attacker performing reconnaissance attacks. The defender can mask the machine in the network with fake information, such as an operating system, to mitigate the effect of reconnaissance attacks.…”

“…• Utility [14,15,13,12,37,49,65,73,75,81,96,97,99,101,100,106,107,111,114,122,132,133,137,141,153,155]:…”

“…As a result, some of these studies considered the impact to normal as another cost of deception technology [114,137]. A defender's expected utility is a common metric to be maximized as the system's objective, as shown in game-theoretic or ML-based DD techniques in [5,7,65,73,75,81,85,96,100,106,107,111,122,132,133,141,153,155].…”

To Signal or Not To Signal: Exploiting Uncertain Real-Time Information in Signaling Games for Security and Sustainability

“…Among the rich literature of Stackelberg security games (SSGs) (Tambe 2011;Bucarey et al 2017), SSGs with realtime information have been studied recently. Some recent work in deception for cybersecurity, such as (Cooney et al 2019;Thakoor et al 2019), considers strategic signaling with boundedly rational attackers and attackers with different objectives and abilities, but no sensing is required to identify attackers; rather, the systems may interact with both normal and adversarial users. Some other work relies on human patrollers for real-time information (Zhang et al 2019;Wang et al 2019), and others rely on sensors that can notify the patroller when an opponent is detected (de Cote et al 2013;Basilico, De Nittis, and Gatti 2015;De Nittis and Gatti 2018).…”

Decoy Allocation Games on Graphs with Temporal Logic Objectives

“…Security games [24,15] are another class of important models for resource allocation in adversarial environments. In [25], the authors formulate a security game (Stackelberg game) to allocate limited decoy resources in a cybernetwork to mask network configurations from the attacker. This class of deception manipulates the adversary's perception of the payoffs and thus causes the adversary to take (or not to take) certain actions that aid the objective of the defender.…”