Evaluating Moving Target Defense with PLADD

Jones, Stephen T.; Outkin, Alexander V.; Gearhart, Jared Lee; Hobbs, Jacob Aaron; Siirola, John Daniel; Phillips, Cynthia A.; Verzi, Stephen Joseph; Tauritz, Daniel R.; Mulder, Samuel A.; Naugle, Asmeret Bier

doi:10.2172/1222986

Cited by 16 publications

(6 citation statements)

References 16 publications

(26 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A GPLADD game consists of multiple PLADD games (defined in [19]) connected by a graph structure and other elements. A PLADD game is a contest for control of a single resource by the attacker and the defender.…”

Section: Approachmentioning

confidence: 99%

Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data

Outkin¹,

Schulz²,

Schulz³

et al. 2021

Preprint

View full text Add to dashboard Cite

Protecting against multi-step attacks of uncertain duration and timing forces defenders into an indefinite, always ongoing, resource-intensive response. To effectively allocate resources, a defender must be able to analyze multi-step attacks under assumption of constantly allocating resources against an uncertain stream of potentially undetected attacks. To achieve this goal, we present a novel methodology that applies a game-theoretic approach to the attack, attacker, and defender data derived from MITRE´s ATT&CK ® Framework. Time to complete attack steps is drawn from a probability distribution determined by attacker and defender strategies and capabilities. This constraints attack success parameters and enables comparing different defender resource allocation strategies. By approximating attacker-defender games as Markov processes, we represent the attacker-defender interaction, estimate the attack success parameters, determine the effects of attacker and defender strategies, and maximize opportunities for defender strategy improvements against an uncertain stream of attacks. This novel representation and analysis of multi-step attacks enables defender policy optimization and resource allocation, which we illustrate using the data from MITRE´s APT3 ATT&CK ® Evaluations.

show abstract

Section: Approachmentioning

confidence: 99%

Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data

Outkin¹,

Schulz²,

Schulz³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Some scholars have used FlipIt to study MTD. Jones et al destroyed the attack knowledge by allowing the defender to "mutate" the system, and they extended FlipIt to MTD [18]. Prakesh et al used multitarget detection resource control to study the MTD [19].…”

Section: Basic Principles Of Gamementioning

confidence: 99%

Optimal Timing Selection Approach to Moving Target Defense: A FlipIt Attack-Defense Game Model

Jian-cheng

Zhang

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

The centralized control characteristics of software-defined networks (SDNs) make them susceptible to advanced persistent threats (APTs). Moving target defense, as an effective defense means, is constantly developing. It is difficult to effectively characterize an MTD attack and defense game with existing game models and effectively select the defense timing to balance SDN service quality and MTD decision-making benefits. From the hidden confrontation between the actual attack and defense sides, existing attack-defense scenarios are abstractly characterized and analyzed. Based on the APT attack process of the Cyber Kill Chain (CKC), a state transition model of the MTD attack surface based on the susceptible-infective-recuperative-malfunctioned (SIRM) infectious disease model is defined. An MTD attack-defense timing decision model based on the FlipIt game (FG-MTD) is constructed, which expands the static analysis in the traditional game to a dynamic continuous process. The Nash equilibrium of the proposed method is analyzed, and the optimal timing selection algorithm of the MTD is designed to provide decision support for the selection of MTD timing under moderate security. Finally, the application model is used to verify the model and method. Through numerical analysis, the timings of different types of attack-defense strategies are summarized.

show abstract

“…He pointed out that the effectiveness of MTD defense depends on the ability of attack detection, but his game process only considers probe attack and reimage defense, which is difficult to reflect the general law of MTD defense. Jones et al, " [25] proposed a novel MTD game model PLADD (probabilistic learning attacker, dynamic defender) to improve Flipit. He focused on the analysis of the probability density of time to success and the impact of different types of defense strategies on game payoff.…”

Section: Related Workmentioning

confidence: 99%

SOCMTD: Selecting Optimal Countermeasure for Moving Target Defense Using Dynamic Game

Hu¹,

Liu²,

Jian-cheng³

et al. 2020

KSII TIIS

View full text Add to dashboard Cite

Moving target defense, as a 'game-changing' security technique for network warfare, realizes proactive defense by increasing network dynamics, uncertainty and redundancy. How to select the best countermeasure from the candidate countermeasures to maximize defense payoff becomes one of the core issues. In order to improve the dynamic analysis for existing decision-making, a novel approach of selecting the optimal countermeasure using game theory is proposed. Based on the signal game theory, a multi-stage adversary model for dynamic defense is established. Afterwards, the payoffs of candidate attack-defense strategies are quantified from the viewpoint of attack surface transfer. Then the perfect Bayesian equilibrium is calculated. The inference of attacker type is presented through signal reception and recognition. Finally the countermeasure for selecting optimal defense strategy is designed on the tradeoff between defense cost and benefit for dynamic network. A case study of attack-defense confrontation in small-scale LAN shows that the proposed approach is correct and efficient.

show abstract

Evaluating Moving Target Defense with PLADD

Cited by 16 publications

References 16 publications

Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data

Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data

Optimal Timing Selection Approach to Moving Target Defense: A FlipIt Attack-Defense Game Model

SOCMTD: Selecting Optimal Countermeasure for Moving Target Defense Using Dynamic Game

Contact Info

Product

Resources

About