Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

Zhu, Mu; Anwar, Ahmed H.; Wan, Zelin; Cho, Jin-Hee; Kamhoua, Charles A.; Singh, Munindar P.

doi:10.48550/arxiv.2101.10121

Cited by 3 publications

(6 citation statements)

References 159 publications

(462 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When the deception strategy is used in the defender mode, it is generally called defensive deception technology. This will prevent the attackers from [14].…”

Section: Defensive Deception Technologymentioning

confidence: 99%

Deception Technology Based Intrusion Protection and Detection Mechanism for Digital Substations: A Game Theoretical Approach

Jay¹

2023

IEEE Access

View full text Add to dashboard Cite

Securing substations from cyber attacks is essential to safeguard critical power infrastructure. However, digital substations that are based on the IEC-61850 standard have Generic Object Oriented Substation Events (GOOSE) messages and Sampled Value (SV) messages that are time-critical and thus cannot be protected using encryption techniques. This work presents a study on deception technology (decoys) for mitigating cyber attacks on GOOSE message virtual LAN (VLAN) which is a non-observable strongly connected biography. In this paper, the deployment of defender decoys is proposed by defining observable subgraphs in the VLAN. The defender-attacker interaction is modeled as a single-leader singlefollower game with the defender as the leader. The optimal allocation of decoys for asset protection and attack detection is then formulated as a bi-level optimisation problem. Simultaneous allocation and sequential allocation of protection and detection decoys are considered for defender resource allocation. The existence of equilibrium of the defender-attacker game is proven. The model is illustrated in a 3-IED VLAN and performance is evaluated in a 12-IED VLAN system in the PSRC-I5 protection relay report. The results are compared with the zero-sum game model and it is found that the proposed model is capable of mitigating attacks in the GOOSE VLAN INDEX TERMS Deception technology, IEC-61850 standard, intrusion protection mechanism, intrusion detection mechanism, single-leader single-follower game. NOMENCLATURE VARIABLESDEVIKA JAY (Member, IEEE) received the B.Tech. degree in electrical and electronics engineering from the TKM College of Engineering, Kerala, India, in 2009, and the M.S. degree in power systems and the Ph.D. degree from the Indian Institute of Technology Madras, in 2013 and 2021, respectively. She was the Deputy Manager with Power Grid Corporation of India Ltd. She is currently the Founder and the CTO with Gridsentry Private Ltd. Her research interests include powergrid cybersecurity, power system economics, electricity markets, the application of game theory, and artificial intelligence in power system operation.

show abstract

“…When the deception strategy is used in the defender mode, it is generally called defensive deception technology. This will prevent the attackers from [14].…”

Section: Defensive Deception Technologymentioning

confidence: 99%

Deception Technology Based Intrusion Protection and Detection Mechanism for Digital Substations: A Game Theoretical Approach

Jay¹

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…On the other hand, Honey-X and decoys perform reactive induction and isolation by manipulating, abusing, or misleading the attacker's cognitive aspects. Obfuscation is another separate study area, and its crucial difference is that it is closely related to the achievement of security goals at the data level [6].…”

Section: Related Workmentioning

confidence: 99%

“…In addition, macroscopically upgrading MTD strategies to maximize defenders' gains by minimizing performance degradation and maximizing security, and to minimize attackers' gains such as lateral movement and successful capture of the target host is also a main goal. Characteristically, the previous studies can be divided into 'general game-theoretic studies', 'Bayesian Stackelberg game-theoretic studies', and 'stochastic game-theoretic studies' [6,12,13].…”

Section: Game-enabled Defensive Deception Techniques With Mtdmentioning

confidence: 99%

“…As a lightweight counter-measure to mitigate the spatiotemporal defender inferiority issue of IoT systems, and to protect and defend IoT systems against potential advanced persistent threat (APT) attacks, defensive cyber deception techniques [6][7][8] were introduced. Defensive cyber deception techniques are non-cooperative decision-making pollution techniques that mislead potential attackers' cognitive perspectives, deceiving the attackers…”

Section: Introductionmentioning

confidence: 99%

“…When continuing the search and the access or attack seem impossible, carry out pivoting to another meter within the same sub-farm network or change the intrusion route to another farm network → achieve the intrusion into the power meter and final occupation. (6) Defender's major defense sequences and normalization strategy: Force defender dominant deceiving, disturbing, and isolating actions with MTD based on shuffling by each of the entire IoT nodes and decoying based on multitenancy sandbox → carry out reinforced monitoring and detection of multiplexed UTM and firewall → carry out reactive blocking and expulsion of the IoT attacker that intruded any sub-farm network in parallel → achieve complete expulsion from the upper network.…”

mentioning

confidence: 99%

See 2 more Smart Citations

IoDM: A Study on a IoT-Based Organizational Deception Modeling with Adaptive General-Sum Game Competition

Seo

Kim

2022

Electronics

View full text Add to dashboard Cite

Moving target defense (MTD) and decoy strategies, measures of active defense, were introduced to secure both the proactive security and reactive adaptability of internet-of-things (IoT) networks that have been explosively applied to various industries without any strong security measures and to mitigate the side effects of threats. However, the existing MTD and decoy strategies are limited to avoiding the attacker’s reconnaissance and initial intrusion attempts through simple structural mutations or inducing the attackers to a static trap based on the deceptive path and lack approaches to adaptively optimize IoT in consideration of the unique characteristic information by the domain of IoT. Game theory-based and decoy strategies are other options; however, they do not consider the dynamicity and uncertainty of the decision-making stages by the organizational agent related to the IoT domains. Therefore, in this paper, we present a type of organizational deception modeling, namely IoT-based organizational deception modeling (IoDM), which considers both the dynamic topologies and organizational business fingerprints customized in the IoT domain and operational purpose. For this model, we considered the practical scalability of the existing IoT-enabled MTD and decoy concepts and formulated the partially incomplete deceptive decision-making modeling for the cyber-attack and defense competition for IoT in real-time based on the general-sum game. According to our experimental results, the efficiency of the deceptive defense of the IoT defender could be improved by 70% on average while deriving the optimal defense cost compared to the increased defense performance. The findings of this study will improve the deception performances of MTD and decoy strategies by IoT scenarios related to various operational domains such as smart home networks, industrial networks, and medical networks. To the best of our knowledge, this study has employed social-engineering IoT knowledge and general-sum game theory for the first time.

show abstract

D3GF: A Study on Optimal Defense Performance Evaluation of Drone-Type Moving Target Defense Through Game Theory

Seo¹,

Moon²,

Lee³

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Based on the paradigm shift in modern warfare, ground forces conduct pilot operations of wireless unmanned maneuvering systems, such as tactical drones, in the form of manned and unmanned cooperative tactics after deploying the relevant systems in the battlefield. However, security considerations for relevant systems are limited to the scope of using only the existing end-to-end encryption and public key authentication modules, and no defense strategy to actively respond to specialized cyber-electronic warfare threats has been officially established. To drastically reduce both the potential attack surface and security vulnerabilities of drones employed in network-centric-warfare, a proactive defense technology that expires the effectiveness of attacks by avoiding invasive action at the target is expected to be essential. Accordingly, this paper proposes the concept of active moving-target-defense (MTD), an element of cyber deception that minimizes the rate of success of cyber-attacks while conversely maximizing both defense predominance and attack complexity asymmetrically, exclusive according to partially observable Markov decision process (POMDP)-based threat modeling that considers both the internal and external operation sequences of target drones. To optimally design the proposed drone-type MTD based on the Pareto frontier, we additionally advanced and simulated a drone-based defensive deception game framework (D3GF), which represents a general-sum combat framework reflecting decision logics such as the perfect Bayesian Nash equilibrium, stochastic Stackelberg, and partial signal game. This study was conducted to compare and calculate the efficiencies of the drone-type MTD's deceptive defense, which had not been considered in prior studies, by unique environmental features inside and outside the drone. Furthermore, we conducted a detailed performance evaluation considering game metrics based on sensitivity analysis. Hereafter, the drone-type MTD will be extended into an actual active drone protection technology combining cyber flare-type avoidance strategies and cyber camouflage-type disarrangement strategies by expanding its optimization domain as a hypergame, while integrating it with drone decoy elements.

show abstract

Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

Cited by 3 publications

References 159 publications

Deception Technology Based Intrusion Protection and Detection Mechanism for Digital Substations: A Game Theoretical Approach

Deception Technology Based Intrusion Protection and Detection Mechanism for Digital Substations: A Game Theoretical Approach

IoDM: A Study on a IoT-Based Organizational Deception Modeling with Adaptive General-Sum Game Competition

D3GF: A Study on Optimal Defense Performance Evaluation of Drone-Type Moving Target Defense Through Game Theory

Contact Info

Product

Resources

About