Game Theory Based Network Security

Abstract

The interactions between attackers and network administrator are modeled as a non-cooperative non-zero-sum dynamic game with incomplete information, which considers the uncertainty and the special properties of multi-stage attacks. The model is a Fictitious Play approach along a special game tree when the attacker is the leader and the administrator is the follower. Multi-objective optimization methodology is used to predict the attacker’s best actions at each decision node. The administrator also keeps tracking the attacker’s actions and updates his knowledge on the attacker’s behavior and objectives after each detected attack, and uses it to update the prediction of the attacker’s future actions. Instead of searching the entire game tree, appropriate time horizons are dynamically determined to reduce the size of the game tree, leading to a new, fast, adaptive learning algorithm. Numerical experiments show that our algorithm has a significant reduction in the damage of the network and it is also more efficient than other existing algorithms

Reinforcement Learning Algorithms for Adaptive Cyber Defense against Heartbleed

“…Non-cooperative game theory has been widely used to model the interdependency of defenders and attackers in; e.g., [12,13,14,15,16,19,21]. A number of algorithms have been proposed to compute Nash equilibrium and further infer the actions of attackers in; e.g., [2].…”

Game‐Theoretic Computing in Cyber‐Risk

“…Luo et al in 2010 published a noncooperative nondynamic game scenario with incomplete information [46]. Recently, problems in counterterrorism and corporate competition have prompted applied research that attempts to combine math-statistical risk analysis with game theory in ways that support practical decision making.…”

Vulnerability assessment of a food supply chain to an intentional attack

“…Robust stochastic models [10] have been developed to deal with incomplete information. Luo [11] used a multiobjective optimization methodology to predict the attacker's best action, assuming a sequential learning situation. Algorithms have been developed for situation assessment, given noise corrupted observations [12].…”