Moving Target Defense for Internet of Things Based on the Zero-Determinant Theory

Wang, Shengling; Hong-wei, Shi; Hu, Qin; Lin, Bin; Cheng, Xiuzhen

doi:10.1109/jiot.2019.2943151

Cited by 31 publications

(25 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Next, the partial signal game-based PBNE in the game environment based on OD and OA is generally summarized as shown in Equations ( 12)-( 15) based on Equations (10) and (11). In this case, P D in Equation (12), which is similarly constructed based on OPT2, is the prior probability-based defender's judgment probability for SS N A -related TS N D . P D in Equation ( 13) is the defender's inference probability based on the posterior probability related to SS N D reconstructed based on the updated internal deception-defense strategy after the feedback-based signaling of the defender for SS N A .…”

Section: Configuration and Optimization Of Zero-sum-based Attack-defe...mentioning

confidence: 99%

“…These can interact with each other to mislead attackers based on the network or system level depending on the defender's intention. MTD has been combined with decisionmaking strategies among decision-making entities in areas such as game theory [11][12][13][14], MDP (Markov decision process) [15][16][17][18], and machine learning [19][20][21][22]. It has also been combined with the learning theory for benefit optimization between attacks and defenses to achieve diverse optimized mutation strategies and deception thresholds while attenuating effects of intrusion by cyber kill chain (CKC) [23] stage and surface spaces.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

SOD2G: A Study on a Social-Engineering Organizational Defensive Deception Game Framework through Optimization of Spatiotemporal MTD and Decoy Conflict

Seo

Kim

2021

Electronics

View full text Add to dashboard Cite

Existing moving target defense (MTD) and decoy systems are conceptually limited in avoiding and preventing attackers’ social-engineering real-time attacks by organization through either structural mutations or induction and isolation only using static traps. To overcome the practical limitations of existing MTD and decoy and to conduct a multi-stage deception decision-making in a real-time attack-defense competition, the current work presents a social-engineering organizational defensive deception game (SOD2G) as a framework, consi dering hierarchical topologies and fingerprint characteristics by organization. The present work proposed and applied deception concepts and zero-sum-based two-player game models as well as attacker and defender decision-making process based on deceivable organizational environments and vulnerability information. They were designed in consideration of limited organizational resources so that they could converge in the positive direction to secure organizational defender dominant share and optimal values of the defender deception formulated by both scenario and attribute. This framework could handle incomplete private information better than existing models and non-sequentially stratified, and also contributed to the configuration of the optimal defender deception strategy. As the experimental results, they could increase the deception efficiency within an organization by about 40% compared to existing models. Also, in the sensitivity analysis, the proposed MTD and decoy yielded improvements of at least 60% and 30% in deception efficiency, respectively, compared to the existing works.

show abstract

Section: Configuration and Optimization Of Zero-sum-based Attack-defe...mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

SOD2G: A Study on a Social-Engineering Organizational Defensive Deception Game Framework through Optimization of Spatiotemporal MTD and Decoy Conflict

Seo

Kim

2021

Electronics

View full text Add to dashboard Cite

show abstract

“…Threat modeling technology has also progressed toward the modeling of the cost and efficiency of each choice made in the relationship between the attacker and the defender through fusion efforts with game theory. Wang et al [29] proposed a Moving Target Defense (MTD) technique that modeled the interaction between a general device and an attacker using a Markov game in a distributed network environment, in this case the IoT environment, and determined the optimal behavior based on a zero-determinant factor. Sengupta et al [30] proposed a method for deriving an optimal MTD technique by modeling a strategy based on a general sum Markov game for Advanced Persistent Threat (APT) attacks in a cloud computing environment.…”

Section: Threat Modeling and Cyber Threat Intelligencementioning

confidence: 99%

Cyber Threat Intelligence Framework for Incident Response in an Energy Cloud Platform

Gong

Lee

2021

Electronics

View full text Add to dashboard Cite

Advanced information technologies have transformed into high-level services for more efficient use of energy resources through the fusion with the energy infrastructure. As a part of these technologies, the energy cloud is a technology that maximizes the efficiency of energy resources through the organic connection between the entities that produce and consume the energy. However, the disruption or destruction of energy cloud systems through cyberattacks can lead to incidents such as massive blackouts, which can lead to national disasters. Furthermore, since the technique and severity of modern cyberattacks continue to improve, the energy cloud environment must be designed to resist cyberattacks. However, since the energy cloud environment has different characteristics from general infrastructures such as the smart grid and the Advanced Metering Infrastructure (AMI), it requires security technology specialized to its environment. This paper proposes a cyber threat intelligence framework to improve the energy cloud environment’s security. Cyber Threat Intelligence (CTI) is a technology to actively respond to advanced cyber threats by collecting and analyzing various threat indicators and generating contextual knowledge about the cyber threats. The framework proposed in this paper analyzes threat indicators that can be collected in the advanced metering infrastructure and proposes a cyber threat intelligence generation technique targeting the energy cloud. This paper also proposes a method that can quickly apply a security model to a large-scale energy cloud infrastructure through a mechanism for sharing and spreading cyber threat intelligence between the AMI layer and the cloud layer. Our framework provides a way to effectively apply the proposed technologies through the CTI architecture, including the local AMI layer, the station layer, and the cloud layer. Furthermore, we show that the proposed framework can effectively respond to cyber threats by showing a 0.822 macro-F1 score and a 0.843 micro-F1 score for cyberattack detection in an environment that simulates a model of an attacker and an energy cloud environment.

show abstract

“…A large part of this work is based on game theory and attempts to find equilibria in the presence of attackers and defenders of a certain skill or optimize defense and attack strategies. These approaches comprise Stackelberg Games [1,38], Zero-Determinant Theory [40], empirical game-theoretic analysis [36], Markov modeling [18,27,30,41,42], as well as stochastic petri nets [7,14]. However, none of them attempt to determine a given technique's real effects.…”

Section: Related Workmentioning

confidence: 99%

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Bajic

Becker²

2021

Int. J. Inf. Secur.

View full text Add to dashboard Cite

With numbers of exploitable vulnerabilities and attacks on networks constantly increasing, it is important to employ defensive techniques to protect one’s systems. A wide range of defenses are available and new paradigms such as Moving Target Defense (MTD) rise in popularity. But to make informed decisions on which defenses to implement, it is necessary to evaluate their effectiveness first. In many cases, the full impact these techniques have on security is not well understood yet. In this paper we propose network defense evaluation based on detailed attack simulation. Using a flexible modeling language, networks, attacks, and defenses are described in high detail, yielding a fine-grained scenario definition. Based on this, an automated instantiator generates a wide range of realistic benchmark networks. These serve to perform simulations, allowing to evaluate the security impact of different defenses, both quantitatively and qualitatively. A case study based on a mid-sized corporate network scenario and different Moving Target Defenses illustrates the usefulness of this approach. Results show that virtual machine migration, a frequently suggested MTD technique, more often degrades than improves security. Hence, we argue that evaluation based on realistic attack simulation is a qualified approach to examine and verify claims of newly proposed defense techniques.

show abstract

Moving Target Defense for Internet of Things Based on the Zero-Determinant Theory

Cited by 31 publications

References 14 publications

SOD2G: A Study on a Social-Engineering Organizational Defensive Deception Game Framework through Optimization of Spatiotemporal MTD and Decoy Conflict

SOD2G: A Study on a Social-Engineering Organizational Defensive Deception Game Framework through Optimization of Spatiotemporal MTD and Decoy Conflict

Cyber Threat Intelligence Framework for Incident Response in an Energy Cloud Platform

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Contact Info

Product

Resources

About