Optimal Timing in Dynamic and Robust Attacker Engagement During Advanced Persistent Threats

Abstract

Advanced persistent threats (APTs) are stealthy attacks which make use of social engineering and deception to give adversaries insider access to networked systems. Against APTs, active defense technologies aim to create and exploit information asymmetry for defenders. In this paper, we study a scenario in which a powerful defender uses honeynets for active defense in order to observe an attacker who has penetrated the network. Rather than immediately eject the attacker, the defender may elect to gather information. We introduce an undiscounted, infinite-horizon Markov decision process on a continuous state space in order to model the defender's problem. We find a threshold of information that the defender should gather about the attacker before ejecting him. Then we study the robustness of this policy using a Stackelberg game. Finally, we simulate the policy for a conceptual network. Our results provide a quantitative foundation for studying optimal timing for attacker engagement in network defense.

Modeling observability in adaptive systems to defend against advanced persistent threats

“…Work by Pawlick et al [22] is the most similar to our work, also balancing the defender's choice between evicting an attacker versus waiting for more information. Their approach uses an infinite horizon MDP, and the defender gains information about the attacker by keeping them in honeypots.…”

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

“…Previous works [18,19] have investigated the adaptive honeypot deployment to effectively engage attackers without their notices. The authors in recent work [20] proposes a continuous-state Markov Decision Process (MDP) model and focuses on the optimal timing of the attacker ejection.…”

Deceptive Reinforcement Learning Under Adversarial Manipulations on Cost Signals

“…The topic of defensive deception has bee surveyed in [17], which includes a taxonomy of deception mechanisms and a review of game-theoretic models. Game and decision-theoretic models for deception have been studied in various contexts [12,27], including honeypots [16,18], adversarial machine learning [25,26], moving target defense [8,28], and cyber-physical control systems [15,19,20,29]. In this work, we extend the paradigm of cyber deception to reinforcement learning and establish a theoretical foundation for understanding the impact and the fundamental limits of such adversarial behaviors.…”