The game-theoretic model and experimental investigation of cyber wargaming

Abstract

We demonstrate that game-theoretic calculations serve as a useful tool for assisting cyber wargaming teams in identifying useful strategies. We note a significant similarity between formulating cyber wargaming strategies and the methodology known in military practice as Course of Action (COA) generation. For scenarios in which the attacker must penetrate multiple layers in a defense-in-depth security configuration, an accounting of attacker and defender costs and penetration probabilities provides cost-utility payoff matrices and penetration probability matrices. These can be used as decision tools by both the defender and attacker. Inspection of the matrices allows players to deduce preferred strategies (or COAs) based on game-theoretical equilibrium solutions. The matrices also help in analyzing anticipated effects of potential human-based choices of wargame strategies and counterstrategies.We describe a mathematical game-theoretic formalism and offer detailed analysis of a table-top cyber wargame executed at the US Army Research Laboratory. Our analysis shows how game-theoretical calculations can provide an effective tool for decision-making during cyber wargames.

Cyberbiosecurity: A New Perspective on Protecting U.S. Food and Agricultural System

“…Moderate-sized agribusinesses, including many food processing companies and supporting industries, are vulnerable since cyber-attacks are often targeted against organizations with <100 employees (Geil et al, 2018). The Fd+Ag system includes military food production, such as the manufacturing of packaged meals for soldiers, which has a high potential for sabotage (Colbert et al, 2018). It is important to note that attackers need not know details of the food manufacturing process.…”

How to Measure Cyber-Resilience of a System With Autonomous Agents: Approaches and Challenges

“…Hence, game-theoretical approaches such as wargaming may fit the behavior of autonomous cyber-defenders and attackers. One example is offered in [11], which provides a formulation of the wargame that includes attacker and defender benefits, the probabilities of the attacker breaching defense layers, strategies, costs and utility for attacker and defender.…”

“…Hence, the computation of optimal defense strategies may be impractical, leading to sub-optimal solutions. Moreover, cyber wargaming, as proposed in [11], requires that experts estimate payoffs and probabilities. Obtaining expert estimates may be a difficult and expensive process that can result in subjective, inconsistent, and/or unreliable results as discussed in Section 2.2.…”

“…Cyber wargaming is not a universally-defined term [11] and sometimes is used interchangeably as red teaming. Both have been used in military planning and decisions for a long time [12], and both are used to denote antagonistic teams (red and blue) that compete with the purpose to evaluate the most effective defense strategies against known cyber-attacks.…”

Fog computing systems: State of the art, research issues and future trends, with a focus on resilience

“…In this way, the system designer should protect the processes of absorption and recovery after a threat so that these processes are less penalized by malicious actions. The work in [155] [156][144] propose GT to identify effective strategies against cyber-threats.…”