Proactive Defense Strategy Design in Probabilistic Attack Graphs
摘要
This chapter investigates the design of proactive defense systems with joint detection and deception. We consider multi-stage attack modeled using a probabilistic attack graph. In this attack graph, the proactive defense design investigates how to optimally allocate detection and deception resources to detect, interdict, confuse, and distract the attacker from compromising critical assets in the system. The use of deceptive resources, including stealthy sensors and fake target systems, creates asymmetric information between the defender and the attacker. In particular, the defender knows that the attacker may misperceive the game dynamics (due to stealthy sensors) and utility functions (due to fake targets). We study how to leverage the joint effects of randomization and stealthy sensors to maximize the attack detection rate, given that the attacker best responds to evade detection but is oblivious to stealthy sensors. Then, we show that the effects of fake targets and defense countermeasures can be captured as a way to manipulate the attacker’s perceptual reward function. With insight from mechanism design, we develop optimization-based deceptive resource allocations to steer the attacker to behave in a way favored by the defender. We demonstrate the effectiveness of our method using experiments and provide our insights into defense mechanism design with deceptive resources.