Research Direction Introduction

Research Direction Introduction Advisor: Yeong-Sung Lin Presented by I-Ju Shih

Agenda • Introduction • Network Survivability • Problem Description

Introduction

Game theory • Game theory is a way to analyze interaction among a group of rational agents who behave strategically. • Game theory has been successfully applied in different areas as competition, biology, economics, political science, computer science, military strategy, and more.

Finitely repeated game • In recent years, the game theory has been applied in lots of network security issues. • In the real world, attackers and defenders frequentlyinteract repeatedly over time. • The interaction between attacker and defender could be viewed as an N-period game.

Non-cooperative game • Games are classified into two major classes: cooperative games and non-cooperative games. • In the context of information security, cyber attacker wouldnot cooperate with network defender. X

Incomplete information • In traditional non-cooperative games it is assumed that • 1. The players are rational. • 2. There are no enforceable agreements between players. • 3. The players know all the data of the game. • However,real-game situations may involve other types of uncertainty. • The players may lack complete information about other players or themselves.

Sequential game • Most past literature has focused on sequential games in which the defender moves first, since network defender will be able to deter cyber attacker or shift attack to unimportant target.

High availability • Users want their systems, for example hospitals, airplanes or computers, to be ready to serve them at all times. • High availability (HA) is a system design approach and associated service implementation that ensures a prearranged level of operational performance will be met during a contractual measurement period.

High availability • Highavailability (HA) clusters operate by harnessing redundant computers in groups or clusters that provide continued service when system components fail. • Highavailability (HA) clusters can sometimes becategorized into one of the following models: • Active/active • Active/passive • Highavailability (HA) cluster implementations attempt to build redundancy into a cluster to eliminate single point of failure.

Network Survivability

ADOD(Average Degree of Disconnectivity) • DOD (Degree of Disconnectivity) • Contest success function

DOD • The DOD (Degree of Disconnectivity) metric could be used to measure the damage degree of network. • Definition

DOD • OD pairs = 1 2 3 4

DOD • OD pairs = • DOD=3/6 1 2 3 4

DOD • OD pairs = • DOD=6/6 1 2 3 4

DOD • OD pairs = • DOD=10/6 1 2 3 4

DOD • OD pairs = • DOD=14/6 1 2 3 4

DOD • The larger number of the DOD value, the more damage degree of network would be.

Contest success function(CSF) • Skaperdas, S., 1996. Contest success functions. Economic Theory 7, 283–290. • Definition

ADOD example

ADOD (Average Degree of Disconnectivity) • The larger number of the Average DOD value is, the more damage degree of the network would be.

Problem Description

Defender versus Attacker

Objective • The network survivability is measured by ADOD. • The game has two players: an attacker (he, A)and a defender(she, D). • Defender • Objective - minimize the damage of the network (ADOD). • Budget Constraint -  deploying the defense budget in nodes  repairing the compromised node  releasing message in nodes • Attacker • Objective - maximize the damage of the network (ADOD). • Budget Constraint –  deploying the attack budget in nodes  updating information

Defender’s characteristics-Private information (Defender’s view) • The defender has private information,including each node’s valuation, each node’s type and network topology.

Defender’s characteristics-Private information (Attacker’s view) • The defender has private information,including each node’s valuation, each node’s type and network topology.

Defender’s characteristics • Effective resources: tm. • Resource reallocation, recycling and accumulation. • Each node’s type. • Bounded rationality. • High availability system.

Attacker’s characteristics • Attacker’s private information: attacker’s budget and something defender did not know. • Effective resources: Tm. • Resource growth:attacker could increase resources when the attacker compromised network nodes. • Resource accumulation. • Bounded rationality.

Defender’s action • In each round, the defender moves first, determines strategy and chooses message which may be truth, deception or secrecy to each node.

Message releasing • Message releasing can be classified into two types.  A node’s information could be divided into different parts to release message by the defender.  The defender could release a node’s defensive state as a message to the attacker.

Message releasing- type 1 • The defender could choose a part of information from a node according to his strategy which released truthful message, deceptive message or secrecy.

Message releasing- type 1 example • The defender chooses : 1. Truthful message if and only if message = actual information; 2. Secrecy if and only if message is secret; 3. Deceptive message if and only if message ≠ actual information. Cost: Deceptive message > Secrecy > Truthful message Defender OS: Linux FTP: Filezilla server DB: MYSQL Message OS: Linux FTP: Filezilla server DB: MYSQL Message OS: Win 7 FTP: Filezilla server DB: unknown

Message releasing- type 1 scenario (Defender's view in each round) The defender chose the part of information to release truth message The defender chose the part of information to use deception Keep the node’s part of information secret

Message releasing- type 2 • The defender released different message, which are truth, deception or secrecy, on each node as a mixed strategy. ?

Message releasing- type 2 scenario (Defender's view in each round) The defender’s actual strategy: Defense resource on node i Keep defender’s actual strategy secret The defender’s message: Defense resource on node i

Message releasing- type 2 scenario (Attacker's view in each round) The defender’s actual strategy: Defense resource on node i Keep defender’s actual strategy secret The defender’s message: Defense resource on node i

The effect of deception/secrecy • The effect of deception or secrecy would be discounted if the attacker knew defender’s partial private information.

The effect of deception/secrecy • The effect of deception or secrecy would be zero if the attacker knew something that the defender did not know.

Immune benefit • Although the attacker knows something that the defender did not know, the defender can update information after observing the result of each round’s contest. • After the defender updated information, she had immune benefit which means that the attacker was unable to use identical attack.

Defender’s resources • From the view of the defender, the budget could be reallocated or recycled but the discount factor is also considered. • The defender could accumulate resources to decrease attack success probability to defend network nodes in next time.

Defender’s resourcesexample – type 2 scenario Defender Reallocated Recycled Reallocated The defender’s actual strategy: Defense resource on node i Keep defender’s actual strategy secret The defender’s message: Defense resource on node i

Attacker’s information • The attacker knows only partial network topology. • The attacker could update information after observing the result of each round’s contest and defender’s messages.

Attacker’s resources • The attacker could accumulate experience to increase attack success probability to compromise network nodes in next time. • The attacker could increase resources when the attacker compromised network nodes. In the first round, the attacker put 3 units of attack budget to collect informationof node i. i In the second round, the attacker put 6 units of attack budget to attack node i. Total attack resource= 3*discount rate +6

Research Direction Introduction