Visible to the public "Stealthy attacks meets insider threats: A three-player game model"Conflict Detection Enabled

Title"Stealthy attacks meets insider threats: A three-player game model"
Publication TypeConference Paper
Year of Publication2015
AuthorsX. Feng, Z. Zheng, P. Hu, D. Cansever, P. Mohapatra
Conference NameMILCOM 2015 - 2015 IEEE Military Communications Conference
Date PublishedOct
ISBN Number978-1-5090-0073-9
Accession Number15666092
Keywordsadvanced persistent threat, Computational modeling, computer security, cyber security, Face, game theory, Games, insider threats, Numerical models, pubcrawl170101, Real-time Systems, security of data, stealthy attacks, three-player attacker-defender insider game, three-player game model, two-player FlipIt game model

Advanced persistent threat (APT) is becoming a major threat to cyber security. As APT attacks are often launched by well funded entities that are persistent and stealthy in achieving their goals, they are highly challenging to combat in a cost-effective way. The situation becomes even worse when a sophisticated attacker is further assisted by an insider with privileged access to the inside information. Although stealthy attacks and insider threats have been considered separately in previous works, the coupling of the two is not well understood. As both types of threats are incentive driven, game theory provides a proper tool to understand the fundamental tradeoffs involved. In this paper, we propose the first three-player attacker-defender-insider game to model the strategic interactions among the three parties. Our game extends the two-player FlipIt game model for stealthy takeover by introducing an insider that can trade information to the attacker for a profit. We characterize the subgame perfect equilibria of the game with the defender as the leader and the attacker and the insider as the followers, under two different information trading processes. We make various observations and discuss approaches for achieving more efficient defense in the face of both APT and insider threats.

Citation Key7357413