Visible to the public Optimal Timing in Dynamic and Robust Attacker Engagement During Advanced Persistent Threats

TitleOptimal Timing in Dynamic and Robust Attacker Engagement During Advanced Persistent Threats
Publication TypeConference Paper
Year of Publication2019
AuthorsPawlick, Jeffrey, Nguyen, Thi Thu Hang, Colbert, Edward, Zhu, Quanyan
Conference Name2019 International Symposium on Modeling and Optimization in Mobile, Ad Hoc, and Wireless Networks (WiOPT)
Keywordsadvanced persistent threat, APT, APT attack, attacker engagement, Games, Human Behavior, Markov Decision Process, Markov processes, Metrics, pubcrawl, resilience, Resiliency, Robustness, Scalability, security, Sensors, Silicon, Stackelberg game, Timing
AbstractAdvanced persistent threats (APTs) are stealthy attacks which make use of social engineering and deception to give adversaries insider access to networked systems. Against APTs, active defense technologies aim to create and exploit information asymmetry for defenders. In this paper, we study a scenario in which a powerful defender uses honeynets for active defense in order to observe an attacker who has penetrated the network. Rather than immediately eject the attacker, the defender may elect to gather information. We introduce an undiscounted, infinite-horizon Markov decision process on a continuous state space in order to model the defender's problem. We find a threshold of information that the defender should gather about the attacker before ejecting him. Then we study the robustness of this policy using a Stackelberg game. Finally, we simulate the policy for a conceptual network. Our results provide a quantitative foundation for studying optimal timing for attacker engagement in network defense.
DOI10.23919/WiOPT47501.2019.9144123
Citation Keypawlick_optimal_2019