Download
1 / 31
310 likes | 441 Vues
Harrison C. Schramm David L. Alderson W. Matthew Carlyle Nedialko B. Dimitrov. A Game Theoretic Model of Strategic Conflict in Cyberspace. Operations Research Department Naval Postgraduate School, Monterey, CA 80 th MORS 12 June, 2012. Cyber Conflict - definitions.
E N D
Harrison C. Schramm David L. Alderson W. Matthew Carlyle Nedialko B. Dimitrov A Game Theoretic Model of Strategic Conflict in Cyberspace Operations Research Department Naval Postgraduate School, Monterey, CA 80th MORS 12 June, 2012
Cyber Conflict - definitions • Defining characteristic: how weapons in cyberspace (cyber weapons) are discovered, developed, and employed • Our model is a high-level, strategic look at the problem of Cyber conflict • Key question: How long should a belligerent in cyber conflict hold an exploit in development before attacking?
Cyber Conflict – Approach • Cyber conflict may be viewed as a game • Players discover and develop attacks, which they then exercise at a time of their choosing • Analysis is abstracted away from specific technologies, systems, and exploits. • Similar to other models of combat.
Related Work • JASON (2010) The Science of Cybersecurity • DOD report, recommends game theory as an analytic method • Shiva et al (2010) Game theoretic approaches to protect cyberspace • Presents a taxonomy of game theoretic methods in cyberspace • Lye & Wing (2002) Game strategies in network security • Shen et al (2007) A Markov game theoretic approach for cyber situational awareness
Cyber munition life-cycle Discovery Development Adversary Patch Employment Obsolescence
Cyber Game Mechanics • Discovery of Exploit • Game state indexed as , where T is the age of the game, represents the length of time player ihas known the exploit • Development of Munition • After a player has discovered the exploit, they may develop the exploit in accordance with some known function,
Game Mechanics II • Employment • Once a player has the exploit, he may choose to use it. His action set is defined as: • Obsolesce • If either player discovers and patches the exploit before an attack is executed, all munitions are worthless and the game ends.
State Transitions This state is recurrent until the first discovery is made
Our Analysis • Zero Sum • Two Players • Identical Systems • One zero-day Exploit • Perfect Information
Solving the game relies on building on cases based on knowledge Solution Hierarchy; solving the case where neither player has the exploit depends on the one-player case, which in turn depends on the case where both players have the exploit.
The Base: Both Players know the Exploit If both players know the exploit, “Attack, Attack” is the optimum solution by iterated elimination of dominated strategies • We may compute the value of the game for cases • where
State Transitions Not Reachable for optimal players with perfect knowledge Absorbing This state is recurrent until the first discovery is made
Situation II – One player knows the exploit • Under what circumstances should Player 1 wait (and possibly gain attack value? • For monotone functions, this is straightforward, but the general case is solved as well. • We may compute the value of the game for cases • where
State Transitions Will Player 2 Reach a better state on the axis? Before Player 1 Discovers the Exploit? Not Reachable Starting Here
The general case – neither player knows the exploit… • we can compute the value of the game from any state, including
State Transitions Not Reachable for optimal players with perfect knowledge Absorbing Starting Here Who wins?
Basic Case If the players have constant probability of detection, and constant attack value functions, then Player 1 will expect to win if:
Example II . • Suppose Players 1 and 2 have attack functions such that: • Here, we have to compute the optimum number of turns to wait before attacking, which turns out to be 5, matching our intuition
Example II • Suppose Players 1 and 2 have attack functions such that: Note that since Player 1 has the exploit, Is irrelevant
Example II Value function associated with example two. We see that the maximum value of occurs at Therefore, in this case, it is not ‘worth it’ to wait.
Waiting Times • What happens if we introduce non-productive waiting times? • Such as administrative approval chains • Or other reasons • Conclusion: If you are slow to act, you can make it up (a little bit) by increasing capability in other areas, but only to a point.
State Transitions Cannot progress until w time periods pass Discovers Here
Waiting Times Payoff to Player 1 of an otherwise ‘even’ cyber game, where player 1 is forced to wait w time periods after discovery before any action may be taken.
Waiting Times II Player 1’s Required probability of detection, to ‘break even’ as a function of wait time. Note in this scenario that after 9 time periods, perfect detection is required; further advancements are not possible
Conclusion • We present a lexicon and framework for analyzing cyber conflict • Future work: • Multiple Attacks • Imperfect Information • Incorporating issues outside of cyber (i.e. kinetic)
NPS OR Cyber interest points of contact: • CDR Harrison Schramm • hcschram@nps.edu • 831 656 2358 • Professor Matt Carlyle • mcarlyle@nps.edu • Professor Dave Alderson • dalders@nps.edu • 831 656 1814 • Professor Ned Dimitrov • ndimitrov@nps.edu • 831 656 3647
