论文标题
用于自动化攻击防御分析的部分观察安全游戏
Partially-Observable Security Games for Automating Attack-Defense Analysis
论文作者
论文摘要
由于各种原因，网络系统通常包含在网络中保持不变的漏洞，例如缺乏补丁或知识来修复它们。在存在此类残留漏洞的情况下，网络管理员应通过应用合适的对策来最大程度地减少攻击者攻击的可能性，从而对恶意活动做出适当的反应或主动防止它们。在本文中，我们提出了一种随机游戏理论方法，用于分析网络安全性并综合保护网络的防御策略。为了支持部分观察中的分析，在攻击者的某些活动无法被辩护或无法检测到的情况下，我们构建了一个单方面的部分可观察到的安全游戏，并将其转换为一个完美的游戏，以进行进一步分析。我们证明，这种转换对于一类安全游戏和逻辑RPATL中指定的属性子集很合理。我们实施了一个完全自动化我们方法的原型，并通过在现实生活中进行实验来对其进行评估。
Network systems often contain vulnerabilities that remain unfixed in a network for various reasons, such as the lack of a patch or knowledge to fix them. With the presence of such residual vulnerabilities, the network administrator should properly react to the malicious activities or proactively prevent them, by applying suitable countermeasures that minimize the likelihood of an attack by the attacker. In this paper, we propose a stochastic game-theoretic approach for analyzing network security and synthesizing defense strategies to protect a network. To support analysis under partial observation, where some of the attacker's activities are unobservable or undetectable by the defender, we construct a one-sided partially observable security game and transform it into a perfect game for further analysis. We prove that this transformation is sound for a sub-class of security games and a subset of properties specified in the logic rPATL. We implement a prototype that fully automates our approach, and evaluate it by conducting experiments on a real-life network.
