Game-Theoretic Analysis of Network Attack-Defense Interactions

Existing computer security techniques lack the quantitative decision framework required to defend against highly organized attacks. Recently, game-theoretic approaches such as stochastic security games have been used to study such security problems as an optimization game comprising multiple players notably the attackers and the defenders (system administrators). Stochastic security games are a probabilistic approach appropriate for studying particularly complex networks where attacks often go from a state and proceeds to another according to a probability distribution. This work describes a stochastic game model that views the interaction between malicious users and network administrators as a two-player zero-sum game. Novel approaches for identifying games states, and generating game transitions are introduced. We also describe a stochastic mechanism for solving security games, compute optimal strategies, and techniques for predicting adversary's actions, determine vulnerable network assets and suggest optimal defense strategies for the defender.