GADAPT: A Sequential Game-Theoretic Framework

GADAPT: A Sequential Game-Theoretic Framework for Designing Defense-in-Depth Strategies Against Advanced Persistent Threats Stefan Rass1 and Quanyan Zhu2(B) 1

Institute of Applied Informatics, System Security Group, Universit¨ at Klagenfurt, Klagenfurt, Austria [email protected] 2 Department of Electrical and Computer Engineering, Tandon School of Engineering, New York University, Brooklyn, NY 11201, USA [email protected]

Abstract. We present a dynamic game framework to model and design defense strategies for advanced persistent threats (APTs). The model is based on a sequence of nested finite two-person zero-sum games, in which the APT is modeled as the attempt to get through multiple protective shells of a system towards conquering the target located in the center of the infrastructure. In each stage, a sub-game captures the attack and defense interactions between two players, and its outcome determines the security level and the resilience against penetrations as well as the structure of the game in the next stage. By construction, interdependencies between protections at multiple stages are automatically accounted for by the dynamic game. The game model provides an analysis and design framework to develop effective protective layers and strategic defense-indepth strategies against APTs. We discuss a few closed form solutions of our sequential APT-games, upon which design problems can be formulated to optimize the quality of security (QoS) across several layers. Numerical experiments are conducted in this work to corroborate our results.

1

Introduction

The recent advances in the information and communications technologies (ICTs) have witnessed a gradual migration of many critical infrastructures such as electric power grid, gas/oil plants and waste water treatment into open public networks to increase its real-time situational awareness and the operational efficiency. However, this paradigm shift has also inherited existing vulnerabilities of ICTs and posed many challenges for providing information assurance to the legacy systems. For example, the recent computer worm, Stuxnet, have been spread to target Siemens Supervisory Control And Data Acquisition (SCADA) systems that are configured to control and monitor specific industrial processes. c Springer International Publishing AG 2016  Q. Zhu et al. (Eds.): GameSec 2016, LNCS 9996, pp. 314–326, 2016. DOI: 10.1007/978-3-319-47413-7 18

GADAPT: A Sequential Game-Theoretic Framework

315

Cyber security mechanisms need to be built into multiple layers of the system to protect critical assets against security threats. Traditional design of security mechanisms relies heavily on cryptographic techniques and the secrecy of cryptographic keys or system states. However, the landscape of system security has recently evolved considerably. The attacks have become more sophisticated, persistent and organized over the years. The attackers can use a wide array of tools such as social engineering and side channel information to steal the full cryptographic keys, which violates the key secrecy assumption in cryptographic primitives. This type of attacks is often referred to as Advanced Persistent Threats (APTs), which can persist in a system for a long period of time, advance stealthy and slowly to maintain a small footprint and reduce detection risks. In this work, we present a dynamic game framework to capture the distinct feature of APTs in control systems. The objective of using game theory for APT is a paradigm shift from designing perfect security to prevent attacks to strategic planning and design of security mechanisms that allow systems to adapt and mitigate its loss over time. The interactions between an stealthy attacker and the system can be modeled through a sequence of nested zero-sum games in which the attacker can advance or stay at each stage of the game, while the system designer aims to detect and thwart the attack from reaching the target or the most critical assets located at the center of the infrastructure. The nested feature of the game integrates multiple layers of the infrastructure together. At each layer, a sub-game captures the local attack and defense interactions, and its outcome determines the security level and the resilience against APT penetrations at the current stage, as well as the structure of the game in the next layer. The nested structure enables a holistic integration of multiple layers of the infrastructure, which often composed of cyber-layer communications and networking protocol and the physical-layer control and automation algorithms. The nested structure can also capture different domains within one layer of the infrastructure. For example, an APT can advance from the domain of enterprise Intranet to the domain of utility networks at the cyber layer of an infrastructure. Another distinct feature of the model is to capture the dynamic behaviors of APT and its dynamic interactions with different layers of the systems at distinct stages. The dynamic game framework allows the system to adapt to the real-time observations and information collected at each stage and implement an automated policy that will enable the system to adjust its security response at different stages. The game model also provides a computational and design framework to develop effective protective layers and strategic defense-in-depth strategies against APTs. We discuss a few closed form solutions of our sequential APT-games, upon which design problems can be formulated to optimize the quality of security (QoS) across several layers. Below, we present related work, and Sect. 2 introduces the dynamic nested sequential game model for APT and presents the analytical results of the equilibrium analysis. Section 3 focuses on the design of security mechanism enabled by the framework. The paper is concluded in Sect. 4.

316

S. Rass and Q. Zhu

Related Work: Game-theoretic methods have been widely used in modeling attacker-defender interactions in communication networks [1–4] and cyberphysical systems [5–8]. The application of game theory to APT has been recently studied in [9,10]. Game-theoretic techniques provide a natural framework to capture the dynamic and strategic conflicting objectives between an APT who aims to inflict maximum damage on the network and a defender who aims to maximize its utility while minimizing his risk [11]. In [9], FlipIt game is proposed as the framework for “Stealthy Takeover,” in which players compete to control a shared resource. In [10], a game-of-games structure is proposed to compose the FlipIt game together with a signaling game to capture the stealthy behaviors between an attacker and a cloud user. Our work is also related to the recent literature on proactive cyber defense mechanisms to defend against intelligent and adaptive adversaries by reducing cyber-system signatures observed by the adversaries and increasing their cost and difficulty to attack. Different types of proactive mechanisms have been investigated including moving target defense [12,13], randomization techniques [14–17], deception [18–20], and software diversity [21–23]. Game theory provides a scientific framework to address the security mechanism design of proactive cyber security.

2

APTs as Inspection Games

The game is defined as a walk on a directed acyclic graph G = (V, E). This graph is created from the infrastructure directly, but may also be derived from an attack graph (related to the infrastructure). Let v0 ∈ V be the smallest node w.r.t. the topological ordering of G. For the APT game, we think of v0 as the target node that the adversary seeks to reach against the actions of the defender. In G, define the k-th level set Lk as the set of nodes that are equidistantly separated from v0 by k edges. Formally, we can think of Lk as a “concentric circle” in the graph around v0 , with L0 = {v0 }. The game starts with the adversary located at the outermost level Lk , in which a local game is played towards reaching the next level Lk−1 . Within each level, the concrete game structure is determined by the particular nodes located at distance k and their vulnerabilities (whose exploits are the strategies for the opponent player). At any such (fixed) stage, the strategies for both players depend on which physical parts of the system (computers, routers, etc.) are located at distance k, which vulnerabilities can be exploited for these, and which counteractions can be adopted to prevent attacks. This view defines a sequence of k games, Gk , Gk−1 , . . . , G1 , where in every game Gi , the attacker has two possible actions, which are either to move onwards to the next level, or to stay at the current level, e.g., to gather necessary information for the next steps and/or to remain undetected upon being idle (and thus not noticeable; like a “dropper” malware). The payoffs in each case depend on the chances to successfully enter the next game Gi−1 in case of a “move”, or to become detected in case of a “stay”. Let the attacker be player 2 in our inspection game.

GADAPT: A Sequential Game-Theoretic Framework

317

The defender, acting as player 1, can choose any component v ∈ V in the graph G for inspection, which results in one out of two results: (1) it can (even unknowingly) close an existing backdoor that the adversary was using (this would be a “catch” event), or (2) it can have chosen the wrong spot to check, so the adversary’s outside connection up to its current position in the G remains intact (this would be a “miss” event). It is important to stress the stealthiness of the situation here, as the spot inspections by player 1 may neither indicate the current nor past presence of the attacker at a node. That is, the defender’s (player 1’s) actual move in the game comprises two steps: it randomly chooses a node to inspect, and then resets it to a valid reference state (e.g., patch it, update its configuration, completely reinstall it, etc.). If there was a backdoor at a node being active, the defender’s action may have closed it, even though the defender itself never noticed this success. The adversary, once having successfully entered game Gi , maintains a path in the graph from the outermost level Lk up to the current level Li (with 1 ≤ i < k) in G. Call a particular such path Pi ⊆ V , and define it to be a set of consecutive nodes in G. Whichever node player 1 chooses to inspect, the attacker looses the game at this stage (but not the overall game) if any node in Pi is inspected (as the backdoor is closed by then), no matter if it decided to stay or move. The likelihood for this event to happen is determined by the randomized rule by which nodes for inspections are being selected, which is the behavior that player 1 seeks to optimize using game theory. If the attacker decides to stay and remains uncaught, this leaves his current profit unchanged, since it took it no closer to its goal. If the adversary decides to move and remains uncaught, this adds to his revenue, since it now is in game Gi−1 . If the backdoor is closed by an inspection (the path Pi is broken), then the game ends, returning the so-far collected payoff for the adversary, and the respective negative value for the defender (zero-sum). The zero-sum assumption is convenient here for providing a valid worst-case assessment without requiring a payoff (incentive) model for the attacker. It thus simplifies the modeling at the cost of possibly giving a pessimistic security assessment (if the attacker is less malicious than presumed). In any case, the game automatically ends once G1 is won, returning the maximal revenue/loss to the attacker/defender. To illustrate the modeling, consider the generic SCADA infrastructure as depicted in Fig. 1. The distance (level) in the game is determined by the number of access controls (e.g., firewalls) between the attacker and the underlying utility controller nodes (e.g., valves in the water supply, which are shown as  in Fig. 1). To define the games on each stage, a topological vulnerability analysis may be used to dig up possible exploits related to each component, so as to define the opponent’s action set and the respective countermeasures. An example output of such an analysis could look like shown in Fig. 1, with the most important part for our game modeling being the vulnerability assessment. This can, for example, be done using a CVSS scoring. Although the score is only for comparative purposes and is devoid of a physical meaning as such, it can be taken as a qualitative indication of severity, on which an “informed guess” for the probability of an

318

S. Rass and Q. Zhu utility network #1 level 1

level 3 level 3

enterprise intranet

DMZ (webserver, private clouds)

Web connection network (run by external ISP provider)

level 2

internet (level 4)

level 1

utility network #2

Fig. 1. Example SCADA infrastructure for APT modeling

exploit to happen can be based. This will become handy when the inspection game model is defined. Let 1 ≤ n ≤ k be the stage of the game, where k is the maximal distance between the attacker and its goal (i.e., the number of stages in the gameplay). Our model is essentially a version of a sequential inspection game (with reversed roles) in the sense that – Up to k “inspections” are possible, – but an “inspection” here means a penetration attempt for the attacker, seeking to get to game Gn−1 from Gn . – the defender (player 1) then takes any (reasonable) number of random checks on the infrastructure towards maximizing security. Let I(n) denote the equilibrium payoff in the game at stage n, then – for simplicity – let us think of only two actions for each player, which are to defend or not to defend (spot checking by player 1), or to penetrate or stay (player 2). Obviously, if player 1 does not defend (inspect), then the attacker will successfully get from Gn to Gn−1 upon a penetration attempt (outcome I(n − 1)), or will stay where it is (outcome I(n)). In both cases, we assume an investment of c for an attack and a cost of z to remain idle. Likewise, if player 1 defends, then an attack will succeed with a certain likelihood p, and an inactive (“staying”) attacker will go undetected with likelihood q. Upon detection, the attacker looses all that has been accomplished so far (revenue −I(n)), or retains I(n) since the attacker stays where it is. The payoff structure can be described by the matrix displayed in Fig. 2. Both parameters p and q may explicitly depend on (and can be tailored to) the stage n. It is reasonable to assume a cyclic structure in this game, since:

GADAPT: A Sequential Game-Theoretic Framework

319

Fig. 2. Sequential 2-player game model for advanced persistent threats

– if “stay” is a pure strategy equilibrium for the attacker, then there is nothing to actively defend, since the attacker has no incentive to get to the center. – if “penetrate” is a pure strategy equilibrium for the attacker, then “defend” is the rational choice for player 1. In that case, we get a recurrence equation I(n) = p(n) · I(n − 1) + (1 − p(n)) · I(n) − c with the closed form solution I(n) = −c · n + I(0). – obviously, “do not defend” cannot be a pure strategy equilibrium, since this would defeat the whole purpose of security. – if “defend” is a pure strategy equilibrium for the defender, then our goal would be designing the system such that the attacker has an incentive to refrain from attacking continuously. As in the first case, a characteristic property of APTs is their stealthiness, so that an attacker will not expose her/himself to the risk of getting detected upon too much activity. Under this assumption, we find I(n) to be given by the recursion  (2c(1 − q) + 2(q − 1)I(n − 1) − pz + z)2 + 8(p − 1)(q − 1)zI(n − 1) I(n) = 4(q − 1) −2cq + 2c + 2qI(n − 1) − 2I(n − 1) − pz + z . (1) + 4(q − 1) Technically, we can directly obtain I(n) under the assumption of a unique equilibrium in mixed strategies, but this assumption needs to be verified. Thus, take I(n) as “given”, and let us take the reverse route of starting from (1) as a mere definition for I(n), and verify it to be a valid equilibrium of the sequential game in Fig. 2. To this end, we need to assure that I(n), upon substituting it into the payoff matrix, induces a circular structure and hence a unique mixed equilibrium. This equilibrium can then (independently) be calculated by well-known closed-form formulas, whose result will match our definition (1). To materialize this plan, we need a preliminary result: Lemma 1. Assume I(n) to be defined by (1), and take I(0) > 0, as well as 0 < p, q < 1 and c, z > 0 all being constant. Then, I(n) is monotonously decreasing, and I(n) ≤ 0 for all n ≥ 1. Proof. (sketch) First, we can show that I(1) < 0 whenever I(0) > 0 (under the stated hypotheses on p, q, c, z), and then induct on n, while using the implication   [I(n) ≤ I(n − 1)] → [I(n + 1) ≤ I(n)] for n ≥ 1.

320

S. Rass and Q. Zhu

The conclusion made by the lemma is indeed practically meaningful, considering that the sequential game is played “backwards” from n to stage n − 1 to stage n−2, etc. To reach the center (payoff I(0)), the attacker has to invest something, hoping to get refunded with the value I(0) upon conquering the goal. Thus, the sign of I(n) ≤ 0 for n ≥ 1 indicates the a-priori imprest before the reward is gained when the game ends. By refining the hypothesis of Lemma 1, we obtain a sufficient condition for the payoff structure induced by I(n) to have a unique mixed equilibrium: Proposition 1. Let p, q, c, z in Fig. 2 be constants, and assume 0 < p < 1, 0 < q < 1/2, c > 0, z > 0 as well as c · q + p2 · z < c. Then, I(n) as defined by (1) with z has a unique equilibrium in mixed the initial condition 0 < I(0) < pc + 2(q−1) strategies for all n ≥ 1 in the sequential game as defined by Fig. 2.   ab Proof. (sketch) Let the payoff structure be A = and define the predicate cd Q(A) := (a < b) ∧ (c > d) ∧ (a < c) ∧ (b > d) as an indicator for a circular preference structure. It is a matter of easy yet messy algebra to show that Q(A) holds under the stated assumptions, together with the upper bound I(n) ≤ 0 implied by Proposition 1 for n ≥ 1. Hence, by backsubstituting (1) into the payoff matrix (Fig. 2), we have the circular structure being guaranteed, which then implies the existence of only one equilibrium in mixed strategies.   Corollary 1. Under the conditions of Proposition 1, I(n) as given by (1) gives the unique equilibrium value in the n-th stage of the game, with the respective equilibrium strategies obtained from the resulting payoff structure (with I(n) and I(n − 1) being substituted). Proof. This immediately follows by computing the equilibrium value from the payoff structure using the closed form formula, which is valid for matrices without a saddle-point in mixed strategies. Specifically, using the notation as in the proof of Proposition 1, and Q(A) then its saddle-point value is given by v(A) = det(A)/N , with N = a − b − c + d. The equilibrium strategies are found as (p∗ , 1 − p∗ ) and (q ∗ , 1 − q ∗ ) with p∗ = (d − c)/N and q ∗ = (d − b)/N . The corollary then follows by writing down v(A) as a quadratic equation in I(n) and I(n − 1), solving for I(n), and observing that one of the two solutions matches (1). In fact, using the parameter configuration as given in Example 1, we get an immediate counter-example showing that the second solution of the quadratic equation defining I(n) does not yield a payoff matrix with a circular preference structure.   Note that the likelihood p may indeed depend on the stage n in reality, and is determined by the equilibrium payoff in the n-th stage. Formally, we may think of this value to depend on n via the game Gn being defined with indicator-valued loss functions. That is, the game Gn is defined with payoffs from {0, 1} to indicate either a successful penetration (outcome 1) or a successful defense (outcome 0), so that the (long-run) average revenue is the probability to successfully get from

GADAPT: A Sequential Game-Theoretic Framework

321

the n-th stage to stage n − 1. The shape of the game Gn depends on the number rn of possible exploits and the number sn of countermeasures at level n. Since both action sets are finite, and if the success or failure of a countermeasure can be s ×r meaningfully determined, the game Gn ∈ {0, 1} n n is actually a matrix game over {0, 1}. Then, we can set p(n) := val(Gn ), when val denotes the saddle-point value of Gn . The parameter c shown above captures costs associated with the penetration attempt. Likewise, the parameter q(n) and the cost z are specified in an analogous way. They describe the likelihood of being detected during an idle phase of information gathering, and the cost for the attacker in playing the strategy “stay”. Example 1. In many infrastructures, one (not exclusive) purpose of firewalls is to concentrate traffic at a single entry or exit point. So, if the firewall separates stage n from stage n − 1 (cf. Fig. 1), the “local” game Gn is played at the intersection point between the networks. The defending player 1 is herein the totality of countermeasures against unauthorized traffic, say, packet filters (the firewall directly), but also intrusion detection mechanisms, access control, or similar. Likewise, player 2 is the intruder having various options to penetrate the barrier between stage n and stage n − 1, such as forged emails, conquering a local computer, etc. Table 1 lists some of the particular scenarios that may possibly define game Gn . In practice, we recommend resorting to specific catalogues of vulnerabilities and respective countermeasures, such as are provided by the ISO27000 norm [24] or related. Table 1. Lists of defense and attack actions, as two separate lists (same rows thus do not reflect any correspondence between defender’s and attacker’s actions). Defender action

Attacker action

d1 : Inspect packets (intrusion detection) a1 : Use open ports d2 : Check firewall filter rules

a2 : Zero-day exploits

d3 : Update firewall firmware

a3 : Drop sleeping trojan

d4 : Local malware scans

a4 : Use shared network drive being accessible from stage n − 1 and stage n

d5 : Reinstall computer .. .

a5 : Email spoofing .. .

The gameplay itself would be defined as a 0-1-valued matrix in which each scenario is assigned an outcome of either “success” or “failure”. However, many of these actions are inherently probabilistic in the sense that there is no 100 % detection rate of the intrusion detection, malware scan, or similar. Other measures like reinstalling a computer from a reference image, however, may indeed have a guarantee to wipe out all malware (unless a virulent email stored elsewhere is re-opened and re-infect the machines). If the defense strategy is a local

S. Rass and Q. Zhu 1

I(n)

0 Pr(“defend”) Pr(“penetrate”)

−500

0.5

−1,000 −1,500

0 0

10

20

30

40

50

60

equilibrium strategies

322

70

number n of stages

Fig. 3. Example sequential game equilibrium I(n)

malware scan (strategy d4 ), then we may have likelihood p43 to succeed in finding a sleeping trojan (attack strategy a5 ). Similarly, reinstalling the computer afresh removes the trojan, i.e., has success rate 1 in the scenario (d5 , a4 ). Checking a firewall rule from time to time (defense action d2 ) would in turn be effective against exploits of open ports (attack action a1 ), provided that those are not in permanent legitimate use. The outcome of this scenario can then be taken as a probability p22 , with its value assessed upon expert ratings of this threat/vulnerability combination. The resulting matrix defining the game Gn would then end up as the labeled matrix A ∈ [0, 1]n×n with values ranging over the entire unit interval. Likewise, if the attacker decides to remain stealthy, it pays less z ≤ c that upon trying to penetrate, but plays a different game Gn (with its own strategies and outcomes, depending on how the defender acts). Its saddle-point value q(n) := val(Gn ) then tells the likelihood of being detected. If the attacker tried to remain stealthy and is detected, the game terminates with the path Pn being closed, so that the full lot of I(n) is lost. It is an easy matter of solving this equation numerically for computing the value I(n) at several stages, starting from I(0). Example 2. Figure 3 displays a solution to I(n) for the parameter set p = 0.7, q = 0.1, c = 20, z = 10 and I(0) = 15 (note that the parameters satisfy the hypothesis of Proposition 1). The second ordinate (on the right) refers to the equilibrium strategies by specifying the likelihoods to play “defend” (for player 1) and “penetrate” for player 2. As expected, the defense is becoming more intense in the proximity of the center. Likewise, the attacker is best advised to behave more aggressively when the goal (stage 0) is near.

3

Design Problems

Practically, altering the infrastructure towards enhancing security amounts to changing one or more individual stage games Ai , Ai , say by adding a firewall, reconfiguring a surveillance or intrusion detection system, etc. Towards automating this process, we may think of the possible changes being modeled by decision

GADAPT: A Sequential Game-Theoretic Framework

323

variables that influence the parameters in the respective stage-game matrix; cf. Example 1. Call their entirety a vector θ. The result is an update to the parameters p, q, c and z depending on the particular values of the decision variables, either by making the detection probability higher (increase p, q), or increase the cost to penetrate (raise c) or stay undetected (raise z). Essentially, we thus have a design problem to optimize the parameters p, q, c, z in an expectedly resource-constrained manner. To formalize the matter, recall that p(n), q(n) have been defined as the values of the games Gn , Gn played within the n-th stage of the protection. Each value is thus the optimum of the linearly constrained program p(n) = maxx (v) subject to An · xn ≤ bn , where the matrix An and vector bn are defined to resemble the well-known constraints on the variables (v, x), where x = (x1 , . . . , xn ) ranges over all mixed strategies on the strategy space of player 1 (the defender in our game Gn ). Likewise, we can abstractly write q(n) = maxy (u) subject to An · xn ≤ bn , with (u, x ) determining the value u and optimal mixed strategy x in game Gn . The problem of optimizing the value of the sequential game I can come in different flavours. The difference is in the goal expression, which can be: – I(k), e.g., the value of the game at the outermost stage: this is a static design problem and refers to optimizing the protection from an external perspective. – I(k) for some large but fixed k: this is also a static optimization problem and attempts to optimize an approximation to the limit that the sequence I(n) approaches when n tends to infinity (i.e., the limit then measures the overall strength of protection irrespectively of the number of stages and games). – I as a function of n ∈ {1, . . . , k}: Optimizing I(n) over all stages defines a dynamic optimization problem. Note that we exclude I(0) here as this measures the value of the innermost asset, and thus may be fixed a priori. We will leave the particular details and issues of solving these various kinds of optimizations as an interesting route of future research. Here, let us complete our discussion by adding the constraints that the above optimization problems are subject to. The decision variables over which the optimization is done are only implicitly available here and primarily define the values of the inner sub-games G1 , G1 , G2 , G2 , . . . , Gk , Gk , Gk , Gk . Let us assume all of them to be – finite (as there are clearly not infinitely many attack and defense strategies available), – and zero-sum (for the sake of the sequential game becoming a worst-case model across the entire infrastructure). The vector of decision variables θ defines a sequence of game-matrices A1 (θ), A1 (θ), A2 (θ), A2 (θ), . . ., Ak (θ), Ak (θ). The n-th such pair of matrices An (θ), An (θ) give rise to two linear optimization problems with constraint matrices Bn , Bn , that again depend on the (not necessarily all) decision variables θ. We omit this dependence hereafter to simplify our notation. The constraints to the infrastructure design problem are found by gluing together the constraints for the stage-games, resulting in a (large) block matrix

324

S. Rass and Q. Zhu

B = diag(B 1 , B 1 , B 2 , B 2 , . . . , B k , B k ). The overall optimization is then over the vector θ and subject to the constraint B(θ) · x ≤ b, with the right-hand side vector b collecting the constraints from all the optimization problems (including the variables p(n), q(n) for all stages), defining the respective games. The goal function in this problem is the solution to the sequential game model. This solution can be worked out numerically (which we assume as feasible, since there are not too many stages to be expected in real life).

4

Conclusion and Outlook

Modeling advanced persistent threats by game theory is a so far largely open issue, and the inherent nature of an APT to be stealthy and highly tailored to the particular infrastructure makes accurate modeling into a challenge. To account for this, we designed a simple 2 × 2-game on top of individual games within an infrastructure, so that the sub-games define the overall APT sequential game model. In this way, we can accurately model the infrastructure at hand, while retaining an analytically and numerically feasible game-theoretic model. As our experiments indicated, the model, despite its simplicity, provides a quite rich dynamics, which under slight alterations even exhibits interesting phenomena like the convergence of the equilibrium values as the number of stages in the game increases (e.g., such as is observed when some of the cost parameters are allowed with negative values to reflect a gain in some situations). An analytic treatment of this is currently in progress, and will be reported in companion work. As a byproduct, the model allows to define design-problems to optimize security investments to mitigate APT risks. This route of usage is particularly interesting for practitioners, seeking to improve the resilience of an IT-infrastructure. Acknowledgments. This work is partially supported by the grant CNS-1544782 from National Science Foundation, as well as by the European Commission’s Project No. 608090, HyRiM (Hybrid Risk Management for Utility Networks) under the 7th Framework Programme (FP7-SEC-2013-1).

References 1. Zhu, Q., Saad, W., Han, Z., Poor, H.V., Ba¸sar, T.: Eavesdropping and jamming in next-generation wireless networks: a game-theoretic approach. In: MILCOM 2011 Military Communications Conference, pp. 119–124 (2011) 2. Conti, M., Di Pietro, R., Mancini, L.V., Mei, A.: Emergent properties: detection of the node-capture attack in mobile wireless sensor networks. In: Proceedings of WiSec 2008, pp. 214–219. ACM (2008) 3. Zhu, Q., Bushnell, L., Ba¸sar, T.: Game-theoretic analysis of node capture and cloning attack with multiple attackers in wireless sensor networks. In: Proceedings of IEEE CDC (2012) 4. Shree, R., Khan, R.: Wormhole attack in wireless sensor network. Int. J. Comput. Netw. Commun. Secur. 2(1), 22–26 (2014)

GADAPT: A Sequential Game-Theoretic Framework

325

5. Xu, Z., Zhu, Q.: Secure and resilient control design for cloud enabled networked control systems. In: Proceedings of CPS-SPC 2015, pp. 31–42. ACM, New York (2015) 6. Zhu, Q., Ba¸sar, T.: Game-theoretic methods for robustness, security, and resilience of cyberphysical control systems: games-in-games principle for optimal cross-layer resilient control systems. IEEE Control Syst. 35(1), 46–65 (2015) 7. Miao, F., Zhu, Q.: A moving-horizon hybrid stochastic game for secure control of cyber-physical systems. In: Proceedings of IEEE CDC, pp. 517–522, December 2014 8. Zhu, Q., Bushnell, L., Ba¸sar, T.: Resilient distributed control of multi-agent cyberphysical systems. In: Tarraf, C.D. (ed.) Control of Cyber-Physical Systems. LNCS, vol. 449, pp. 301–316. Springer, Heidelberg (2013) 9. Dijk, M., Juels, A., Oprea, A., Rivest, R.L.: Flipit: The game of “stealthy takeover”. J. Cryptol. 26(4), 655–713 (2013) 10. Pawlick, J., Farhang, S., Zhu, Q.: Flip the cloud: cyber-physical signaling games in the presence of advanced persistent threats. In: Khouzani, M.H.R., Panaousis, E., Theodorakopoulos, G. (eds.) GameSec 2015. LNCS, vol. 9406, pp. 289–308. Springer, Heidelberg (2015). doi:10.1007/978-3-319-25594-1 16 11. Manshaei, M.H., Zhu, Q., Alpcan, T., Bac¸sar, T., Hubaux, J.P.: Game theory meets network security and privacy. ACM Comput. Surv. 45(3), 25 (2013) 12. Jajodia, S., Ghosh, A.K., Swarup, V., Wang, C., Wang, X.S. (eds.): oving Target Defense - Creating Asymmetric Uncertainty for Cyber Threats. Advances in Information Security. Springer, New York (2011) 13. Jajodia, S., Ghosh, A.K., Subrahmanian, V.S., Swarup, V., Wang, C., Wang, X.S.: Moving Target Defense II - Application of Game Theory and Adversarial Modeling. Advances in Information Security, vol. 100. Springer, New York (2013) 14. Kc, G.S., Keromytis, A.D., Prevelakis, V.: Countering code-injection attacks with instruction-set randomization. In: Proceedings of the 10th ACM Conference on Computer and Communications Security, CCS 2003, pp. 272–280. ACM, New York (2003) 15. Al-Shaer, E.: Toward network configuration randomization for moving target defense. In: Jajodia, S., Ghosh, K.A., Swarup, V., Wang, C., Wang, S.X. (eds.) Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats. Advances in Information Security, vol. 54, pp. 153–159. Springer, New York (2011) 16. Jafarian, J.H., Al-Shaer, E., Duan, Q.: Openflow random host mutation: transparent moving target defense using software defined networking. In: Proceedings of the First Workshop on Hot Topics in Software Defined Networks, HotSDN 2012, pp. 127–132. ACM, New York (2012) 17. Al-Shaer, E., Duan, Q., Jafarian, J.H.: Random host mutation for moving target defense. In: Keromytis, A.D., Pietro, R. (eds.) SecureComm 2012. LNICSSITE, vol. 106, pp. 310–327. Springer, Heidelberg (2013). doi:10.1007/978-3-642-36883-7 19 18. McQueen, M.A., Boyer, W.F.: Deception used for cyber defense of control systems. In: 2nd Conference on Human System Interactions, pp. 624–631, May 2009 19. Zhuang, J., Bier, V.M., Alagoz, O.: Modeling secrecy and deception in a multipleperiod attackerdefender signaling game. Eur. J. Oper. Res. 203(2), 409–418 (2010) 20. Pawlick, J., Zhu, Q.: Deception by design: evidence-based signaling games for network defense. CoRR abs/1503.05458 (2015) 21. Ammann, P.E., Knight, J.C.: Data diversity: an approach to software fault tolerance. IEEE Trans. Comput. 37(4), 418–425 (1988)

326

S. Rass and Q. Zhu

22. Dalton, M., Kannan, H., Kozyrakis, C.: Raksha: a flexible information flow architecture for software security. SIGARCH Comput. Archit. News 35(2), 482–493 (2007) 23. Chen, P., Kataria, G., Krishnan, R.: Software diversity for information security. In: WEIS (2005) 24. International Standards Organisation (ISO): ISO/IEC 27001 - Information technology - Security techniques - Information security management systems - Requirements (2013). http://www.iso.org/iso/iso27001. Accessed 11 Apr 2016