Game Theory for Cyber Deception

Inhaltsverzeichnis

1. Frontmatter

2. Fundamentals

   1. Frontmatter

   2. Chapter 1. Introduction

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      In 2008, the National Academy of Engineering (NAE) included among its 14 Engineering Grand Challenges the objective to “secure cyberspace” [1]. Since that time, increased awareness of threats to cyberspace has helped spur private and public investment in cyberdefense. Yet in the past 10 years, cyberthreats have not only continued to exist, but have also developed new forms based on the evolution of new technologies. This book can be seen as an attempt to confront that reality.

   3. Chapter 2. Nash and Stackelberg Games

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      In this chapter, we give an introduction to several game-theoretic solution concepts that will be used in this book. The chapter starts by introducing matrix-form strategic games and the concept of Nash equilibrium. We then present extensive-form games and the concept of information sets. Stackelberg games are an important type of extensive-form games. This chapter introduces the structure of the game and the solution concept of Stackelberg equilibrium.

   4. Chapter 3. Introduction to Incomplete Information

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      In this chapter, we introduce games with incomplete information. The chapter first gives an overview of Bayesian games and then presents signaling games as an example of two-stage games of incomplete information. Signaling games will be used in several chapters within the book (Chaps. 4, 6-8).

3. Defensive Deception

   1. Frontmatter

   2. Chapter 4. A Taxonomy of Defensive Deception

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      The game theory described in Chaps. 2 and 3 offers versatile possibilities for quantifying cyber deception. Yet specific game-theoretic models must be carefully chosen in order to model different types of deception. In this chapter, therefore, we propose a taxonomy that classifies deception into six categories. We then propose game-theoretic models that fittingly describe each category. Our analysis is based on both theoretical considerations and an empirical study of 25 recent articles in game theory for defensive cyber deception. The taxonomy provides a systematic foundation for understanding the three types of defensive deception that we study in Chaps. 5–7.

   3. Chapter 5. Obfuscation

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      As data ecosystems grow in size due to the IoT, researchers are developing obfuscation techniques that issue fake search engine queries, undermine location tracking algorithms, or evade government surveillance. These techniques raise two conflicts: one between each user and the machine learning algorithms which track the users, and one between the users themselves.

   4. Chapter 6. Honey-X

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      The previous chapter discussed obfuscation, in which the defender’s goal is to hide valuable information within noise. Obfuscation, in other words, is a species of crypsis (Sect. 4.3). But in other species of deception, the defender aims to create a specific false belief. This is called mimesis. The present chapter studies static mimesis, or, honey-x, which takes its name from technologies related to honeypots, honeytokens, etc.

   5. Chapter 7. Attacker Engagement

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      Advanced persistent threats (APTs) are multistage attacks that make use of social engineering and deception to give adversaries insider access to networked systems. Against APTs, active defense technologies create and exploit information asymmetry for defenders. If these active defenses are also dynamic, then we have the species of deception that Chap. 4 calls attacker engagement.

4. Mitigation of Malicious Deception

   1. Frontmatter

   2. Chapter 8. Strategic Trust

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      Because of threats to the IoT, agents in the network must decide whether to trust other possibly-malicious agents, i.e., must assess their reliability and dependability. Unfortunately, the dynamic and plug-n-play nature of the IoT makes reputation-based trust systems insufficient. Hence, this chapter develops a framework for predictive or strategic trust in which agents make decisions in view of the incentives of the agents with whom they are communicating.

   3. Chapter 9. Active Crowd Defense

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      This chapter studies an emerging cyberattack called a “physical” denial-of-service (PDoS) attack, in which devices in the Internet of things overflow the “physical bandwidth” of a cyber-physical system. In order to model active defense used against a PDoS attack, we develop a “Poisson signaling game,” a signaling game with an unknown number of receivers, which have varying abilities to detect deception. Equilibrium results indicate that (1) defenders can bound botnet activity and (2) legal approaches to security have only a limited effect, while active defense can decrease botnet activity arbitrarily.

5. Challenges and Opportunities in Cyber Deception

   1. Frontmatter

   2. Chapter 10. Insights and Future Directions

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      In this chapter, we attempt to go beyond a restatement of the content of the book. First, we consider the broader impacts of this research and the lessons learned during its completion. These insights are situated within the current state of cybersecurity research, and more importantly, within current societal challenges. Second, we outline an ambitious range of future research which could be carried out using this book as a foundation.

   3. Chapter 11. Current Challenges in Cyber Deception

      Jeffrey Pawlick, Quanyan Zhu

      Abstract

      While the previous chapter focused on insights and promising directions based upon the current book, this chapter examines challenges in cyber deception that are found more broadly in the existing literature. As a point of reference, we refer to the research works mentioned in Chap. 4. The literature discussed in Chap. 4 points towards four major challenges in cyber deception.

6. Backmatter