Dual game model of advanced persistent threat attack for distributed network structure

doi:10.11772/j.issn.1001-9081.2017102448

Journal of Computer Applications ›› 2018, Vol. 38 ›› Issue (5): 1366-1371.DOI: 10.11772/j.issn.1001-9081.2017102448

Previous Articles Next Articles

Dual game model of advanced persistent threat attack for distributed network structure

ZHANG Wei¹, SU Yang^1,2, CHEN Wenwu¹

1. Electronic Technique Department, Engineering College of Armed Police Force, Xi'an Shaanxi 710086, China;
2. Key Laboratory of Information Security, Engineering College of Armed Police Force, Xi'an Shaanxi 710086, China

Received:2017-10-16 Revised:2017-12-04 Online:2018-05-10 Published:2018-05-24
Contact: 张为
Supported by:
This work partially supported by the National Natural Science Foundation of China (61103231).

面向分布式网络结构的APT攻击双重博弈模型

张为¹, 苏旸^1,2, 陈文武¹

1. 武警工程大学电子技术系, 西安 710086;
2. 武警工程大学信息安全保密重点实验室, 西安 710086

通讯作者: 张为
作者简介:张为(1991-),男,湖南津市人,硕士研究生,主要研究方向:网络空间安全;苏旸(1975-),男,陕西西安人,教授,博士,主要研究方向:网络空间安全、可信计算;陈文武(1990-),男,河南南阳人,硕士研究生,主要研究方向:网络空间安全。
基金资助:
国家自然科学基金资助项目（61103231）。

Abstract

Abstract: Considering the lack of theoretical analysis for distributed network structure under Advanced Persistent Threat (APT) attacks, a game model was proposed to solve the problem based on Nash equilibrium theory and node game theory. Firstly, a defensive framework of network security was established by analyzing the characteristics of APT attack and distributed network structure. Secondly, risky factor of vulnerability was calculated through node game model, and Oriented to APT (OAPG) was established on the basis of Nash equilibrium theory, the balance point of attack and defense was calculated, maximum return strategy of the attacker was analyzed, and then optimal defense strategy of the defender was proposed. Finally, an APT attack instance was used to verify the model. The calculation results show that the proposed model can analyze both the attack and the defense of the network from the APT attack path and provide a reasonable defense idea for the organizations using the distributed network.

Key words: Advanced Persistent Threat (APT) attack, game model, attack path, distributed network structure, cyberspace security

摘要： 针对目前分布式网络结构缺少防御高级持续威胁（APT）攻击的安全理论模型问题，提出了一种基于纳什均衡理论和节点博弈的博弈模型。首先，通过APT攻击常用手段和分布式网络结构的特点，分析判断攻击者可能采取的攻击路径并提出网络安全防御框架；其次，通过节点博弈计算漏洞风险系数，在纳什均衡理论的基础上建立基于攻击路径的博弈模型（OAPG），计算攻防双方收益均衡点，分析攻击者最大收益策略，进而提出防御者最优防御策略；最后，用一个APT攻击实例对模型进行验证。计算结果表明，所提模型能够从APT攻击路径对网络攻防双方进行理性分析，为使用分布式网络的机构提供一种合理的防御思路。

关键词: 高级持续威胁攻击, 博弈模型, 攻击路径, 分布式网络结构, 网络空间安全

CLC Number:

TP393.08

ZHANG Wei, SU Yang, CHEN Wenwu. Dual game model of advanced persistent threat attack for distributed network structure[J]. Journal of Computer Applications, 2018, 38(5): 1366-1371.

张为, 苏旸, 陈文武. 面向分布式网络结构的APT攻击双重博弈模型[J]. 计算机应用, 2018, 38(5): 1366-1371.

References

[1] RASS S, ZHU Q. GADAPT:a sequential game-theoretic framework for designing defense-in-depth strategies against advanced persistent threats[C]//Proceedings of the 20167th International Conference on Decision and Game Theory for Security. New York:Springer-Verlag, 2016:314-326.
[2] AUTY M. Anatomy of an advanced persistent threat[J]. Network Security, 2015, 2015(4):13-16.
[3] FENG X, ZHENG Z, HU P, et al. Stealthy attacks meets insider threats:a three-player game model[C]//Proceedings of the 2015 IEEE Military Communications Conference. Piscataway, NJ:IEEE, 2015:25-30.
[4] SINGH S, SHARMA P K, MOON S Y, et al. A comprehensive study on APT attacks and countermeasures for future networks and communications:challenges and solutions[J]. The Journal of Supercomputing, 2016:1-32.
[5] RASS S, KÖNIG S, SCHAUER S. Defending against advanced persistent threats using game-theory[J]. PloS One, 2017, 12(1):e0168675.
[6] FENG X, ZHENG Z, CANSEVER D, et al. Stealthy attacks with insider information:a game theoretic model with asymmetric feedback[C]//Proceedings of the 2016 IEEE Military Communications Conference. Piscataway, NJ:IEEE, 2016:277-282.
[7] ZHANG M, ZHENG Z, SHROFF N B. A game theoretic model for defending against stealthy attacks with limited resources[C]//Proceedings of the 2015 International Conference on Decision and Game Theory for Security. New York:Springer-Verlag, 2015:93-112.
[8] SEMASINGHE P, ZHU K, HOSSAIN E. Distributed resource allocation for self-organizing small cell networks:an evolutionary game approach[C]//Proceedings of the 2013 IEEE GLOBECOM Workshops. Piscataway, NJ:IEEE, 2013:702-707.
[9] ALTMAN E, HAYEL Y, KAMEDA H. Evolutionary dynamics and potential games in non-cooperative routing[C]//Proceedings of the 2007 International Symposium on Modeling and Optimization in Mobile, Ad Hoc and Wireless Networks and Workshops. Piscataway, NJ:IEEE, 2007:1-5.
[10] LIN W Y S, LIU K J R. Pricing game and evolution dynamics for mobile video streaming[C]//Proceedings of the 2011 IEEE International Conference on Acoustics, Speech and Signal Processing. Piscataway, NJ:IEEE, 2011:2348-2351.
[11] SHREE R A J, KHAN R A. Wormhole attack in wireless sensor network[J]. International Journal of Computer Networks and Communications Security, 2014, 2(1):22-26.
[12] ZHU Q, BASAR T. Game-theoretic methods for robustness, security, and resilience of cyberphysical control systems:games-in-games principle for optimal cross-layer resilient control systems[J]. IEEE Control Systems, 2015, 35(1):46-65.
[13] BOWERS K D, van DIJK M, GRIFFIN R, et al. Defending against the unknown enemy:applying FlipIt to system security[C]//International Conference on Decision and Game Theory for Security, LNCS 7638. Heidelberg:Springer, 2012:248-263.
[14] PAWLICK J, FARHANG S, ZHU Q. Flip the cloud:cyber-physical signaling games in the presence of advanced persistent threats[C]//International Conference on Decision and Game Theory for Security, LNCS 9406. Heidelberg:Springer, 2015:289-308.
[15] HU P, LI H, FU H, et al. Dynamic defense strategy against advanced persistent threat with insiders[C]//Proceedings of the 2015 IEEE Conference on Computer Communications. Piscataway, NJ:IEEE, 2015:747-755.
[16] FANG X, ZHAI L, JIA Z, et al. A game model for predicting the attack path of APT[C]//Proceedings of the 2014 IEEE 12th International Conference on Dependable, Autonomic and Secure Computing. Piscataway, NJ:IEEE, 2014:491-495.
[17] 姜伟, 方滨兴, 田志宏, 等. 基于攻防博弈模型的网络安全测评和最优主动防御[J]. 计算机学报, 2009, 32(4):817-827.(JIANG W,FANG B X,TIAN Z H, et al. Evaluating network security and optimal active defense based on attack-defense game model[J]. Chinese Journal of Computers, 2009, 32(4):817-827.)
[18] LIPPMANN R, HAINES J W, FRIED D J, et al. Analysis and results of the DARPA off-line intrusion detection evaluation[C]//Proceedings of the 17th International Workshop on Recent Advances in Intrusion Detection. New York:ACM, 2014:162-182.
[19] LASZKA A, HORVATH G, FELEGYHAZI M, et al. FlipThem:modeling targeted attacks with FlipIt for multiple resources[C]//International Conference on Decision and Game Theory for Security, LNCS 8840. Heidelberg:Springer, 2014:175-194.

Dual game model of advanced persistent threat attack for distributed network structure

面向分布式网络结构的APT攻击双重博弈模型

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 4

Recommended Articles

Metrics

[1]	TANG Yan, LYU Guonian, ZHANG Hong. Advanced marking scheme algorithm based on multidimensional pseudo-random sequences [J]. Journal of Computer Applications, 2016, 36(11): 3093-3097.
[2]	BU Junrong, FENG Liping, SHI Qiong, SONG Lipeng. Analysis of egress detection strategy of Internet service provider based on game theory [J]. Journal of Computer Applications, 2015, 35(4): 968-971.
[3]	WANG Rui YANG Qiuxiang CHEN Gouxi MA Qiaomei. Software protection game model based on divided-storage strategy [J]. Journal of Computer Applications, 2013, 33(09): 2525-2528.
[4]	ZHAO Xin ZHANG Xin. Inter-cluster routing algorithm in wireless sensor network based on game theory [J]. Journal of Computer Applications, 2013, 33(07): 1813-1815.