Games of Timing for Security in Dynamic Environments
Benjamin Johnson, Aron Laszka, Jens Grossklags

Citation
Benjamin Johnson, Aron Laszka, Jens Grossklags. "Games of Timing for Security in Dynamic Environments". 6th Conference on Decision and Game Theory for Security (GameSec), November, 2015.

Abstract
Increasing concern about insider threats, cyber-espionage, and other types of attacks which involve a high degree of stealthiness has renewed the desire to better understand the timing of actions to audit, clean, or otherwise mitigate such attacks. However, to the best of our knowledge, the modern literature on games shares a common limitation: the assumption that the cost and effectiveness of the players' actions are time-independent. In practice, however, the cost and success probability of attacks typically vary with time, and adversaries may only attack when an opportunity is present (e.g., when a vulnerability has been discovered). In this paper, we propose and study a model which captures dynamic environments. More specifically, we study the problem faced by a defender who has deployed a new service or resource, which must be protected against cyber-attacks. We assume that adversaries discover vulnerabilities according to a given vulnerability-discovery process which is modeled as an arbitrary function of time. Attackers and defenders know that each found vulnerability has a basic lifetime, i.e., the likelihood that a vulnerability is still exploitable at a later date is subject to the efforts by ethical hackers who may rediscover the vulnerability and render it useless for attackers. At the same time, the defender may invest in mitigation efforts to lower the impact of an exploited vulnerability. Attackers therefore face the dilemma to either exploit a vulnerability immediately, or wait for the defender to let its guard down. The latter choice leaves the risk to come away empty-handed. We develop two versions of our model, i.e., a continuous-time and a discrete-time model, and conduct an analytic and numeric analysis to take first steps towards actionable guidelines for sound security investments in dynamic contested environments.

Electronic downloads

Internal. This publication has been marked by the author for FORCES-only distribution, so electronic downloads are not available without logging in.

Citation formats

• HTML

  Benjamin Johnson, Aron Laszka, Jens Grossklags. <a
  href="http://www.cps-forces.org/pubs/118.html"
  >Games of Timing for Security in Dynamic
  Environments</a>, 6th Conference on Decision and Game
  Theory for Security (GameSec), November, 2015.

• Plain text

  Benjamin Johnson, Aron Laszka, Jens Grossklags. "Games
  of Timing for Security in Dynamic Environments". 6th
  Conference on Decision and Game Theory for Security
  (GameSec), November, 2015.

• BibTeX

  @inproceedings{JohnsonLaszkaGrossklags15_GamesOfTimingForSecurityInDynamicEnvironments,
      author = {Benjamin Johnson and Aron Laszka and Jens
                Grossklags},
      title = {Games of Timing for Security in Dynamic
                Environments},
      booktitle = {6th Conference on Decision and Game Theory for
                Security (GameSec)},
      month = {November},
      year = {2015},
      abstract = {Increasing concern about insider threats,
                cyber-espionage, and other types of attacks which
                involve a high degree of stealthiness has renewed
                the desire to better understand the timing of
                actions to audit, clean, or otherwise mitigate
                such attacks. However, to the best of our
                knowledge, the modern literature on games shares a
                common limitation: the assumption that the cost
                and effectiveness of the players' actions are
                time-independent. In practice, however, the cost
                and success probability of attacks typically vary
                with time, and adversaries may only attack when an
                opportunity is present (e.g., when a vulnerability
                has been discovered). In this paper, we propose
                and study a model which captures dynamic
                environments. More specifically, we study the
                problem faced by a defender who has deployed a new
                service or resource, which must be protected
                against cyber-attacks. We assume that adversaries
                discover vulnerabilities according to a given
                vulnerability-discovery process which is modeled
                as an arbitrary function of time. Attackers and
                defenders know that each found vulnerability has a
                basic lifetime, i.e., the likelihood that a
                vulnerability is still exploitable at a later date
                is subject to the efforts by ethical hackers who
                may rediscover the vulnerability and render it
                useless for attackers. At the same time, the
                defender may invest in mitigation efforts to lower
                the impact of an exploited vulnerability.
                Attackers therefore face the dilemma to either
                exploit a vulnerability immediately, or wait for
                the defender to let its guard down. The latter
                choice leaves the risk to come away empty-handed.
                We develop two versions of our model, i.e., a
                continuous-time and a discrete-time model, and
                conduct an analytic and numeric analysis to take
                first steps towards actionable guidelines for
                sound security investments in dynamic contested
                environments.},
      URL = {http://cps-forces.org/pubs/118.html}
  }
  

Posted by Aron Laszka on 15 Mar 2016.
For additional information, see the Publications FAQ or contact webmaster at cps-forces org.