一个一般的安全博弈模型
On a Generic Security Game Model
摘要：
为了保护暴露在互联网上的系统免受攻击，需要一个能够与攻击者交战的安全系统。已经尝试将良性和恶意用户与网络管理员之间的参与/交互建模为游戏。在这些作品的基础上，我们提出了一个游戏模型，这是通用的，足以捕捉各种模式的这种互动。该模型有利于不完全信息的随机博弈。由于错误的传感器导致玩家对当前状态的错误感知，信息是不完美的。为了对分布在其他多个状态上的感知误差进行建模，我们使用传感器输出之间的欧几里得距离。我们构建了一个5态游戏来表示管理员与用户的交互。这些状态对应于1）用户在互联网中离开系统，并且在登录到系统之后; 2）具有低权限; 3）具有高权限; 4）当他成功攻击时;以及5）被管理员困在蜜罐中。每个州都有自己的行动集。我们提出了一个独特的感知动作集对应于这些状态的每个不同的信息集的游戏。该模型有利于不完全信息的随机博弈。不完美的信息是由于错误的传感器导致玩家对当前状态的错误感知。为了对分布在状态上的感知误差进行建模，我们使用传感器输出之间的欧几里得距离。一个例子游戏的数值模拟显示的评价奖励的球员和首选的策略。我们还提出了制定战略时，处理多个攻击者和进行合作的条件。
英文摘要：
To protect the systems exposed to the Internet against attacks, a security system with the capability to engage with the attacker is needed. There have been attempts to model the engagement/interactions between users, both benign and malicious, and network administrators as games. Building on such works, we present a game model which is generic enough to capture various modes of such interactions. The model facilitates stochastic games with imperfect information. The information is imperfect due to erroneous sensors leading to incorrect perception of the current state by the players. To model this error in perception distributed over other multiple states, we use Euclidean distances between the outputs of the sensors. We build a 5-state game to represent the interaction of the administrator with the user. The states correspond to 1) the user being out of the system in the Internet, and after logging in to the system; 2) having low privileges; 3) having high privileges; 4) when he successfully attacks and 5) gets trapped in a honeypot by the administrator. Each state has its own action set. We present the game with a distinct perceived action set corresponding to each distinct information set of these states. The model facilitates stochastic games with imperfect information. The imperfect information is due to erroneous sensors leading to incorrect perception of the current state by the players. To model this error in perception distributed over the states, we use Euclidean distances between outputs of the sensors. A numerical simulation of an example game is presented to show the evaluation of rewards to the players and the preferred strategies. We also present the conditions for formulating the strategies when dealing with more than one attacker and making collaborations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
