使用因子化交互POMDPs识别网络攻击者意图的主动欺骗
Active Deception using Factored Interactive POMDPs to Recognize Cyber Attacker's Intent
摘要：
本文提出了一种智能和自适应代理，采用欺骗来识别网络对手的意图。与以前的网络欺骗方法不同，这些方法主要集中在延迟或混淆攻击者，我们专注于与他们接触以了解他们的意图。我们将网络欺骗建模为两个智能体上下文中的顺序决策问题。我们引入因子嵌套的交互式POMDPs（I-POMDPx），并使用这个框架来模拟多个攻击者类型的问题。我们的方法模拟了从攻击者最初进入到达到其敌对目标的多个阶段对单个蜜罐主机的网络攻击。基于I-POMDPx的防御代理使用诱饵在多个阶段与攻击者进行交互，以形成对攻击者行为和意图的日益准确的预测。I-POMDPs的使用也使我们能够模拟对手的心理状态，并调查欺骗如何影响他们的信念。我们在模拟和真实主机上的实验表明，基于I-POMDPx的代理在意图识别方面比常用的欺骗策略在蜜罐上表现得更好。
英文摘要：
This paper presents an intelligent and adaptive agent that employs deception to recognize a cyber adversary's intent. Unlike previous approaches to cyber deception, which mainly focus on delaying or confusing the attackers, we focus on engaging with them to learn their intent. We model cyber deception as a sequential decision-making problem in a two-agent context. We introduce factored finitely nested interactive POMDPs (I-POMDPx) and use this framework to model the problem with multiple attacker types. Our approach models cyber attacks on a single honeypot host across multiple phases from the attacker's initial entry to reaching its adversarial objective. The defending I-POMDPx-based agent uses decoys to engage with the attacker at multiple phases to form increasingly accurate predictions of the attacker's behavior and intent. The use of I-POMDPs also enables us to model the adversary's mental state and investigate how deception affects their beliefs. Our experiments in both simulation and on a real host show that the I-POMDPx-based agent performs significantly better at intent recognition than commonly used deception strategies on honeypots.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
