Foureye：基于超博弈理论的防御性欺骗对抗高级持续性威胁
Foureye: Defensive Deception based on Hypergame Theory Against Advanced Persistent Threats
摘要：
防御性欺骗技术已经成为一种有前途的主动防御机制，以误导攻击者，从而实现攻击失败。然而，大多数博弈论防御欺骗方法都假设玩家在不确定性下保持一致的观点。他们不考虑参与者可能的主观信念，这些信念是由于给予他们的信息不对称而形成的。在这项工作中，我们制定了一个攻击者和防御者之间的超博弈，他们可以不同地解释同一个游戏，并相应地选择他们的最佳策略，根据各自的信念。这为防御性欺骗策略提供了操纵攻击者信念的机会，这是攻击者决策的关键。我们考虑高级持续性威胁（APT）攻击，它在网络杀戮链的各个阶段执行多个攻击，攻击者和防御者的目标是根据他们的信念选择最佳策略。通过广泛的模拟实验，我们证明了防御者如何有效地利用防御欺骗技术，同时在超级游戏中处理多阶段的APT攻击，其中不完美信息是基于感知的不确定性，成本和攻击者和防御者的预期效用，系统寿命（即，平均安全失败时间），并提高了检测攻击者的误报率。
英文摘要：
Defensive deception techniques have emerged as a promising proactive defense mechanism to mislead an attacker and thereby achieve attack failure. However, most game-theoretic defensive deception approaches have assumed that players maintain consistent views under uncertainty. They do not consider players' possible, subjective beliefs formed due to asymmetric information given to them. In this work, we formulate a hypergame between an attacker and a defender where they can interpret the same game differently and accordingly choose their best strategy based on their respective beliefs. This gives a chance for defensive deception strategies to manipulate an attacker's belief, which is the key to the attacker's decision making. We consider advanced persistent threat (APT) attacks, which perform multiple attacks in the stages of the cyber kill chain where both the attacker and the defender aim to select optimal strategies based on their beliefs. Through extensive simulation experiments, we demonstrated how effectively the defender can leverage defensive deception techniques while dealing with multi-staged APT attacks in a hypergame in which the imperfect information is reflected based on perceived uncertainty, cost, and expected utilities of both attacker and defender, the system lifetime (i.e., mean time to security failure), and improved false positive rates in detecting attackers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
