具有有限理性参与者和多个攻击者的拦截攻击计划：一种对抗性风险分析方法
Interdicting attack plans with boundedly-rational players and multiple attackers: An adversarial risk analysis approach
摘要：
网络安全规划支持在资源有限的环境中选择和实施安全控制措施，以管理风险。这样做需要在建模工作中考虑具有不同战略复杂程度的适应性对手，以支持风险管理。然而，文献中的大多数模型只考虑理性或非战略对手。因此，我们研究如何通知防御决策，以减轻有限理性的球员的风险，特别注重作出综合的，相互依存的规划决策。为了实现这一目标，我们引入了一个建模框架，用于选择一系列安全缓解措施，这些措施可以阻止使用结构化方法进行风险分析的对抗性攻击计划。我们的方法采用对抗风险分析和认知层次理论，考虑一个单一的防御者和多个攻击者谁有不同的目标和战略复杂程度的最大可靠性路径阻断问题。而不是列举所有可能的攻击和防御，我们引入了一个解决方案的技术，基于整数规划和近似算法迭代解决防御者和攻击者的问题。一个案例研究说明了所提出的模型，并提供见解防御规划。
英文摘要：
Cybersecurity planning supports the selection of and implementation of security controls in resource-constrained settings to manage risk. Doing so requires considering adaptive adversaries with different levels of strategic sophistication in modeling efforts to support risk management. However, most models in the literature only consider rational or non-strategic adversaries. Therefore, we study how to inform defensive decision-making to mitigate the risk from boundedly rational players, with a particular focus on making integrated, interdependent planning decisions. To achieve this goal, we introduce a modeling framework for selecting a portfolio of security mitigations that interdict adversarial attack plans that uses a structured approach for risk analysis. Our approach adapts adversarial risk analysis and cognitive hierarchy theory to consider a maximum reliability path interdiction problem with a single defender and multiple attackers who have different goals and levels of strategic sophistication. Instead of enumerating all possible attacks and defenses, we introduce a solution technique based on integer programming and approximation algorithms to iteratively solve the defender's and attackers' problems. A case study illustrates the proposed models and provides insights into defensive planning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
