基于博弈论的MDP攻击者隐蔽入侵防御建模
Game-Theoretic Modeling of Stealthy Intrusion Defense against MDP-Based Attackers
AI总结：
本文提出基于博弈论的MDP攻击者隐蔽入侵防御建模，通过三种信息制度分析防御策略优化。
摘要：
互联网的快速扩展增加了系统面临网络威胁的风险，高级持续性威胁（APTs）尤其具有挑战性，因为它们具有隐蔽性、持续时间长和多阶段攻击的特点，针对高价值资产。在本研究中，我们将APT的演变建模为攻击者和防御者在攻击图上的战略互动。由于对攻击者的位置和进度信息有限，防御者通过在网络上部署入侵检测传感器随机间隔行动。一旦检测到入侵，受影响的组件会立即通过诸如回门移除、修补或系统重新配置等措施进行保护。同时，攻击者开始进行侦察，然后通过网络进行攻击，利用漏洞并安装回门以维持持久访问和适应性移动。此外，攻击者可能在连续防御操作之间采取多步行动，导致时间动态的不对称性。防御者的目的是减少攻击者获得关键资产的可能性，而攻击者的目的是增加这种可能性。我们研究了三种信息制度下的这种互动，反映了攻击者在行动前对信息的不同水平：（i）Stackelberg场景，其中攻击者完全了解防御者的策略并可以相应优化；（ii）盲区，攻击者没有任何信息并假设对防御部署有均匀信念；（iii）基于信念的框架，攻击者对防御者的行动有准确的概率信念。对于每种制度，我们通过解决相应的优化问题推导出最优防御策略。
英文摘要：
The rapid expansion of Internet use has increased system exposure to cyber threats, with advanced persistent threats (APTs) being especially challenging due to their stealth, prolonged duration, and multi-stage attacks targeting high-value assets. In this study, we model APT evolution as a strategic interaction between an attacker and a defender on an attack graph. With limited information about the attacker's position and progress, the defender acts at random intervals by deploying intrusion detection sensors across the network. Once a compromise is detected, affected components are immediately secured through measures such as backdoor removal, patching, or system reconfiguration. Meanwhile, the attacker begins with reconnaissance and then proceeds through the network, exploiting vulnerabilities and installing backdoors to maintain persistent access and adaptive movement. Furthermore, the attacker may take several steps between consecutive defensive operations, resulting in an asymmetric temporal dynamic. The defender's goal is to reduce the likelihood that the attacker will gain access to a critical asset, whereas the attacker's purpose is to increase this likelihood. We investigate this interaction under three informational regimes, reflecting varying levels of attacker knowledge prior to action: (i) a Stackelberg scenario, in which the attacker has full knowledge of the defender's strategy and can optimize accordingly; (ii) a blind regime, where the attacker has no information and assumes uniform beliefs about defensive deployments; and (iii) a belief-based framework, where the attacker holds accurate probabilistic beliefs about the defender's actions. For each regime, we derive optimal defensive strategies by solving the corresponding optimization problems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
