The Hacking Game: Cross-Impact Analysis Tool Art Hendela, PhD student, art.hendela@hendela.com

Introduction The Problem Types of Games The Hacking Game Cross Impact Analysis The Hacking Game Components Technology Used Future Work

The Problem Protect a computer network from attack with limited resources Determine the allocation of those resources with the help of a mathematical model You can allocate the resources, but how do you know if you’ve done it in a reasonable and efficient manner?

Types of Games Economic Games Combinatorial Games Cooperative, i.e., joint venture (Aloysius,2002) Non-Cooperative, business competitors (Garcia, 2003) Mixed (Nash, 1951) Combinatorial Games Two person with perfect knowledge (Berlekamp 1982 ) Non-cooperative games are those where the participants are solely competitive and do not share information (Garcia 2003). One such example of a non-cooperative game pits managers against one another each with limited resources. As resources become scarcer, the meanness of the players towards one another increases (Wayne 1992).

The Hacking Game Participation in the game occurs in a virtual space No scenario is pre-determined Input is limited to your allotted budget Uses a mathematical model to aid resource allocation Model is based on Cross Impact Analysis The game is online. People do not have to meet to participate. The selection of game components and the events is entirely up to the players and the Overall Game Director. You can’t spend more than you have but you can ask for more. We cover Cross Impact next

Cross Impact Analysis From a paper by Murray Turoff in 1972 entitled, “An Alternative Approach to Cross Impact Analysis” Used for determining influences between events Uses the Delphi Method to help generate group statistics for impact (Turoff, 1970) The Cross Impact analysis provides the mathematical base The Delphi method provides the ideas on how to use experts to form the set of probabilities

Cross Impact Analysis Inputs A set of base events The probability of each base event occurring independent of the other events, Pi The set of probabilities for all other events where an individual base event is certain to occur, Rij The set of probabilities for all other events where an individual base event is certain to never occur, Sij

Cross Impact Analysis Outputs The relative impact of one event on another, Cij The influence by external events not entered, Gi

The Hacking Game Components Security System Component Library Game Definition Event Library Cross Impact Calculation Engine Players Security in in .Net and included role definition, management, Username assignment, Email password to user, Apply for Username, etc. Probabilities Teams Results Survey

The Hacking Game Components Security and roles Player/team management Game Definition with Budgets Components Events Probabilities Calculation Engine Results reporting Survey/evaluation Security limits access based on the type of player Players sign-up through the username/log-in management system Define the game as single or multi-user, allocate the budgets Enter the components that will be acted upon, for example a server or a firewall Enter the events, for example a Denial of Service attack. This creates the base set of events. Probabilities, Pi, Rij, Sij The results are calculated The results are shown The game is evaluated.

Technology Used Code Framework: ASP.NET 2.0 Development Environment: Visual Studio 2005 Language: Visual Basic, VB.NET Database: MS SQLServer 2000 ASP.NET provides many useful controls such as login to minimize the amount of code written. Visual Studio 2005 allows for local testing by providing Internet Information Service (IIS) on your laptop, desktop, etc. My company grew from dBase to FoxPro to Visual FoxPro. Visual basic is very close in structure and syntax to these legacy languages. SQLServer provides an enterprise scale data repository.

Future Work Complete development of the model Field test and evaluate the game Expand the use of the approach to non-network hacking environments that feature an offense/defense structure Protect chemical plants from terrorism Launch a new product against a business competitor

Acknowledgements This research is fully supported by Hendela System Consultants, Inc, Little Falls, NJ (www.hendela.com). The opinions expressed are those of the authors and may not reflect those of the corporate sponsor.

Selected References Aloysius, J. A. (2002). "Research Joint Ventures: A Cooperative Game for Competitors." European Journal of Operational Research 136(3): 591-602. Berlekamp, E., Conway, J, and Guy, R. (1982). Winning Ways for your Mathematical Plays, Academic Press.

Selected References Garcia, D. D., David Ganet, Peter Henderson (2003). "Everything you Always Wanted to Know about Game Theory (But were Afraid to Ask)." SIGCSE 2003 35(1): 96-97. Nash, J. F. (1951). "Non-Cooperative Games." Annals of Mathematics Journal 54(1951): 286-295.

Selected References Turoff, M, (1970). “The Design of a Policy Delphi”, Technology Forecasting and Social Change, 2(2). Turoff, M, (1972). “An alternative approach to Cross Impact Analysis." Technology Forecasting and Social Change”, 3, 338-368.