Game Strategies in Network Security Kong-wei Lye and Jeannette M. Wing Carnegie Mellon University Pittsburgh, Pennsylvania, U.S.A.

25 th July 2002Game Strategies in Network Security1 Network Example Public web server Private file server Private workstation Border router Attacker Firewall Internet

25 th July 2002Game Strategies in Network Security2 Motivation Results of their actions: costs and rewards state transitions in network Model of their interactions: stochastic game. Players in the network attack-defense game Attacker Administrator

25 th July 2002Game Strategies in Network Security3 Model Network state: EW FN l EW l WF l FN l NW Node states : n W, n F, n N Traffic state : t = n X = P  { f, h, n, p, s,v } a  { u, c } d  { c, i } l XY  { 0,,, 1 }

25 th July 2002Game Strategies in Network Security4 Stochastic Games xy Prob(y|x,a,b) Player 1 gets reward R 1 (x,a,b) Current state: x Player 1 takes action a Player 2 takes action b Player 2 gets reward R 2 (x,a,b) Prob(x|x,a,b)

25 th July 2002Game Strategies in Network Security5 Strategies Strategy: probability distribution over action set for each state s. Player k should take action  i at state s with probability  (s,  i )

25 th July 2002Game Strategies in Network Security6 Expected Returns Value vector: Expected discounted return for player k at state s when player 1 uses  1 and player 2 uses  2 :

25 th July 2002Game Strategies in Network Security7 Nash Equilibrium is a Nash equilibrium strategy pair if is player 1’s best response to player 2’s and vice versa.

25 th July 2002Game Strategies in Network Security8 Nash Equilibria [FV96] Jerzy Filar & Koos Vrieze. Competitive Markov Decision Processes. Springer-Verlag, New York, Zero-sum game: 1 unique Nash equilibrium General-sum game:  1 Nash equilibria Discounted general-sum stochastic games: most applicable class of games. Nonlinear program (NLP-1) [FV96]: used to compute Nash equilibria

25 th July 2002Game Strategies in Network Security9 State transitions Attack_httpd, 1.0, 10 Continue_attacking, 0.5, 0 Normal_operation,,, > Httpd_attacked,,, > Continue_ attacking, 0.5, 0 Httpd_hacked,,, >

25 th July 2002Game Strategies in Network Security10 Attack Graph Network_shut_down Shutdown_network Workstation_data_stolen_1 Capture_data Workstation_hacked Crack_workstation_ root_ password Webserver_sniffer Install_ sniffer Ftpd_hacked Continue_attacking Ftpd_attacked Attack_ftpd Normal_operation Attack Scenario Continue_ attacking Attack_ftpd Attack_httpd Deface_website_ leave Install_sniffer Continue_ attacking Normal_operation Httpd_attackedFtpd_attacked Ftpd_hacked Website_defaced Webserver_sniffer_detector  Run_DOS_virus   Crack_file_server _root_password Crack_workstation_ root_ password Capture_data Shutdown_network Capture_data Webserver_DOS_1 Webserver_DOS_2 Network_shut_down Shutdown_network Workstation_hacked Continue_attacking Webserver_sniffer Fileserver_hacked Httpd_hacked Fileserver_data_stolen_1 Workstation_data_stolen_1 Continue_attacking Install_ sniffer

25 th July 2002Game Strategies in Network Security11 Running NLP-1 Model: 18 states, 3 actions per state Matlab by The MathWorks Pentium III 600Mhz 128Mb 30 to 45 minutes per run Multiple Nash equilibria, depending on initialization conditions

25 th July 2002Game Strategies in Network Security12 Results Nash Equilibrium for example

25 th July 2002Game Strategies in Network Security13 Nash Equilibrium Excerpts State: Httpd_hacked State: Webserver_sniffer State: Webserver_DOS_1

25 th July 2002Game Strategies in Network Security14 Nash Equilibrium Excerpts States: Fileserver_hacked, Workstation_hacked State: Webserver_sniffer

25 th July 2002Game Strategies in Network Security15 Summary Related work employs zero-sum or static games –[Bel01], [Bro00], [Bur99], [HB01], [MSAH01], [Syv97]. Modeled the network security problem as general- sum stochastic game Found multiple Nash equilibria (best attack and defense strategies) for network example Knowledge of strategies useful for administrator

25 th July 2002Game Strategies in Network Security16 Future Work [SJW02] O. Sheyner, S. Jha, J. Wing. Automated generation and analysis of attack graphs. In Proceedings of the IEEE Symposium on Security and Privacy, Oakland, California, Scalability –Decompose large models into smaller components –Use automatic attack graph generation method by [SJW02].

25 th July 2002Game Strategies in Network Security17 Game Theory 2,20,3 3,01,1 Prisoner 1 Prisoner 2 cooperate defect The Prisoner’s Dilemma