Download presentation
Presentation is loading. Please wait.
Published byFelix Ball Modified over 9 years ago
1
Audit Games Jeremiah Blocki, Nicolas Christin, Anupam Datta, Ariel D. Procaccia, Arunesh Sinha 1 Carnegie Mellon University
2
Motivation 2
3
Auditing Permissive real time access control policy Inspect accesses after occurrence Find and punish policy violators How does it help? Deter potential violators Take remedial measures to prevent future losses 3
4
Auditing for Policy Enforcement HIPAA GLBA EU Data Protection Directive 4
5
Auditing in Practice FairWarning Audit Tool for hospitals Flags all celebrity record accesses as suspicious Place traffic police at strategic locations Intelligent heuristics, but, no mathematical model or guarantees 5
6
Why study Audit Process? Optimize costs expended in auditing Audits costs money Prevent violations Decide appropriate punishment for deterrence Efficiently computable audit strategies Enable cost-optimal prioritized inspections 6
7
Outline Simple rational game model Example Main Algorithm for computing equilibrium Example Future Work 7
8
Simple Rational Model 8 Utility when audited Utility when unaudited
9
Punishment as an Action High Punishment: Hostile Work Environment Low Punishment: No incentive to follow policy. x 9 Simple Rational Model
10
Stackelberg Equilibrium Concept 10 Simple Rational Model
11
Small example Example 223 10.10.5 0.250.50.25 111 Defender’s utility Adversary’s utility 11
12
Example contd. 12 Example 0.2850.430.2850.430.5700.25
13
Computing Optimal Defender Strategy 13 Quadratic Non-convex Simple Rational Model
14
Properties of Optimal Point 14 Tight Constraints Main Algorithm
15
Main Idea in Algorithm 15 Main Algorithm
16
16 Main Algorithm
17
Main Theorem 17 Main Algorithm
18
0.2850.430.2850 Varying cost of punishment 18 0.430.5700.250.460.5400.99 Example
19
Future Work Studying security games variations in audit games Budget-constrained defender Combinatorial constraints on use of defender resources Varying punishment with violation severity Validation: Simulation: studying effect of various parameters Real world case study 19 Future Work
20
Conclusion 20 First model of auditing and first step toward a computationally feasible solution of audit games. Research at the intersection of AI and security & privacy holds lot of promise, given the encouraging precedent set by the deployment of security games algorithms
21
Extensions 21 Extensions
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.