TY - GEN
T1 - Adaptive MTD Security using Markov Game Modeling
AU - Chowdhary, Ankur
AU - Sengupta, Sailik
AU - Alshamrani, Adel
AU - Huang, Dijiang
AU - Sabur, Abdulhakim
N1 - Funding Information:
We can observe that the strategic approach affects attackers reward significantly, a reduction of almost half. An attacker can obtain the reward of 30 for a strategic approach, compared to reward ∼ 65 for naive approach when administrator deploys countermeasures for 50% vulnerable states. The interdiction of attack paths by the administrator using Markov Game, being the optimal, will strictly dominate any other strategy and thus, significantly limit the attacker’s capability as the number of vulnerabilities will increase in the cloud environment. V. RELATED WORK Sheyner et al [2] present a formal analysis of attacks on a network along with cost-benefit analysis and security measures to defend against the network attacks. In [1], Chowdhary et al. provide a polynomial time method for attack graph construction and network reconfiguration using a parallel computing approach, making it possible to leverage information for strategic reason of attacks in large-scale systems. Authors in [3] introduced the idea of moving secret proxies to new network locations using a greedy algorithm, which they show can thwart brute force and DDoS attacks. In [12], Zhuang et al shows that MTD system designed with intelligent adaptations improve the effectiveness further. In [10], authors shows that intelligent strategies based on common intuitions can be detrimental to security and highlight how game theoretic reasoning can alleviate the problem. On those line, Wei et al [5] and Sengupta et al [9] use a game theoretic approach to model the attacker-defender interaction as a two-player game where they calculate the optimal response for the players using the Nash and the Stackelberg Equilibrium concepts respectively. Although they propose the use of the Markov Decision Process (MDP) and attack graph-based approaches, they leave it as future work. In the context of cloud systems, Peng et al discusses a risk-aware MTD strategy [7] where they model the attack surface as a non-decreasing probability density function and then estimate the risk of migrating a VM to a replacement node using probabilistic inference. Kampanakis et al [4] highlight obfuscation as a possible MTD strategy in order to deal with attacks like OS fingerprinting and network reconnaissance in the SDN environment. Furthermore, they highlight that the trade-off between such random mutations, which may disrupt any active services, require analysis of cost-benefits. In this paper, we identify an adaptive MTD strategy against multi-hop monotonic attacks for cloud networks which optimizes the performance while providing gains in security. VI. CONCLUSION AND FUTURE WORK A cloud network is composed of heterogeneous network devices and applications interacting with each other. The interaction of these entities poses both (1) a security risk to overall cloud infrastructure and (2) makes it difficult to secure them. While traditional security solutions provide reactive security mechanisms to detect and mitigate a threat, they may fail to assess the damage to infrastructure due to a cascading security breach. We presented Markov Game as an assessment tool to perform a cost-benefit analysis of security vulnerabilities and corresponding countermeasures in the cloud network. The assessment shows that a network administrator needs to proactively identify critical security assets and strategically deploy available countermeasures. Game Theoretic approach will help the administrator to quantify and minimize risk provided limited resources. ACKNOWLEDGMENT This research is based upon work supported by the NRL N00173-15-G017, NSF Grants 1642031, 1528099, and 1723440, and NSFC Grants 61628201 and 61571375. The second author is supported by the IBM Ph.D. Fellowship.
Funding Information:
This research is based upon work supported by the NRL N00173-15-G017, NSF Grants 1642031, 1528099, and 1723440, and NSFC Grants 61628201 and 61571375. The second author is supported by the IBM Ph.D. Fellowship.
Publisher Copyright:
© 2019 IEEE.
PY - 2019/4/8
Y1 - 2019/4/8
N2 - Large scale cloud networks consist of distributed networking and computing elements that process critical information and thus security is a key requirement for any environment. Unfortunately, assessing the security state of such networks is a challenging task and the tools used in the past by security experts such as packet filtering, firewall, Intrusion Detection Systems (IDS) etc., provide a reactive security mechanism. In this paper, we introduce a Moving Target Defense (MTD) based proactive security framework for monitoring attacks which lets us identify and reason about multi-stage attacks that target software vulnerabilities present in a cloud network. We formulate the multi-stage attack scenario as a two-player zero-sum Markov Game (between the attacker and the network administrator) on attack graphs. The rewards and transition probabilities are obtained by leveraging the expert knowledge present in the Common Vulnerability Scoring System (CVSS). Our framework identifies an attacker's optimal policy and places countermeasures to ensure that this attack policy is always detected, thus forcing the attacker to use a sub-optimal policy with higher cost.
AB - Large scale cloud networks consist of distributed networking and computing elements that process critical information and thus security is a key requirement for any environment. Unfortunately, assessing the security state of such networks is a challenging task and the tools used in the past by security experts such as packet filtering, firewall, Intrusion Detection Systems (IDS) etc., provide a reactive security mechanism. In this paper, we introduce a Moving Target Defense (MTD) based proactive security framework for monitoring attacks which lets us identify and reason about multi-stage attacks that target software vulnerabilities present in a cloud network. We formulate the multi-stage attack scenario as a two-player zero-sum Markov Game (between the attacker and the network administrator) on attack graphs. The rewards and transition probabilities are obtained by leveraging the expert knowledge present in the Common Vulnerability Scoring System (CVSS). Our framework identifies an attacker's optimal policy and places countermeasures to ensure that this attack policy is always detected, thus forcing the attacker to use a sub-optimal policy with higher cost.
UR - http://www.scopus.com/inward/record.url?scp=85064966125&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85064966125&partnerID=8YFLogxK
U2 - 10.1109/ICCNC.2019.8685647
DO - 10.1109/ICCNC.2019.8685647
M3 - Conference contribution
AN - SCOPUS:85064966125
T3 - 2019 International Conference on Computing, Networking and Communications, ICNC 2019
SP - 577
EP - 581
BT - 2019 International Conference on Computing, Networking and Communications, ICNC 2019
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2019 International Conference on Computing, Networking and Communications, ICNC 2019
Y2 - 18 February 2019 through 21 February 2019
ER -