Effective Repair Strategy Against Advanced Persistent Threat: A Differential Game Approach

• Published in: IEEE transactions on information forensics and security Vol. 14; no. 7; pp. 1713 - 1728
• Main Authors: Yang, Lu-Xing, Li, Pengdeng, Zhang, Yushu, Yang, Xiaofan, Xiang, Yong, Zhou, Wanlei
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.07.2019; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: advanced persistent threat; APT repair problem; Cloud computing; Cybersecurity; Differential games; differential Nash game; Economic models; epidemic modeling; Equilibrium; Game theory; Games; Maintenance engineering; Nash equilibrium; Organizations; potential Nash equilibrium; Repair; Resource allocation; Servers
• ISSN: 1556-6013; 1556-6021
• DOI: 10.1109/TIFS.2018.2885251

Advanced persistent threat (APT) is a new kind of cyberattack that poses a serious threat to modern society. When an APT campaign on an organization has been identified, the available repair resources must be reasonably allocated to the potentially insecure hosts to mitigate the potential loss of the organization. We refer to the feasible repair resource allocation strategies as repair strategies. This paper focuses on the APT repair problem, i.e., the problem of developing effective repair strategies for organizations. First, for an organization with time-varying communication relationship, we establish an evolution model of the organization's expected state, in which the impact of lateral movement of APT is accommodated. On this basis, we model the APT repair problem as a differential Nash game problem (the APT repair game) in which the attacker attempts to maximize his potential benefit, and the organization manages to minimize its potential loss. Second, we derive a system (the potential system) for calculating a potential Nash equilibrium of an APT repair game, and we examine the structure of the potential attack and repair strategies in a potential Nash equilibrium. Next, we solve some potential systems to get the corresponding potential Nash equilibria. Finally, by comparison with a large number of randomly generated attack and repair strategies, we conclude that the potential Nash equilibrium of each APT repair game is a Nash equilibrium of the game. Therefore, we recommend to organizations their respective potential repair strategies. Our findings help to better understand and effectively defend against APT.