An adaptive defense mechanism to prevent advanced persistent threats. Issue 2 (3rd April 2021)

• Record Type: Journal Article
• Authors: Xie, Yi-xi; Ji, Li-xin; Li, Ling-shu; Guo, Zehua; Baker, Thar
• Is Part Of: Connection science. Volume 33:Issue 2(2021)
• Page Start: 359
• Page End: 379
• Publication Date: 2021-04-03
• Subjects: Advanced persistent threats -- moving target defense -- risk assessment -- Bayesian network -- Markov game; Neural computers -- Periodicals; Artificial intelligence -- Periodicals; Cognitive science -- Periodicals; Connectionism -- Periodicals; 006.3
• DOI: 10.1080/09540091.2020.1832960
• Languages: English
• ISSNs: 0954-0091

Abstract

Abstract : The expansion of information technology infrastructure is encountered with Advanced Persistent Threats (APTs), which can launch data destruction, disclosure, modification, and/or Denial of Service attacks by drawing upon vulnerabilities of software and hardware. Moving Target Defense (MTD) is a promising risk mitigation technique that replies to APTs via implementing randomisation and dynamic strategies on compromised assets. However, some MTD techniques adopt the blind random mutation, which causes greater performance overhead and worse defense utility. In this paper, we formulate the cyber-attack and defense as a dynamic partially observable Markov process based on dynamic Bayesian inference. Then we develop an Inference-Based Adaptive Attack Tolerance (IBAAT) system, which includes two stages. In the first stage, a forward–backward algorithm with a time window is employed to perform a security risk assessment. To select the defense strategy, in the second stage, the attack and defense process is modelled as a two-player general-sum Markov game and the optimal defense strategy is acquired by quantitative analysis based on the first stage. The evaluation shows that the proposed algorithm has about 10% security utility improvement compared to the state-of-the-art.