Abstract:Advanced persistent threat (APT) is a kind of stealthy, sophisticated, and long-term cyberattack that has brought severe financial losses and critical infrastructure damages. Existing works mainly focus on APT defense under stable network topologies, while the problem under time-varying dynamic networks (e.g., vehicular networks) remains unexplored, which motivates our work. Besides, the spatiotemporal dynamics in defense resources, complex attackers' lateral movement behaviors, and lack of timely defense make APT defense a challenging issue under time-varying networks. In this paper, we propose a novel game-theoretical APT defense approach to promote real-time and optimal defense strategy-making under both periodic time-varying and general time-varying environments. Specifically, we first model the interactions between attackers and defenders in an APT process as a dynamic APT repair game, and then formulate the APT damage minimization problem as the precise prevention and control (PPAC) problem. To derive the optimal defense strategy under both latency and defense resource constraints, we further devise an online optimal control-based mechanism integrated with two backtracking-forward algorithms to fastly derive the near-optimal solution of the PPAC problem in real time. Extensive experiments are carried out, and the results demonstrate that our proposed scheme can efficiently obtain optimal defense strategy in 54481 ms under seven attack-defense interactions with 9.64$\%$ resource occupancy in stimulated periodic time-varying and general time-varying networks. Besides, even under static networks, our proposed scheme still outperforms existing representative APT defense approaches in terms of service stability and defense resource utilization.

Defense for Advanced Persistent Threat with Inadvertent or Malicious Insider Threats

Defense for Advanced Persistent Threat with Inadvertent and Malicious Insider Threats

A Dynamic Games Approach to Proactive Defense Strategies against Advanced Persistent Threats in Cyber-Physical Systems

Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System.

Adaptive Strategic Cyber Defense for Advanced Persistent Threats in Critical Infrastructure Networks

Defending Against Advanced Persistent Threats using Game-Theory

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Defending Against Man-In-The-Middle Attack in Repeated Games

Insider Threat Modeling: An Adversarial Risk Analysis Approach

Dynamic Defense Strategy Against Advanced Persistent Threat under Heterogeneous Networks

Optimal Personalized Defense Strategy Against Man-in-the-middle Attack

Modeling and Study of Defense Outsourcing Against Advanced Persistent Threat Through Impulsive Differential Game Approach

Game Theoretical Security Detection Strategy for Networked Systems

The impacts of adaptive attacking and defending strategies on mitigation of intentional threats

A target defence‐intrusion game with considering the obstructive effect of target

An Intelligent Game Theory Framework for Detecting Advanced Persistent Threats

Optimal Repair Strategy Against Advanced Persistent Threats Under Time-Varying Networks

A Game-Theoretic Approach for Threats Detection and Intervention in Surveillance (extended Abstract)

Effective Repair Strategy Against Advanced Persistent Threat: A Differential Game Approach

A Game-Theoretic Approach for Threats Detection and Intervention in Surveillance

Risk-attitude-based Defense Strategy Considering Proactive Strike, Preventive Strike and Imperfect False Targets.