Asymptotic Security using Bayesian Defense Mechanism with Application to Cyber Deception

TL;DR

This paper demonstrates that a Bayesian defense mechanism can asymptotically detect attacks or induce nominal behavior in control systems, with applications to cyber deception strategies that mislead attackers.

Contribution

It introduces a stochastic signaling game framework to analyze defender and attacker dynamics, proving asymptotic security guarantees under certain conditions.

Findings

Belief of true scenario converges at equilibrium

Defender can asymptotically detect attacks with high confidence

Deception can cause attackers to cease attacks even without vulnerability awareness

Abstract

This paper addresses the question whether model knowledge can guide a defender to appropriate decisions, or not, when an attacker intrudes into control systems. The model-based defense scheme considered in this study, namely Bayesian defense mechanism, chooses reasonable reactions through observation of the system's behavior using models of the system's stochastic dynamics, the vulnerability to be exploited, and the attacker's objective. On the other hand, rational attackers take deceptive strategies for misleading the defender into making inappropriate decisions. In this paper, their dynamic decision making is formulated as a stochastic signaling game. It is shown that the belief of the true scenario has a limit in a stochastic sense at an equilibrium based on martingale analysis. This fact implies that there are only two possible cases: the defender asymptotically detects the attack with a firm belief, or the attacker takes actions such that the system's behavior becomes nominal after a finite time step. Consequently, if different scenarios result in different stochastic behaviors, the Bayesian defense mechanism guarantees the system to be secure in an asymptotic manner provided that effective countermeasures are implemented. As an application of the finding, a defensive deception utilizing asymmetric recognition of vulnerabilities exploited by the attacker is analyzed. It is shown that the attacker possibly stops the attack even if the defender is unaware of the exploited vulnerabilities as long as the defender's unawareness is concealed by the defensive deception.