Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment

TL;DR

This paper models attacker-defender interactions in cybersecurity as Markov Games, using deception strategies validated through Capture-The-Flag experiments and user studies to improve defense tactics against adversaries.

Contribution

It introduces a novel Markov Game framework with deception strategies for understanding and countering human attacker behaviors in cybersecurity.

Findings

Deception strategies outperform traditional defenses like patching.

Bayesian Stackelberg Equilibrium effectively models attacker-defender interactions.

Application-level deception is an optimal mitigation tactic.

Abstract

Identifying the actual adversarial threat against a system vulnerability has been a long-standing challenge for cybersecurity research. To determine an optimal strategy for the defender, game-theoretic based decision models have been widely used to simulate the real-world attacker-defender scenarios while taking the defender's constraints into consideration. In this work, we focus on understanding human attacker behaviors in order to optimize the defender's strategy. To achieve this goal, we model attacker-defender engagements as Markov Games and search for their Bayesian Stackelberg Equilibrium. We validate our modeling approach and report our empirical findings using a Capture-The-Flag (CTF) setup, and we conduct user studies on adversaries with varying skill-levels. Our studies show that application-level deceptions are an optimal mitigation strategy against targeted attacks -- outperforming classic cyber-defensive maneuvers, such as patching or blocking network requests. We use this result to further hypothesize over the attacker's behaviors when trapped in an embedded honeypot environment and present a detailed analysis of the same.