Interdicting attack plans with boundedly-rational players and multiple attackers: An adversarial risk analysis approach

TL;DR

This paper develops a new risk analysis framework for cybersecurity that considers multiple boundedly rational attackers with different goals, using integer programming and approximation algorithms for strategic defense planning.

Contribution

It introduces a novel modeling framework combining adversarial risk analysis and cognitive hierarchy theory for multi-attacker cybersecurity scenarios.

Findings

The approach effectively models bounded rationality in attackers.

The solution technique reduces computational complexity in defense planning.

Case study demonstrates practical applicability and strategic insights.

Abstract

Cybersecurity planning supports the selection of and implementation of security controls in resource-constrained settings to manage risk. Doing so requires considering adaptive adversaries with different levels of strategic sophistication in modeling efforts to support risk management. However, most models in the literature only consider rational or non-strategic adversaries. Therefore, we study how to inform defensive decision-making to mitigate the risk from boundedly rational players, with a particular focus on making integrated, interdependent planning decisions. To achieve this goal, we introduce a modeling framework for selecting a portfolio of security mitigations that interdict adversarial attack plans that uses a structured approach for risk analysis. Our approach adapts adversarial risk analysis and cognitive hierarchy theory to consider a maximum reliability path interdiction problem with a single defender and multiple attackers who have different goals and levels of strategic sophistication. Instead of enumerating all possible attacks and defenses, we introduce a solution technique based on integer programming and approximation algorithms to iteratively solve the defender's and attackers' problems. A case study illustrates the proposed models and provides insights into defensive planning.