Coordinated Multi-Domain Deception: A Stackelberg Game Approach

TL;DR

This paper presents a novel Stackelberg game framework for coordinated deception across cyber and physical systems, leveraging vulnerability data to optimize defense strategies and disrupt attacker reconnaissance.

Contribution

It introduces a multi-domain deception model that integrates CVSS data and physical replicas, advancing strategic cybersecurity defenses.

Findings

Coordinated deception improves defender utility over baseline strategies.

The CVE-based utility function effectively identifies critical vulnerabilities.

Multi-layer deception outperforms single-layer approaches.

Abstract

This paper explores coordinated deception strategies by synchronizing defenses across coupled cyber and physical systems to mislead attackers and strengthen defense mechanisms. We introduce a Stackelberg game framework to model the strategic interaction between defenders and attackers, where the defender leverages CVSS-based exploit probabilities and real-world vulnerability data from the National Vulnerability Database (NVD) to guide the deployment of deception. Cyber and physical replicas are used to disrupt attacker reconnaissance and enhance defensive effectiveness. We propose a CVE-based utility function to identify the most critical vulnerabilities and demonstrate that coordinated multilayer deception outperforms single-layer and baseline strategies in improving defender utility across both CVSS versions.