Game-Theoretic Modeling of Stealthy Intrusion Defense against MDP-Based Attackers
Willie Kouam, Stefan Rass

TL;DR
This paper models the strategic interaction between attackers and defenders in cyber networks using game theory, analyzing different information scenarios to develop optimal defense strategies against stealthy APT attacks.
Contribution
It introduces a game-theoretic framework for modeling APT evolution with asymmetric information and derives optimal defense strategies for various informational regimes.
Findings
Optimal defense strategies vary with attacker knowledge levels.
The model captures asymmetric temporal dynamics of attack and defense.
Strategies are derived for Stackelberg, blind, and belief-based regimes.
Abstract
The rapid expansion of Internet use has increased system exposure to cyber threats, with advanced persistent threats (APTs) being especially challenging due to their stealth, prolonged duration, and multi-stage attacks targeting high-value assets. In this study, we model APT evolution as a strategic interaction between an attacker and a defender on an attack graph. With limited information about the attacker's position and progress, the defender acts at random intervals by deploying intrusion detection sensors across the network. Once a compromise is detected, affected components are immediately secured through measures such as backdoor removal, patching, or system reconfiguration. Meanwhile, the attacker begins with reconnaissance and then proceeds through the network, exploiting vulnerabilities and installing backdoors to maintain persistent access and adaptive movement. Furthermore,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Software-Defined Networks and 5G
