A game-theoretic approach to respond to attacker lateral movement

Mohammad A. Noureddine, Ahmed Fawaz, William H. Sanders, Tamer Başar

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

In the wake of an increasing number in targeted and complex attacks on enterprise networks, there is a growing need for timely, efficient and strategic network response. Intrusion detection systems provide network administrators with a plethora of monitoring information, but that information must often be processed manually to enable decisions on response actions and thwart attacks. This gap between detection time and response time, which may be months long, may allow attackers to move freely in the network and achieve their goals. In this paper, we present a game-theoretic approach for automatic network response to an attacker that is moving laterally in an enterprise network. To do so, we first model the system as a network services graph and use monitoring information to label the graph with possible attacker lateral movement communications. We then build a defense-based zero-sum game in which we aim to prevent the attacker from reaching a sensitive node in the network. Solving the matrix game for saddle-point strategies provides us with an effective way to select appropriate response actions. We use simulations to show that our engine can efficiently delay an attacker that is moving laterally in the network from reaching the sensitive target, thus giving network administrators enough time to analyze the monitoring data and deploy effective actions to neutralize any impending threats.

Original languageEnglish (US)
Title of host publicationDecision and Game Theory for Security - 7th International Conference, GameSec 2016, Proceedings
EditorsEmmanouil Panaousis, Milind Tambe, Tansu Alpcan, William Casey, Quanyan Zhu
PublisherSpringer-Verlag
Pages294-313
Number of pages20
ISBN (Print)9783319474120
DOIs
StatePublished - Jan 1 2016
Event7th International Conference on Decision and Game Theory for Security, GameSec 2016 - New York, United States
Duration: Nov 2 2016Nov 4 2016

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume9996 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other7th International Conference on Decision and Game Theory for Security, GameSec 2016
CountryUnited States
CityNew York
Period11/2/1611/4/16

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'A game-theoretic approach to respond to attacker lateral movement'. Together they form a unique fingerprint.

  • Cite this

    Noureddine, M. A., Fawaz, A., Sanders, W. H., & Başar, T. (2016). A game-theoretic approach to respond to attacker lateral movement. In E. Panaousis, M. Tambe, T. Alpcan, W. Casey, & Q. Zhu (Eds.), Decision and Game Theory for Security - 7th International Conference, GameSec 2016, Proceedings (pp. 294-313). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9996 LNCS). Springer-Verlag. https://doi.org/10.1007/978-3-319-47413-7_17