A Game Theoretic Approach for
Active Defense
Peng Liu
Lab. for Info. and Sys. Security
University of Maryland, Baltimore County
Baltimore, MD 21250
OASIS, March 2002
1
Evolution of Defensive Computing Systems
Survivability
Intrusion Detection
Prevention
- authentication, access control,
inference control, information flows,
encryption, keys, signatures, ...
- host-based, network-based, misuse
detection, anomaly detection, ...
- assessment
- repair
- isolation
-containment
- replication
- segmentation
- masking
- migration
- quorums
- voting
- reconfiguration
- … ...
However, many existing defensive computing systems are
passive!.
2
Many IDS are passive
• Static intrusion detection -- fixed IDS configuration
• Adaptive intrusion detection -- reactive but not active
– adapting IDS configuration to the changing environment
– most successful when new attacks follow the same trend
Passive -- the defense lags behind the offense.
3
Many existing intrusion tolerant systems
are passive
Environment
Tuner
An intrusion
tolerant system
attacks
good
accesses
• Reactive adaptations work well when the environment
gradually changes following the same trend
• When the environment suddenly changes, the adaptation
latency can be significant, during which the system is not
stable and can perform very poorly
4
ITDB is passive
Tuner
Authorized but malicious transactions
Mediator & Damage
Container
suspicious
transactions
alarms
Intrusion Detector
trails
malicious
transactions
merge
isolation
database
assess
repair
alarms
discard
Repair manager
trails
5
Active Defense Systems
Environment
An
attacking
system
Tuner
battle
An intrusion
tolerant system
good
accesses
6
A game theoretic approach for active
defense
Game
Player 1
An intrusion
tolerant system
Defense
strategy
Attack
strategy
strategy
space
Player 2
An attacking
system
strategy
space
Payoff-1 (D, A)
Payoff-2 (D, A)
time
• The game should have multiple phases
• The simplest case should be repeated games
7
A simple game
Prisoner 2
high
risk
Deny
Deny
Confess
-1, -1
-9, 0
0, -9
-6, -6
Prisoner 1
Confess
Nash
equilibrium
• Rational players: maximum payoffs with minimum risks
• Rational prediction -- Nash equilibrium -- (confess, confess)
– player 1’s predicted strategy is player 1’s best response to the
predicted strategy of player 2, and vice versa
– no single player wants to deviate from his or her predicted strategy
8
A motivating example
Merchant
Acquiring
Bank
Fraud
Detection
• credit card transactions
• fraud detection
– a profile for each card (customer)
– distance (transaction, profile) indicates
the anomaly
– raising several levels of alarms based
on the distance using a set of thresholds
• challenge -- how to
– minimize the fraud loss
– minimize the denial-of-service
Account
information
Issuing Bank
9
Anomaly Detection System Specification
10
A game for active fraud defense (1)
Payoff
ugood
Types
Good guy
Probability
1-θ
believes
θ
Customer
ubad
Fraud
Detection
System
Bad guy
uads = (1- θ)uads,good + θ uads, bad
Bayesian 2-player active defense game
11
A game for active fraud defense (2)
• Assumption: the profile of each customer is simply specified
by the transaction amount
u good
0
if | amount  Pi | TH


if | amount  Pi | TH
 DoS (amount )
ubad
amount

 0
uads, good
uads,bad
b.TH

 0
 amount

0

if | amount  Pi | TH
if | amount  Pi | TH
if | amount  Pi | TH
if | amount  Pi | TH
if | amount  Pi | TH
if | amount  Pi | TH
12
Attack Prediction Game
13
A naïve approach
• Assumption: the attacker knows Pi
• The Nash Equilibrium is:
– when b=0
• the FDS’s stategy is: TH=0
• the good guy’s strategy is: amount=Pi
• the bad guy’s strategy is: amount =Pi
– when b>0
• there is no (pure strategy) Nash equilibrium
• since the FDS wants to outguess the bad guy and vice versa
However, Pi is usually not completely known to the bad guy!
14
A probabilistic approach
• Assumption: the attacker only knows a distribution of Pi,
e.g., a normal distribution
• The Nash Equilibrium (TH*, Ag*, Ab*) must satisfy:
| Ag *  Pi | TH *
r2
max Ab   f ( x)dx
Ab
r1
here
r1  max( 0, Ab  TH *)
r 2  min( CL, Ab  TH *)
max (1   )b.TH   . Ab * .h( Ab*, Pi, TH )
TH
Pi
2TH
However, when b is very small:
TH * | Ab *  Pi |
Ab*
CL
0
15
Adding more uncertainty
• Motivation: in many cases, the FDS is uncertain about the
attacker’s strategy
• Assumption: the attacker’s strategy is randomly distributed
over an attack window [X, X+B] where B is fixed
• The results are:
CL
Pi
0
X
X+B
Question: which X is best for the bad guy?
16
Preliminary results (1)
Attacker strategy
Figure 1: The relationship between the attacker's
strategy and ADS strategy, given different attacking
ranges
90
80
70
60
50
40
30
20
10
0
B=20
B=40
B=60
0
20
40
60
80
100
Threshold
17
Preliminary results (2)
Figure 2b: The relationship between normal user's profile and
IDS strategy, given different bandwidth rewards (B=40,
Sita=0.05)
ADS Threshold
100
80
60
40
bandwidth=0.001
bandwidth=0.06
bandwidth=0.2
20
0
-20 0
20
40
60
80
100
User profile
18
Preliminary results (3)
Attacker Strategy
Figure 3b: The relationship betw een norm al user's profile and
attacker strategy, given different bandw idth rew ards (B=40, Sita=0.05)
80
70
60
50
40
30
20
10
0
bandw idth=0.001
bandw idth=0.06
bandw idth=0.2
0
20
40
60
User profile
80
100
19
Preliminary results (4)
Attacker success rate
Figure 4b: The relationship betw een normal user's profile and attacker
success rate, given different bandw idth rew ards (B=40, Sita=0.05)
1
0.8
0.6
0.4
bandw idth=0.001
bandw idth=0.06
bandw idth=0.2
0.2
0
0
20
40
60
80
100
User profile
20
The impact on false alarm rate and
detection rate
• The false alarm rate is dependent on the behavior of
the good guy
– If the good guy takes Nash strategies, the false alarm rate is 0
• The detection rate can be predicted using the Nash
Equilibrium
• Since in many practical defense systems there is
incomplete information to compute the Nash Equilibrium,
the false alarm rate is usually not zero, and the detection
rate can only be approximately predicted
21
Suggestions to card holders
• Have multiple cards
• Each card has converged usage
22
Broader Attack Prediction Applications
Attack Space
Valuable
games
New attacks
Not valuable
games
Known types of
attacks
New types of
attacks
23
Example 1: new attacks
• There is a game for each new attack, however,
– the attacker knows a lot about it but the defender knows very little
– the attacker knows a lot about the Nash equilibrium, but the
defender does not know
– the attacker will not inform the defender what he or she knows
• As a result, the attacker can exploit the nature of
asymmetric information sharing to win more!
• The defender can start to play the game only after the new
attack happens
24
Example 2: code red
Web server
Attacker
Patch
Low
probability of
being
captured
Code Red
None
0, -1
10, -10
0, -1
0, 0
Patch
High
probability of
being
captured
Code Red
None
-5, -1
5, -10
0, -1
0, 0
None
Nash
equilibrium
None
25
Potential impact
• Nash equilibrium are rational predictions for attacks
• Nash equilibrium can guide better defensive system
design
26
Questions?
Thank you!
27