带有欺骗证据的蜜罐博弈攻防策略优化机制

doi:10.11959/j.issn.1000-436x.2022226

Abstract

Abstract:

Using game theory to optimize honeypot behavior is an important method in improving defender’s trapping ability.Existing work tends to use over simplified action spaces and consider isolated game stages.A game model named HoneyED with expanded action spaces and covering comprehensively the whole interaction process between a honeypot and its adversary was proposed.The model was focused on the change in the attacker’s beliefs about its opponent’s real identity.A pure-strategy-equilibrium involving belief was established for the model by theoretical analysis.Then, based on the idea of deep counterfactual regret minimization (Deep-CFR), an optimization algorithm was designed to find an approximate hybrid-strategy-equilibrium.Agents for both sides following hybrid strategies from the approximate equilibrium were obtained.Theoretical and experimental results show that the attacker should quit the game when its belief reaches a certain threshold for maximizing its payoff.But the defender’s strategy is able to maximize the honeypot’s profit by reducing the attacker’s belief to extend its stay as long as possible and by selecting the most suitable response to attackers with different deception recognition abilities.

Key words: honeypot game, strategy adaptability, belief, evidence for deception, Deep-CFR

CLC Number:

TP393

Lihua SONG, Yangyang JIANG, Changyou XING, Guomin ZHANG. Optimization mechanism of attack and defense strategy in honeypot game with evidence for deception[J]. Journal on Communications, 2022, 43(11): 104-116.

Figures/Tables 12

假设条件	初始信念区间	均衡结果
$1 - \frac{p_{t 2}}{\sqrt[n]{p_{t 3}}} \geq p_{v b} > 1 - \frac{p_{t 2}}{\sqrt[n - 1]{p_{t 3}}}$	$[P_{exit}^{1SA}, 1]$	（exit, block）
$p_{v b} < \frac{l_{a} - c_{d} - c_{f b}}{l_{a} - c_{d}}$	$[\frac{p_{t 2} α}{(1 - p_{v b}) β + p_{t 2} α}, P_{exit}^{1SA})$	（attack-exit, block）
	$[\frac{p_{t 2}^{2} α}{{(1 - p_{v b})}^{2} β + p_{t 2}^{2} α}, \frac{p_{t 2} α}{(1 - p_{vb}) β + p_{t 2} α})$	（attack²-exit, f-block-block）
	$[\frac{p_{t 2}^{3} α}{{(1 - p_{v b})}^{3} β + p_{t 2}^{3} α}, \frac{p_{t 2}^{2} α}{{(1 - p_{v b})}^{2} β + p_{t 2}^{2} α})$	（attack³-exit,f-block² -block）
	?
	$[\frac{p_{t 2}^{n - 1} α}{{(1 - p_{v b})}^{n - 1} β + p_{t 2}^{n - 1} α}, \frac{p_{t 2}^{n - 2} α}{{(1 - p_{v b})}^{n - 2} β + p_{t 2}^{n - 2} α})$	（attack^n-1-exit,f-block^n-2-block）
	$[P_{0}^{\min}, \frac{p_{t 2}^{n - 1} α}{{(1 - p_{v b})}^{n - 1} β + p_{t 2}^{n - 1} α})$	attackⁿ-exit,f-block^n-1-block）
$1 - \frac{p_{t 2}}{\sqrt[n]{p_{t 3}}} \geq p_{v b} > 1 - \frac{p_{t 2}}{\sqrt[n - 1]{p_{t 3}}}$	$[P_{exit}^{1SA}, 1]$	（exit, block）
$p_{v b} \geq \frac{l_{a} - c_{d} - c_{f b}}{l_{a} - c_{d}}$	$[P_{0}^{\min}, P_{exit}^{1SA})$	（attack-exit,block）

编号	假设条件	编号	假设条件
1	$p_{va} \leq 1 - \frac{p_{t 1} (p_{t 1} r_{a} - c_{a})}{2 p_{t 1} r_{a} + 2 p_{t 2} r_{a} - c_{a} - p_{t 1} c_{a} - 2 p_{t 2} c_{a}}$	14	$1 - \frac{p_{t 2} p_{t 1}}{(1 - p_{vb}) p_{t 3}} < p_{va} \leq 1 - p_{t 1}$
2	$c_{a} \geq \frac{p_{t 1}^{2} r_{a} + 2 p_{t 3}^{2} r_{a} - 2 p_{t 3} r_{a} + 2 p_{t 3} p_{va} r_{a} - 2 p_{t 3}^{2} p_{va} r_{a}}{p_{t 1} - p_{t 3} (1 - p_{va}) (1 + p_{t 1} + 2 p_{t 2})}$	15	$p_{va} > 1 - p_{t 1}$
3	$p_{vb} \leq 1 - p_{t 2} \sqrt[2]{\frac{(2 p_{t 1} r_{a} + 2 p_{t 2} r_{a} - c_{a} - p_{t 1} c_{a} - 2 p_{t 2} c_{a})}{p_{t 3} (p_{t 1} r_{a} - c_{a})}}$	16	$p_{va} \leq 1 - \frac{(1 - p_{vb}) p_{t 3}}{p_{t 2}}$
4	$p_{vb} \leq 1 - \frac{p_{t 2} (2 p_{t 1} r_{a} + 2 p_{t 2} r_{a} - c_{a} - p_{t 1} c_{a} - 2 p_{t 2} c_{a})}{2 p_{t 1} r_{a} + 2 p_{t 3} r_{a} - c_{a} - p_{t 1} c_{a} - 2 p_{t 3} c_{a}}$	17	$p_{va} > 1 - \frac{(1 - p_{vb}) p_{t 3}}{p_{t 2}}$
5	$p_{vb} < \frac{l_{a} - c_{d} - c_{f b}}{l_{a} - c_{d}}$	18	$\frac{p_{t 2} p_{t 1}}{(1 - p_{vb}) p_{t 3}} < p_{v a} \leq 1 - \frac{p_{t 2}^{2} p_{t 1}}{(1 - p_{vb})^{2} p_{t 3}}$
6	$p_{vb} \geq \frac{l_{a} - c_{d} - c_{f b}}{l_{a} - c_{d}}$	19	$\frac{l_{a} - c_{d} - c_{f a} - c_{f d} - p_{vd} l_{a} + p_{vd} c_{d}}{2 (l_{a} - c_{d}) - c_{f d} - p_{vd} l_{a} + p_{vd} c_{d}} \leq p_{va} < \frac{l_{a} - c_{d} - c_{f a}}{2 (l_{a} - c_{d})}$
7	$p_{vb} \leq 1 - \frac{r_{a} + c_{f b}}{l_{a} - c_{d}}$	20	$p_{va} < \frac{l_{a} - c_{d} - c_{f a} - c_{f d} - p_{vd} l_{a} + p_{vd} c_{d}}{2 (l_{a} - c_{d}) - c_{f d} - p_{vd} l_{a} + p_{vd} c_{d}}$
8	$p_{vb} > 1 - \frac{r_{a} + c_{f b}}{l_{a} - c_{d}}$	21	$p_{va} \geq \frac{l_{a} - c_{d} - c_{f a}}{2 (l_{a} - c_{d})}$
9	$p_{va} \leq 1 - \frac{p_{t 2} p_{t 1}}{(1 - p_{vb}) p_{t 3}}$	22	$\frac{r_{a} - c_{fa}}{l_{a} - c_{d} - c_{f b} + (1 - p_{vb}) (l_{a} - c_{d})} \leq p_{v a} < \frac{r_{a} - c_{fa} + c_{fb} + p_{vb} (l_{a} - c_{d})}{2 (l_{a} - c_{d})}$
10	$1 - \frac{p_{t 2} p_{t 1}}{(1 - p_{vb}) p_{t 3}} < p_{v a} \leq 1 - \frac{p_{t 2}}{1 - p_{vb}}$	23	$p_{va} < \frac{r_{a} - c_{fa}}{l_{a} - c_{d} - c_{f b} + (1 - p_{vb}) (l_{a} - c_{d})}$
11	$1 - \frac{p_{t 2}}{1 - p_{vb}} < p_{va} \leq 1 - p_{t 3}$	24	$p_{v a} \geq \frac{r_{a} - c_{f a} + c_{f b} + p_{vb} (l_{a} - c_{d})}{2 (l_{a} - c_{d})}$
12	$p_{va} > 1 - p_{t 3}$	25	$p_{t 3} \geq \frac{p_{t 2} p_{t 1}}{1 - p_{vb}}$
13	$1 - \frac{p_{t 2}}{1 - p_{vb}} < p_{va} < 1 - \frac{p_{t 2}^{2}}{(1 - p_{vb})^{2}}$	26	$p_{t 3} < \frac{p_{t 2} p_{t 1}}{1 - p_{vb}}$

假设条件	信念区间	均衡结果
1,2,3,4,5,9,25	$[P_{exit}^{2SA}, 1]$	（exit, block）
1,2,3,4,5,10,14,19,25	$[P_{exit}^{2SA}, 1]$	（exit, block）
1,2,3,4,5,10,15,18,21,25	$[\frac{p_{t 2} η}{(1 - p_{v b}) β + p_{t 2} η}, P_{exit}^{2SA})$	（attack-exit, block）
1,2,3,4,5,11,14,19,25
1,2,3,4,5,11,15,18, 21,25
1,2,3,4,5,12,15,18,21,25	$[\frac{p_{t 3} η}{β + p_{t 3} η}, \frac{p_{t 2} η}{(1 - p_{v b}) β + p_{t 2} η})$	（attack²-exit, f-block-block）
1,2,3,4,5,8,9, 26
1,2,3,4,5,8,10,14,19,26
1,2,3,4,5,8,10,15,18,21,26	$[P_{0}^{\min}, \frac{p_{t 3} η}{β + p_{t 3} η})$	（attack²-exit,block²）
1,2,3,4,5,8,11,14,19,26
1,2,3,4,5,8,11,15,18, 21,26
	$[P_{exit}^{2SA}, 1]$	（exit, block）
1,2,3,4,6,10,15,18,19	$[\frac{p_{t 1} p_{t 3} α}{(1 - p_{v a}) β + p_{t 1} p_{t 3} α}, P_{exit}^{2SA})$	（attack-exit, block）
1,2,3,4,6,11,15,18,19
1,2,3,4,6,12,15,18,19
	$[P_{0}^{\min}, \frac{p_{t 1} p_{t 3} α}{(1 - p_{v a}) β + p_{t 1} p_{t 3} α})$	（attack²-exit, f-allow-block）
1,2,3,4,6,9,10	$[P_{exit}^{2SA}, 1]$	（exit, block）
1,2,3,4,6,10,14	$[P_{exit}^{2SA}, 1]$	（exit, block）
1,2,3,4,6,11,14	$[P_{0}^{\min}, P_{exit}^{2SA})$	（attack-exit, block）
1,2,3,4,6,10,15,18,21
1,2,3,4,6,11,15,18,21
1,2,3,4,6,12,15,18,21

References 15

[1]	SPITZNER L . Honeypots:tracking hackers[M]. Reading: Addison-Wesley, 2003.
[2]	WAGENER G , DULAUNOY A , ENGEL T . Self adaptive high interaction honeypots driven by game theory[C]// Symposium on Self-Stabilizing Systems. Berlin:Springer, 2009: 741-755.
[3]	HAYATLE O , OTROK H , YOUSSEF A . A game theoretic investigation for high interaction honeypots[C]// Proceedings of 2012 IEEE International Conference on Communications. Piscataway:IEEE Press, 2012: 6662-6667.
[4]	王鹃, 杨泓远, 樊成阳 . 一种基于多阶段攻击响应的SDN动态蜜罐[J]. 信息网络安全, 2021,21(1): 27-40.
	WANG J , YANG H Y , FAN C Y . A SDN dynamic honeypot with multi-phase attack response[J]. Netinfo Security, 2021,21(1): 27-40.
[5]	WAGENER G , STATE R , DULAUNOY A ,et al. Heliza:talking dirty to the attackers[J]. Journal in Computer Virology, 2011,7(3): 221-232.
[6]	PAUNA A , IACOB A C , BICA I . QRASSH - a self-adaptive SSH honeypot driven by Q-learning[C]// Proceedings of 2018 International Conference on Communications (COMM). Piscataway:IEEE Press, 2018: 441-446.
[7]	MNIH V , KAVUKCUOGLU K , SILVER D ,et al. Playing atari with deep reinforcement learning[J]. arXiv Preprint,arXiv:1312.5602, 2013.
[8]	PAUNA A , BICA I , POP F ,et al. On the rewards of self-adaptive IoT honeypots[J]. Annals of Telecommunications, 2019,74(7/8): 501-515.
[9]	DOWLING S , SCHUKAT M , BARRETT E . New framework for adaptive and agile honeypots[J]. ETRI Journal, 2020,42(6): 965-975.
[10]	SURATKAR S , SHAH K , SOOD A ,et al. An adaptive honeypot using Q-learning with severity analyzer[J]. Journal of Ambient Intelligence and Humanized Computing, 2022,13(10): 4865-4876.
[11]	PAWLICK J , ZHU Q . Deception by design:evidence-based signaling games for network defense[J]. arXiv Preprint,arXiv:1503.05458, 2015.
[12]	PAWLICK J , COLBERT E , ZHU Q Y . Modeling and analysis of leaky deception using signaling games with evidence[J]. IEEE Transactions on Information Forensics and Security, 2018,14(7): 1871-1886.
[13]	ZINKEVICH M , JOHANSON M , BOWLING M ,et al. Regret minimization in games with incomplete information[C]// Proceedings of the 20th International Conference on Neural Information Processing Systems. Piscataway:IEEE Press, 2007: 1729-1736.
[14]	BROWN N , LERER A , GROSS S ,et al. Deep counterfactual regret minimization[J]. arXiv Preprint,arXiv:1811.00164, 2018.
[15]	RU Y Q , WANG Y F , LI J E ,et al. Risk assessment of cyber attacks in ECPS based on attack tree and AHP[C]// Proceedings of 2016 12th International Conference on Natural Computation,Fuzzy Systems and Knowledge Discovery (ICNC-FSKD). Piscataway:IEEE Press, 2016: 465-470.

Metrics

Recommended 0

No Suggested Reading articles found!

符号	含义
N= (N_a,N_d)	博弈参与人，N_d 表示防御方,N_a 表示攻击方
T = (T_a,T_d)	参与人的类型空间，T_a = {网络攻方击 }， T_d ={蜜罐，生产系 }统
A=(A_a,A_d)	参与人的动作空间，A_a={attack，exit}；A_d ={allow,block,f-allow,f-block}
R_a(a_d,a_a,θ_d)	攻击方收益函数，其中，a_d、a_a、θ_d 分别为防御方动作、攻击方动作、防御方类型
R_d(a_d,a_a,θ_d)	防御方收益函数
r_a	攻击命令成功执行时攻击方的收益
l_a	攻击命令造成的攻击方信息损失
c_a	攻击方的攻击成本
c_d	防御方维护系统的成本
c _fa	防御方伪造允许输出的成本
c _fb	防御方伪造阻塞输出的成本，且c_fa＞c_fb
P	防御类型的先验信念集合，P(T_d)={P₀,1-P₀}
P′	防御类型的后验信念集合，由贝叶斯法则计算
p _va	攻击方验证后识别出虚假允许输出的概率
p _vb	攻击方验证后识别出虚假阻塞输出的概率，且p_va＞p_vb
p_t ={p_{t 1},p_t2,p_t3}	真实生产系统产生允许输出、虚假阻塞输出和阻塞输出的概率，且 p_t1＞p_t2＞p_t3

实验参数	量化数值
攻击收益r_a	7
信息收益l_a	10
攻击成本c_a	2
维护成本c_d	1
f-allow伪造成本c _fa	3
f-block伪造成本c _fb	2
初始信念P₀	0.1
p _va	0.4、0.8
p _vb	0.2、0.4、0.7
p_t ={p_{t 1},p_t2,p_t3}	{0.89,0.10,0.01}
学习率	0.001
批大小batchsize	6 400

Optimization mechanism of attack and defense strategy in honeypot game with evidence for deception

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 12

References 15

Related Articles 4

Metrics

Recommended 0

[1]	Zhiyong LUO,Xu YANG,Jiahui LIU,Rui XU. Network intrusion intention analysis model based on Bayesian attack graph [J]. Journal on Communications, 2020, 41(9): 160-169.
[2]	Guidong SUN,Xin GUAN,Xiao YI,Jing ZHAO. Correlation coefficient measurement for conflict evidence [J]. Journal on Communications, 2018, 39(12): 30-39.
[3]	Lin-lan LIU,Jiang-bo XU,Yue LI,Zhi-yong YANG. Deep belief network-based link quality prediction for wireless sensor network [J]. Journal on Communications, 2017, 38(Z2): 17-25.
[4]	Hong-bin JIN,Jiang-qiao LAN. Method of determining BBA based on multi-class support vector machine [J]. Journal on Communications, 2010, 31(8A): 100-104.