Presentation on theme: "A Game Theoretic Model of Strategic Conflict in Cyberspace Operations Research Department Naval Postgraduate School, Monterey, CA 80 th MORS 12 June, 2012."— Presentation transcript:
A Game Theoretic Model of Strategic Conflict in Cyberspace Operations Research Department Naval Postgraduate School, Monterey, CA 80 th MORS 12 June, 2012 Harrison C. Schramm David L. Alderson W. Matthew Carlyle Nedialko B. Dimitrov
Cyber Conflict - definitions Defining characteristic: how weapons in cyberspace (cyber weapons) are discovered, developed, and employed Our model is a high-level, strategic look at the problem of Cyber conflict Key question: How long should a belligerent in cyber conflict hold an exploit in development before attacking? 2
Cyber Conflict – Approach Cyber conflict may be viewed as a game Players discover and develop attacks, which they then exercise at a time of their choosing Analysis is abstracted away from specific technologies, systems, and exploits. – Similar to other models of combat. 3
Related Work JASON (2010) The Science of Cybersecurity – DOD report, recommends game theory as an analytic method Shiva et al (2010) Game theoretic approaches to protect cyberspace – Presents a taxonomy of game theoretic methods in cyberspace Lye & Wing (2002) Game strategies in network security Shen et al (2007) A Markov game theoretic approach for cyber situational awareness 4
Cyber munition life-cycle Discovery Development ObsolescenceEmployment Adversary Patch 5
Cyber Game Mechanics Discovery of Exploit – Game state indexed as, where T is the age of the game, represents the length of time player i has known the exploit Development of Munition – After a player has discovered the exploit, they may develop the exploit in accordance with some known function, 6
Game Mechanics II Employment – Once a player has the exploit, he may choose to use it. His action set is defined as: Obsolesce – If either player discovers and patches the exploit before an attack is executed, all munitions are worthless and the game ends. 7
State Transitions This state is recurrent until the first discovery is made
Our Analysis Zero Sum Two Players Identical Systems One zero-day Exploit Perfect Information 9
Solving the game relies on building on cases based on knowledge 10 No Players One player Both Players Solution Hierarchy; solving the case where neither player has the exploit depends on the one-player case, which in turn depends on the case where both players have the exploit.
The Base: Both Players know the Exploit If both players know the exploit, “Attack, Attack” is the optimum solution by iterated elimination of dominated strategies 11 We may compute the value of the game for cases where
State Transitions This state is recurrent until the first discovery is made Not Reachable for optimal players with perfect knowledge Absorbing
Situation II – One player knows the exploit Under what circumstances should Player 1 wait (and possibly gain attack value? For monotone functions, this is straightforward, but the general case is solved as well. 13 We may compute the value of the game for cases where
State Transitions Not Reachable Starting Here Will Player 2 Reach a better state on the axis? Before Player 1 Discovers the Exploit?
The general case – neither player knows the exploit… 15 we can compute the value of the game from any state, including
State Transitions Not Reachable for optimal players with perfect knowledge Absorbing Starting Here Who wins?
Waiting Times What happens if we introduce non-productive waiting times? – Such as administrative approval chains – Or other reasons Conclusion: If you are slow to act, you can make it up (a little bit) by increasing capability in other areas, but only to a point.
State Transitions Discovers Here Cannot progress until w time periods pass
Waiting Times Payoff to Player 1 of an otherwise ‘even’ cyber game, where player 1 is forced to wait w time periods after discovery before any action may be taken.
Waiting Times II Player 1’s Required probability of detection, to ‘break even’ as a function of wait time. Note in this scenario that after 9 time periods, perfect detection is required; further advancements are not possible
Conclusion We present a lexicon and framework for analyzing cyber conflict Future work: – Multiple Attacks – Imperfect Information – Incorporating issues outside of cyber (i.e. kinetic) 28
NPS OR Cyber interest points of contact: CDR Harrison Schramm – firstname.lastname@example.org email@example.com – 831 656 2358 Professor Matt Carlyle – firstname.lastname@example.org email@example.com Professor Dave Alderson – firstname.lastname@example.org email@example.com – 831 656 1814 Professor Ned Dimitrov – firstname.lastname@example.org email@example.com – 831 656 3647