Dynamic Information Flow Tracking for Detection of Advanced Persistent Threats: A Stochastic Game Approach

• 成果类型: Article
• 署名作者: Moothedath, Shana; Sahabandu, Dinuka; Allen, Joey; Clark, Andrew; Bushnell, Linda; Lee, Wenke; Poovendran, Radha
• 署名单位: University of Washington; University of Washington Seattle; University System of Georgia; Georgia Institute of Technology; Washington University (WUSTL)
• 刊物名称: IEEE TRANSACTIONS ON AUTOMATIC CONTROL
• ISSN/ISSBN: 0018-9286
• DOI: 10.1109/TAC.2024.3403675
• 发表日期: 2024
• 页码: 6684-6699
• 关键词: games; security; Stochastic processes; Analytical models; COSTS; Flow graphs; Science - general; Advanced persistent threats (APTs); information flow tracking; minimum-cut problem; stochastic games

摘要

Advanced persistent threats (APTs) are stealthy attacks by intelligent adversaries. This article studies the detection of APTs that infiltrate cyber systems and compromise specifically targeted data and/or infrastructures. Dynamic information flow tracking is an information trace-based detection mechanism against APTs that tags suspicious information flows in the system and performs security analysis for unauthorized use of tagged data. In this article, we develop an analytical model for resource-efficient detection of APTs using an information flow tracking game. The game is a nonzero-sum, turn-based, stochastic game with asymmetric information as the defender cannot distinguish whether an incoming flow is malicious or benign. The payoff functions of the game capture the cost for performing security analysis and the rewards and penalties received by the players. We analyze equilibrium of the game and prove that a Nash equilibrium is given by a solution to the minimum capacity cut set problem on a flow-network derived from the system. The edge capacities of the flow-network are obtained from the cost of performing security analysis. Finally, we implement our algorithm on a real-world dataset for a data exfiltration attack augmented with false-negative and false-positive rates and compute an optimal defender strategy.