04
Real World National Security Agency discloses 91% of the zero-day vulnerabilities (that it discovers in software made and/or used in the U.S. to developers).
Admiral Michael Rogers, Director of the NSA 4<br>
05
1. Action Sequence For a zero-day vulnerability 5 Withhold and Attack Disclose and Patch +<br>
06
1. Action Sequence 6 Player 1 attacks Player 2<br>
07
2. Uncertainty of the Other Players Has another player discovered the vulnerability yet?
How likely will another player discover the vulnerability in the future? 7<br>
08
3. Ricochet & Patch-based Exploit Generation (PEG) The Ricochet attack: to generate an exploit based on a receiving exploit [1].
The Patch-based Exploit Generation (PEG): to generate an exploit based on a receiving patch. 8 [1] T. Bao, Y. Shoshitaishvili, R. Wang and D. Brumley. Your Exploit is Mine: Automatic Shellcode Transplant for Remote Exploits, Proceedings of the 38th IEEE Symposium on Security and Privacy, 2017.<br>
09
3. Ricochet: Collateral Damage Utility = # machines a player wins - # machines a player loses
if Player 1 does not attack: 0
if Player 1 attacks Player 2: 9 Player 1 Attack Player 2 Ricochet 2 - 5 = -3<br>
10
Previous Work 10 [2] T. Moore, A. Friedman, and A. D. Procaccia. Would a ‘cyber warrior’ protect us? Exploring trade-offs between attack and defense of information systems. In Proceedings of the Workshop on New Security Paradigms, pages 85–94, 2010 [3] H. C. Schramm, D. L. Alderson, W. M. Carlyle, and N. B. Dimitrov. A game theoretic model of strategic conflict in cyberspace. Military Operations Research, 19(1):5–17, 2014.<br>
11
Our Work: the Cyber-warfare Model Scope
One vulnerability
Independent and rational players
Outline
One player: the player model
Multiple players: the game model
Nash equilibrium 11<br>
12
Player Model 12 Knowing a Zero-day Vulnerability Player Action Player’s Machines<br>
13
Player Model 13 Observe disclosure from the others Player Discover by self Detect exploits from the others Action Player’s Machines<br>
14
Player Model 14 Observe disclosure from the others Player Player’s Machines Discover by self Detect exploits from the others Exploit Generation Patch-based Exploit Generation The Ricochet Attack Action<br>
15
Player Parameters 15 Observe disclosure from the others Player Discover by self Detect exploits from the others Exploit Generation Patch-based Exploit Generation The Ricochet Attack Attack Patch Player’s Machines<br>
16
Player State and Player Action Player States
Not Discovered a zero-day vulnerability
Discovered a zero-day vulnerability
Player Actions
: Nop
: Attack, Patch, Stockpile 16<br>
17
Player State and Player Action 17 Attack Stockpile Patch Nop Collect Information End Make a Decision<br>
18
Multiple Players 18 Player 1 Player 2 Player 1 Player 2<br>
19
Rounded Game: Game Tree 19 Player 1 Player 2 A, N S, N P, N Player 2 Player 1<br>
20
Stochastic Game 20 A, N S, N N, N P, N<br>
21
Incomplete Information 21 Player 1 Player 2 Player 1 Player 2<br>
22
Player 1’s Perspective 22<br>
23
Player 2’s Perspective 23<br>
24
Ricochet + PEG 24 Player 1 Player 2<br>
25
Ricochet 25 Player 1 Player 2 Attack Attack<br>
26
Patch-based Exploit Generation 26 Player 1 Player 2 Patch Attack<br>
27
Game Model Therefore, we model the game as:
a stochastic game, and
an incomplete information game.
Partial-observation Stochastic Game (POSG). 27<br>
28
Computing Nash Equilibrium Nash equilibrium: the strategy profile where all players play their optimal strategy.
Computing the Nash equilibrium for POSG is known to be intractable[4]. 28 [4] L. MacDermed, C. L. Isbell, and L. Weiss. Markov games of incomplete information for multi-agent reinforcement learning. In Workshops at the Twenty-Fifth AAAI Conference on Artificial Intelligence, pages 43–51, 2011.<br>
29
Computing Nash Equilibrium For the Cyber-warfare game, we observe:
Players infer the the other player’s state by player’s parameters.
Assuming the parameters are accessible, thus the inference is also public.
Convert from POSG to Stochastic Game (SG)
Compute the Nash equilibrium for SG using the Shapley Method (dynamic programming). 29<br>
30
Evaluation 1: Review Previous Conclusions 30 [2] T. Moore, A. Friedman, and A. D. Procaccia. Would a ‘cyber warrior’ protect us? Exploring trade-offs between attack and defense of information systems. In Proceedings of the Workshop on New Security Paradigms, pages 85–94, 2010 [3] H. C. Schramm, D. L. Alderson, W. M. Carlyle, and N. B. Dimitrov. A game theoretic model of strategic conflict in cyberspace. Military Operations Research, 19(1):5–17, 2014. At least one player wants to attack. The attacking player(s) should attack right away. It is possible that neither player wants to attack.<br>
31
Neither Player Attacks 31 Player 1 discovers the vulnerability Player 2 generates the exploit<br>
32
Evaluation 2: Cyber Grand Challenge Strategic-Shellphish: Shellphish + strategy based on the Cyber-warfare model.
Consider all the teams as one player. 32 Shellphish
254452 Strategic-Shellphish
268543<br>
33
Conclusion Cyber-warfare game, which addresses the limitations of previous work regarding:
Actions over time
Ricochet and Patch-based exploit generation
Uncertainty of the other player
We find a method to compute the Nash Equilibrium of the Cyber-warfare game.
Applications:
We observe that Ricochet may lead to neither players attack.
We could help teams such as Shellphish with more scores. 33<br>
36
Multiple Players’ Actions over Time 36 T0. A vulnerability is introduced.
T1. Player 1 realizes the vulnerability.
T2. Player 1 launches an attack.
T3. Player 1 starts to patch and Player 2 realizes the vulnerability. Time T1 T2 T3 T0<br>
