Network Defense Decision-Making Based on a Stochastic Game System and a Deep Recurrent Q-Network

Cyber defense requires decision making under uncertainty, yet this critical area has not been a focus of research in judgment and decision-making. Future defense systems, which will rely on software-defined networks and may employ “moving target” defenses, will increasingly automate lower level detection and analysis, but will still require humans in the loop for higher level judgment. We studied the decision making process and outcomes of 17 experienced network defense professionals who worked through a set of realistic network defense scenarios. We manipulated gain versus loss framing in a cyber defense scenario, and found significant effects in one of two focal problems. Defenders that began with a network already in quarantine (gain framing) used a quarantine system more, as measured by cost, than those that did not (loss framing). We also found some difference in perceived workload and efficacy. Alternate explanations of these findings and implications for network defense are discussed.

Download Full-text

Optimal Decision-Making Approach for Cyber Security Defense Using Game Theory and Intelligent Learning

Security and Communication Networks ◽

10.1155/2019/3038586 ◽

2019 ◽

Vol 2019 ◽

pp. 1-16 ◽

Cited By ~ 2

Author(s):

Yuchen Zhang ◽

Jing Liu

Keyword(s):

Decision Making ◽

Cyber Security ◽

Learning Algorithm ◽

Stochastic Game ◽

Learning Ability ◽

Optimal Decision ◽

Equilibrium Strategy ◽

Cyber Attack ◽

Defense Strategies ◽

Network States

Existing approaches of cyber attack-defense analysis based on stochastic game adopts the assumption of complete rationality, but in the actual cyber attack-defense, it is difficult for both sides of attacker and defender to meet the high requirement of complete rationality. For this aim, the influence of bounded rationality on attack-defense stochastic game is analyzed. We construct a stochastic game model. Aiming at the problem of state explosion when the number of network nodes increases, we design the attack-defense graph to compress the state space and extract network states and defense strategies. On this basis, the intelligent learning algorithm WoLF-PHC is introduced to carry out strategy learning and improvement. Then, the defense decision-making algorithm with online learning ability is designed, which helps to select the optimal defense strategy with the maximum payoff from the candidate strategy set. The obtained strategy is superior to previous evolutionary equilibrium strategy because it does not rely on prior data. By introducing eligibility trace to improve WoLF-PHC, the learning speed is further improved and the defense timeliness is significantly promoted.

Download Full-text

A Versatile Stochastic Duel Game

Mathematics ◽

10.3390/math8050678 ◽

2020 ◽

Vol 8 (5) ◽

pp. 678 ◽

Cited By ~ 2

Author(s):

Song-Kyoo (Amang) Kim

Keyword(s):

Decision Making ◽

Time Domain ◽

Stochastic Game ◽

Business Case ◽

Optimal Number ◽

Game Model ◽

Strategic Decisions ◽

The Time Domain ◽

Continuum Of States ◽

Number Of Iterations

This paper deals with a standard stochastic game model with a continuum of states under the duel-type setup. It newly proposes a hybrid model of game theory and the fluctuation process, which could be applied for various practical decision making situations. The unique theoretical stochastic game model is targeted to analyze a two-person duel-type game in the time domain. The parameters for strategic decisions including the moments of crossings, prior crossings, and the optimal number of iterations to get the highest winning chance are obtained by the compact closed joint functional. This paper also demonstrates the usage of a new time based stochastic game model by analyzing a conventional duel game model in the distance domain and briefly explains how to build strategies for an atypical business case to show how this theoretical model works.

Download Full-text