论文标题
一种退缩的马MDP方法，用于对网络中移动目标防御的性能评估
A Receding-Horizon MDP Approach for Performance Evaluation of Moving Target Defense in Networks
论文作者
论文摘要
在本文中，我们研究了通过基于网络的移动目标防御来评估主动防御政策有效性的问题。我们使用概率攻击图建模网络系统 - 图形安全模型。鉴于具有主动防御策略的网络系统，智能攻击者需要反复执行侦察，以了解入侵检测系统的位置并最佳地重新计划以在避免检测的同时最佳地达到目标。为了计算攻击者的安全评估策略，我们使用对风险敏感的Markov决策过程开发了一种退化的Horizon规划算法，并具有时变奖励功能。最后，我们在合成网络中实施国防和攻击策略，并分析网络随机化的频率以及检测系统的数量如何影响攻击者的成功率。这项研究提供了针对机智攻击者的在线和多阶段攻击的主动防御策略的见解。
In this paper, we study the problem of assessing the effectiveness of a proactive defense-by-detection policy with a network-based moving target defense. We model the network system using a probabilistic attack graph--a graphical security model. Given a network system with a proactive defense strategy, an intelligent attacker needs to perform reconnaissance repeatedly to learn about the locations of intrusion detection systems and re-plan optimally to reach the target while avoiding detection. To compute the attacker's strategy for security evaluation, we develop a receding-horizon planning algorithm using a risk-sensitive Markov decision process with a time-varying reward function. Finally, we implement both defense and attack strategies in a synthetic network and analyze how the frequency of network randomization and the number of detection systems can influence the success rate of the attacker. This study provides insights for designing proactive defense strategies against online and multi-stage attacks by a resourceful attacker.
