Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework
Stealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Ligh...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-08-01
|
| Series: | Entropy |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1099-4300/22/8/894 |
| _version_ | 1797557975249846272 |
|---|---|
| author | Kaiming Xiao Cheng Zhu Junjie Xie Yun Zhou Xianqiang Zhu Weiming Zhang |
| author_facet | Kaiming Xiao Cheng Zhu Junjie Xie Yun Zhou Xianqiang Zhu Weiming Zhang |
| author_sort | Kaiming Xiao |
| collection | DOAJ |
| description | Stealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Light-weight countermeasures, on the other hand, can help retard the spread of stealth malwares, but the ensuing side effects might violate the primary safety requirement of CPS. Hence, defenders need to find a balance between the gain and loss of deploying light-weight countermeasures, which normally is a challenging task. To address this challenge, we model the persistent anti-malware process as a shortest-path tree interdiction (SPTI) Stackelberg game with both static version (SSPTI) and multi-stage dynamic version (DSPTI), and safety requirements of CPS are introduced as constraints in the defender’s decision model. The attacker aims to stealthily penetrate the CPS at the lowest cost (e.g., time, effort) by selecting optimal network links to spread, while the defender aims to retard the malware epidemic as much as possible. Both games are modeled as bi-level integer programs and proved to be NP-hard. We then develop a Benders decomposition algorithm to achieve the Stackelberg equilibrium of SSPTI, and design a Model Predictive Control strategy to solve DSPTI approximately by sequentially solving an <inline-formula><math display="inline"><semantics><mrow><mn>1</mn><mo>+</mo><mi>δ</mi></mrow></semantics></math></inline-formula> approximation of SSPTI. Extensive experiments have been conducted by comparing proposed algorithms and strategies with existing ones on both static and dynamic performance metrics. The evaluation results demonstrate the efficiency of proposed algorithms and strategies on both simulated and real-case-based CPS networks. Furthermore, the proposed dynamic defense framework shows its advantage of achieving a balance between fail-secure ability and fail-safe ability while retarding the stealth malware propagation in CPS. |
| first_indexed | 2024-03-10T17:24:49Z |
| format | Article |
| id | doaj.art-dec48b3d57b24705a9868083c33e51cb |
| institution | Directory Open Access Journal |
| issn | 1099-4300 |
| language | English |
| last_indexed | 2024-03-10T17:24:49Z |
| publishDate | 2020-08-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Entropy |
| spelling | doaj.art-dec48b3d57b24705a9868083c33e51cb2023-11-20T10:14:31ZengMDPI AGEntropy1099-43002020-08-0122889410.3390/e22080894Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical FrameworkKaiming Xiao0Cheng Zhu1Junjie Xie2Yun Zhou3Xianqiang Zhu4Weiming Zhang5Science and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, ChinaScience and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, ChinaScience and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, ChinaScience and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, ChinaScience and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, ChinaScience and Technology on Information Systems Engineering Laboratory, National University of Defense Technology, Changsha 410073, ChinaStealth malware is a representative tool of advanced persistent threat (APT) attacks, which poses an increased threat to cyber-physical systems (CPS) today. Due to the use of stealthy and evasive techniques, stealth malwares usually render conventional heavy-weight countermeasures inapplicable. Light-weight countermeasures, on the other hand, can help retard the spread of stealth malwares, but the ensuing side effects might violate the primary safety requirement of CPS. Hence, defenders need to find a balance between the gain and loss of deploying light-weight countermeasures, which normally is a challenging task. To address this challenge, we model the persistent anti-malware process as a shortest-path tree interdiction (SPTI) Stackelberg game with both static version (SSPTI) and multi-stage dynamic version (DSPTI), and safety requirements of CPS are introduced as constraints in the defender’s decision model. The attacker aims to stealthily penetrate the CPS at the lowest cost (e.g., time, effort) by selecting optimal network links to spread, while the defender aims to retard the malware epidemic as much as possible. Both games are modeled as bi-level integer programs and proved to be NP-hard. We then develop a Benders decomposition algorithm to achieve the Stackelberg equilibrium of SSPTI, and design a Model Predictive Control strategy to solve DSPTI approximately by sequentially solving an <inline-formula><math display="inline"><semantics><mrow><mn>1</mn><mo>+</mo><mi>δ</mi></mrow></semantics></math></inline-formula> approximation of SSPTI. Extensive experiments have been conducted by comparing proposed algorithms and strategies with existing ones on both static and dynamic performance metrics. The evaluation results demonstrate the efficiency of proposed algorithms and strategies on both simulated and real-case-based CPS networks. Furthermore, the proposed dynamic defense framework shows its advantage of achieving a balance between fail-secure ability and fail-safe ability while retarding the stealth malware propagation in CPS.https://www.mdpi.com/1099-4300/22/8/894cyber-physical systemsstealth malware propagationStackelberg gamenetwork interdictiondynamic defense |
| spellingShingle | Kaiming Xiao Cheng Zhu Junjie Xie Yun Zhou Xianqiang Zhu Weiming Zhang Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework Entropy cyber-physical systems stealth malware propagation Stackelberg game network interdiction dynamic defense |
| title | Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework |
| title_full | Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework |
| title_fullStr | Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework |
| title_full_unstemmed | Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework |
| title_short | Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework |
| title_sort | dynamic defense against stealth malware propagation in cyber physical systems a game theoretical framework |
| topic | cyber-physical systems stealth malware propagation Stackelberg game network interdiction dynamic defense |
| url | https://www.mdpi.com/1099-4300/22/8/894 |
| work_keys_str_mv | AT kaimingxiao dynamicdefenseagainststealthmalwarepropagationincyberphysicalsystemsagametheoreticalframework AT chengzhu dynamicdefenseagainststealthmalwarepropagationincyberphysicalsystemsagametheoreticalframework AT junjiexie dynamicdefenseagainststealthmalwarepropagationincyberphysicalsystemsagametheoreticalframework AT yunzhou dynamicdefenseagainststealthmalwarepropagationincyberphysicalsystemsagametheoreticalframework AT xianqiangzhu dynamicdefenseagainststealthmalwarepropagationincyberphysicalsystemsagametheoreticalframework AT weimingzhang dynamicdefenseagainststealthmalwarepropagationincyberphysicalsystemsagametheoreticalframework |