Abstract
A model of a structured query language injection attack was designed using the Petri nets with players, strategies, and costs formalism. The formalism models the attacker and defender as competing players that can observe a specific subset of the net and act by changing the transition firing rates that the respective player can control. This model of the attack was based on the Common Attack Pattern and Enumeration Classification database and was validated by a panel of subject matter experts to be representative of a structured query language injection attack. The model was simulated with a reinforcement learning algorithm using an \(\upvarepsilon \)-greedy selection method. The algorithm learned within each iteration an optimal solution by varying player-controlled transitions rates. This paper describes the validation of the model, the design of the algorithm, and the results from 4 different \(\upvarepsilon \)-values.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Banks, J., Carson, J.S., Nelson, B.L., Nicol, D.M., Banks, C.M.: Discrete-Event System Simulation, 5th edn. Prentice-Hall, Upper Saddle River (2012)
Bland, J.A.: Machine learning of cyberattack and strategies. Ph.D. thesis, University of Alabama in Huntsville (2018)
Bland, J.A., Mayfield, K.P., Petty, M.D., Whitaker, T.S.: Validating Petri Net models of common attack pattern enumeration and classification. In: Proceedings of the 2017 AlaSim International Conference and Exposition, Huntsville, AL (2017)
Cantrell, W.A., Mayfield, K.P., Petty, M.D., Whitaker, T.S., Bland, J.A.: Structured face validation of extended Petri Nets for modeling cyberattacks. In: Proceedings of the 2017 AlaSim International Conference and Exposition, Huntsville, AL (2018)
Ferragut, E.M., Brady, A.C., Brady, E.J., Ferragut, J.M., Ferragut, N.M., Wildgruber, M.C.: HackAttack: game-theoretic analysis of realistic cyber conflicts. In: Proceedings of the 11th Annual Cyber and Information Security Research Conference, no. 1, p. 8. https://doi.org/10.1145/2897795.2897801. http://arxiv.org/abs/1511.04389
Henry, M.H., Layer, R.M., Snow, K.Z., Zaret, D.R.: Evaluating the risk of cyber attacks on SCADA systems via Petri Net analysis with application to hazardous liquid loading operations. In: 2009 IEEE Conference on Technologies for Homeland Security, HST 2009, pp 607–614 (2009). https://doi.org/10.1109/THS.2009.5168093
Lin, C., Wang, Y.: A stochastic game nets based approach for network security analysis. In: 29th International Conference on Application and Theory of Petri Nets and other Models of Concurrency, pp. 21–34 (2008)
Mayfield, K.P., Petty, M.D., Bland, J.A., Whitaker, T.S.: Composition of cyberattack models. In: Proceedings of the 31st International Conference on Computer Applications in Industry and Engineering, New Orleans, LA (2018)
Mayfield, K.P., Petty, M.D., Whitaker, T.S., Bland, J.A., Cantrell, W.A.: Component-based implementation of cyberattack simulation models. In: Proceedings of the ACM SouthEast 2019 Conference. Association for Computing Machinery, Kennesaw, GA (2019). https://doi.org/10.1145/3299815.3314435. ISBN 978-1-4503-6251-1
Mitchell, R., Chen, I.R.: Modeling and analysis of attacks and counter defense mechanisms for cyber physical systems. IEEE Trans. Reliab. 65(1), 350–358 (2016). https://doi.org/10.1109/TR.2015.2406860
MITRE: CAPEC - Common Attack Pattern Enumeration and Classification (CAPEC) (2018). https://capec.mitre.org/
OWASP: Open Web Application Security Project (2019). https://www.owasp.org/
Sutton, R., Barto, A.: Reinforcement Learning: An Introduction, 2nd edn. MIT Press, Cambridge (2017)
Zakrzewska, A.N., Ferragut, E.M.: Modeling cyber conflicts using an extended Petri Net formalism. In: IEEE SSCI 2011: Symposium Series on Computational Intelligence - CICS 2011: 2011 IEEE Symposium on Computational Intelligence in Cyber Security, pp. 60–67 (2011). https://doi.org/10.1109/CICYBS.2011.5949385
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Bland, J.A., Colvett, C.D., Cantrell, W.A., Mayfield, K.P., Petty, M.D., Whitaker, T.S. (2020). Machine Learning Cyberattack Strategies with Petri Nets with Players, Strategies, and Costs. In: Choo, KK., Morris, T., Peterson, G. (eds) National Cyber Summit (NCS) Research Track. NCS 2019. Advances in Intelligent Systems and Computing, vol 1055. Springer, Cham. https://doi.org/10.1007/978-3-030-31239-8_18
Download citation
DOI: https://doi.org/10.1007/978-3-030-31239-8_18
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-31238-1
Online ISBN: 978-3-030-31239-8
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)