Combating Ransomware in Internet of Things: A Games-in-Games Approach for Cross-Layer Cyber Defense and Security Investment

Abstract

The recent surge in ransomware attacks has threatened many critical infrastructures such as oil pipeline systems, hospitals, and industrial Internet of Things (IoT). Ransomware is a cryptoviral extortion attack that involves two phases: the cyber infection of the malware and the financial transaction of the ransom payment. As the ransomware attackers are financially motivated, the protection of the infrastructure networked systems requires a cross-layer risk analysis that not only examines the vulnerability of the cyber system but also consolidates the economics of ransom payment. To this end, this paper establishes a two-player multi-phase and multi-stage game framework to model cyber and economic phases of a ransomware attack. We use a zero-sum Markov game to capture the multi-stage penetration of ransomware in the lateral movement. A sequential-move game is proposed to model the ransom payment interactions at the second phase. Two games are composed to form a multi-phase and multi-stage game-in-games (MPMS-GiG) that enables a holistic risk assessment of ransomware in networks and a cross-layer design of cyber defense and investment strategies to mitigate the attack. We provide a complete equilibrium characterization of ransomware game and design interdependent optimal strategies for cyber protection and ransom payment. We use prospect theory to analyze the impact of human factors on equilibrium strategies. Finally, we use a prototypical industrial IoT network as a case study to corroborate the results.

This work is partially supported by grants SES-1541164, ECCS-1847056, CNS-2027884, and BCS-2122060 from National Science Foundation (NSF), DOE-NE grant 20-19829 and grant W911NF-19-1-0041 from Army Research Office (ARO).

A Proof in the Budget Dilemma

Recall that $\hat{r}_d$ is the root of $g(r_d,B) = B-r_d - f(r_d)$ for small B. Assume the differentiability of $\theta$ and $c_f$, it is easy to show that $f'(r_d) > 0$. Using the implicit function theorem, we can find a function $\hat{r}_d = h(B)$ in the neighborhood of $(B, \hat{r}_d)$ where $g(r_d, B) = 0$. Hence, we have $\frac{\mathrm {d} \hat{r}_d}{\mathrm {d} B} = -(-1-f'(\hat{r}_d))^{-1} = \frac{1}{1+f'(\hat{r}_d)} > 0$. The defender’s utility is $-\hat{r}_d$ if she chooses to invest $\hat{r}_d$. Thus, $\frac{\mathrm {d} (-\hat{r}_d)}{\mathrm {d} B} < 0$.