Toward an integrated dynamic defense system for strategic detecting attacks in cloud networks using stochastic game

Abstract

In a complex network as a cloud computing environment, security is becoming increasingly based on deception techniques. To date, the static nature of cyber networks offers to adversaries good opportunities to systematically study the network environment, launch a cyber-attack effortlessly and wide-spread and finally defeat the target system. In order to resolve the limitations of the traditional security measures as intrusion prevention or detection systems, firewall, access list, etc., which did not change the attack surface and cannot avoid zero-days attacks, technics that provide dynamic defense, such virtual machine migration and honeypot should be deployed. Despite this, with a virtual machine migration technique, not all virtual machines’ migration between servers enhances security considerably. In this paper, we propose an integrated defense system combining virtual machine migration and honeypot. The effectiveness of the proposed system is discussed in terms of security policies. In addition, our proposed model determines the potential attack paths quantitatively then classifies them into two sub-sets: attack paths explored only and attack paths explored and exploited based on the black box intrusion steps. Thus, to model the interaction attacker–defender, the attack graph combined with the stochastic game theory is used. Finally, we carry out some numerical results to demonstrate the effectiveness of the proposed security game model.

Appendices

A Appendix

Proof of Theorem 1

For a fixed value of $u_{s}$ we have:

• If $M_{s}$ is played by the defender then the best response of the attacker is $AP_{i_{0}}$ with: $i_{0}=\underset{i \in \{1, \ldots , m\}}{argmax} u_{s} \alpha _{i} L_{i}-\beta _{i} C_{i}$.

• If ${\overline{M}}$ is played by the defender than then best response of the defender is $AP_{m}$.

Therefore, the Nash equilibrium are given as follows:

• If $i_{0}=m$:

  • If $u_{s}<1-\frac{C^{M}}{\alpha _{m} L_{m}}$: $NE_{pure}=\left( M_{s}, AP_{m}\right)$,

  • If $u_{s} \ge 1-\frac{C^{M}}{\alpha _{m} L_{m}}$: $NE_{pure}=\left( {\overline{M}}, AP_{m}\right)$.

• If $i_{0} \ne m$:

  • If $u_{s} \le 1-\frac{C^{M}}{\alpha _{i_{0}} L_{i_{0}}}$: $NE_{pure}=\left( M_{s}, AP_{i_{0}}\right)$,

  • If $u_{s} \ge 1-\frac{C^{M}}{\alpha _{m} L_{m}}$: $NE_{pure}=\left( {\overline{M}}, AP_{m}\right)$,

  • If $1-\frac{C^{M}}{\alpha _{i_{0}} L_{i_{0}}}<u_{s}<1-\frac{C^{M}}{\alpha _{m} L_{m}}$: we have a mixed Nash equilibrium

    $NE_{\text{ mixed }}=\left( x \times A P_{i_{0}}+(1-x) \times AP_{m}, y \times M_{s}\right.$$\left. +(1-y) \times {\overline{M}}\right)$ Indeed x and y are computed as follows:

    ${\mathcal {E}}_{{ Def}}(M_{s})={\mathcal {E}}_{{ Def}}({\overline{M}}) \Leftrightarrow x=\frac{\alpha _{m} L_{m}\left( 1-u_{s}\right) -C^{M}}{\left( \alpha _{m} L_{m}-\alpha _{i_{0}} L_{i_{0}}\right) \left( 1-u_{s}\right) }$

    ${\mathcal {E}}_{At}\left( AP_{m}\right) ={\mathcal {E}}_{At}\left( AP_{i_{0}}\right) \Leftrightarrow y=\frac{1}{1-u_{s}}$$\times \left( 1-\frac{\beta _{m} C_{m}-\beta _{i_{0}} C_{i_{0}}}{\alpha _{m} L_{m}-\alpha _{i_{0}} L_{i_{0}}}\right)$.

$\square$

B Appendix

• 1. Proof that the strategy $M_{{\overline{s}}}$ is a strictly dominated by $M_{s}$:

  For $i \in \{1, \ldots , n\}$: $u_{s}<u_{{\overline{s}}} \Leftrightarrow u_{s} \alpha _{i} L_{i}<u_{{\overline{s}}} \alpha _{i} L_{i} \Leftrightarrow -u_{{\overline{s}}} \alpha _{i} L_{i}<-u_{s} \alpha _{i} L_{i}$.

  Thereby: $-u_{{\overline{s}}} \alpha _{i} L_{i}-C^{M}<-u_{s} \alpha _{i} L_{i}-C^{M}$

  Then the strategy $M_{{\overline{s}}}$ is strictly dominated by $M_{s}$.

• 2. The Bayesian sub-game $g^{i}_{{\overline{m}}}$ is resolved by using the mathematical expression related to compute the Bayesian Nash equilibrium. Hence, we obtain:

  $$\begin{aligned} {\left\{ \begin{array}{ll} \mu _{{ Def}}({\overline{M}}|Hp)=1 \\ \mu _{{ Def}}(.|Rn) \in {{\,\mathrm{argmax}\,}}_{\gamma \in \varDelta \left( A^{Rn}_{{ Def}}\left( g^{i}_{{\overline{m}}} \right) \right) } \in \\ \left[ \gamma \left( M_{s} \right) \left( -C^{M}+\mu _{At}\left( A|Ml \right) \left( 1-u_{s} \right) \left( 1-\alpha _{i} \right) L_{i}\right) \right. \\ \quad \left. -h-\mu _{At}\left( A|Ml \right) \left( 1-\alpha _{i} \right) L_{i} \right] \\ \mu _{At}(.|Ml) \in {{\,\mathrm{argmax}\,}}_{\gamma \in \varDelta \left( A^{Ml}_{At}\left( g^{i}_{{\overline{m}}} \right) \right) } \in \\ \gamma \left( A \right) \left[ \theta \left( 1-\alpha _{i} \right) L_{i}\left( 1-\left( 1-\mu _{s} \right) \mu _{{ Def}}\left( M|Rn \right) \right) -\left( 1-\beta _{i} \right) C_{i} \right] \end{array}\right. } \end{aligned}$$

  Then, the probability distributions $\mu _{{ Def}}(.|Rn)$ and $\mu _{At}(.|Ml)$ are defined as follows:

  • If $\left( 1-\alpha _{i}\right) L_{i} \ge u_{s}\left( 1-\alpha _{i}\right) L_{i}+C^{M}$:

    • If $\theta \left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i}$: ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=1 \\ \mu _{At}(A|Ml)=1 \end{array}\right. }$

    • If $\theta \left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=\frac{1}{1-u_{s}}\left( 1-\frac{\left( 1-\beta _{i}\right) C_{i}}{\theta \left( 1-\alpha _{i}\right) L_{i}}\right) \\ \mu _{At}(A|Ml)=\frac{C^{M}}{\left( 1-u_{s}\right) \left( 1-\alpha _{i}\right) L_{i}} \end{array}\right. }$

    • If $\left( 1-\beta _{i}\right) C_{i} \ge \theta \left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=0 \\ \mu _{At}(A|Ml)=0 \end{array}\right. }$

  • If $u_{s}\left( 1-\alpha _{i}\right) L_{i}+C^{M}>\left( 1-\alpha _{i}\right) L_{i}$:

    • If $\theta \left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i}$ or $\theta \left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=0 \\ \mu _{At}(A|Ml)=1 \end{array}\right. }$

    • If $\left( 1-\beta _{i}\right) C_{i} \ge \theta \left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=0 \\ \mu _{At}(A|Ml)=0 \end{array}\right. }$

  Secondly, the Bayesian sub-game $g_{m}^{i}$ is resolved below by using the same approach presented above. Then, we obtain:

  $$\begin{aligned} {\left\{ \begin{array}{ll} \mu _{{ Def}}({\overline{M}}|Hp)=1 \\ \mu _{{ Def}}(.|Rn) \in {{\,\mathrm{argmax}\,}}_{\gamma \in \varDelta \left( A^{Rn}_{{ Def}}\left( g^{i}_{m} \right) \right) }\in \\ \gamma \left( M_{s} \right) \left[ -C^{M}+\mu _{At}\left( A|Ml \right) u_{s}\left( 1-v_{s} \right) \left( 1-\alpha _{i} \right) L_{i} \right] \\ \quad -h-\mu _{At}\left( A|Ml \right) u_{s}\left( 1-\alpha _{i} \right) L_{i}\\ \mu _{At}(.|Ml) \in {{\,\mathrm{argmax}\,}}_{\gamma \in \varDelta \left( A^{Ml}_{At}\left( g^{i}_{m} \right) \right) } \in \\ \gamma \left( A \right) \left[ \theta u_{s}\left( 1-\alpha _{i} \right) L_{i}\left( 1-\left( 1-v_{s} \right) \mu _{{ Def}}\left( M|Rn \right) \right) \right. \\ \quad \left. -\left( 1-\beta _{i} \right) C_{i} \right] \end{array}\right. } \end{aligned}$$

  Then, the probability distributions $\mu _{{ Def}}(.|Rn)$ and $\mu _{At}(.|Ml)$ are defined as follows:

  • If $u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge v_{s} u_{s}\left( 1-\alpha _{i}\right) L_{i}+C^{M}$:

    • If $\theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s} v_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i}$: ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=1\\ \mu _{At}(A|Ml)=1 \end{array}\right. }$

    • If $\theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i} \ge \theta u_{s} v_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=\frac{1}{1-v_{s}}\left( 1-\frac{\left( 1-\beta _{i}\right) C_{i}}{\theta u_{s}\left( 1-\alpha _{i}\right) L_{i}}\right) \\ \mu _{At}(A|Ml)=\frac{C^{M}}{u_{s}\left( 1-v_{s}\right) \left( 1-\alpha _{i}\right) L_{i}} \end{array}\right. }$

    • If $\left( 1-\beta _{i}\right) C_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s} v_{s}\left( 1-\alpha _{i}\right) L_{i}$: ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=0\\ \mu _{At}(A|Ml)=0 \end{array}\right. }$

  • If $v_{s} u_{s}\left( 1-\alpha _{i}\right) L_{i}+C^{M} \ge u_{s}\left( 1-\alpha _{i}\right) L_{i}$:

    • If $\theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s} v_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i}$ or

      $\theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \left( 1-\beta _{i}\right) C_{i} \ge \theta u_{s} v_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=0\\ \mu _{At}(A|Ml)=1 \end{array}\right. }$

    • If $\left( 1-\beta _{i}\right) C_{i} \ge \theta u_{s}\left( 1-\alpha _{i}\right) L_{i} \ge \theta u_{s} v_{s}\left( 1-\alpha _{i}\right) L_{i}$:

      ${\left\{ \begin{array}{ll} \mu _{{ Def}}(M_{s}|Rn)=0\\ \mu _{At}(A|Ml)=0 \end{array}\right. }$.