Efficient heuristic improves defense of computer networks from stealthy hackers
Tractable Defense against Advanced Persistent Threats in Networked Settings
Cryptography and Security
Summary
Stopping sneaky hackers who quietly move through computer networks is very hard because defenders have limited information and resources. The authors study this problem using a mathematical model called Boolean Dynamical Systems that captures key challenges in these attacks. They create a new, simpler method to help defenders decide which computers to protect, making the problem easier to solve even for large networks. Their method is based on an assumption about the uncertainty of the system state, and they show it works well when this assumption roughly holds.
What this means in practice
- •For network defenders: Select which computers to secure proactively in large networks under stealthy, noisy attacks by using a computationally feasible heuristic strategy.
- •For information security teams: Improve automated defense tools that respond to ongoing intrusions by adopting a tractable value estimation based on maximum entropy assumptions.
Authors
Brandon Collins, Keith Paarporn, Shouhuai Xu, Philip N. Brown
Abstract
Recently, the theory of Boolean Dynamical Systems was proposed to study the decision theory surrounding the defense of computer networks against Advanced Persistent Threats (APTs). Boolean Dynamical Systems naturally capture four first principle primitives of APTs: the stealthy nature of attacks, limited and noisy information from automated systems like intrusion detection systems, lateral movement after the attacker penetrates into the network, and the defender's ability to secure a subset of computers at any time at the loss of resources such as system uptime. Currently, doing optimal/heuristic control in a computationally tractable manner is not possible because the emergent value function is computationally intractable (with respect to the network size). To resolve this, we propose a mean-field analysis inspired heuristic value function. We prove that our proposed heuristic is based on an exact computation of the value function under the assumption that the underlying state estimate distribution maximizes entropy. We numerically evaluate the quality of our heuristic as parameterized by the degree to which the entropy assumptions are violated.