Automated threat containment adjusts dynamically to live cyber risk
From Reconnaissance to Response: Quantitative Risk Parameterization and Game Theoretic Containment in Modern Enterprise Attack
Computer Science and Game TheoryCryptography and Security
Summary
Many security teams respond too slowly to early signs of cyberattacks, letting hackers gather information and get closer to success. The authors created a system that uses real-time security data to estimate the chance of a successful attack and decide when to automatically isolate parts of a network. They use math models that update as new information comes in, enabling faster reactions. Tests using data from big casino cyberattacks showed the system quickly stops threats while ignoring false alarms.
What this means in practice
- •For security operations teams: Enable rapid automated network isolation decisions based on live attack and vulnerability data to reduce incident response delays.
- •For cybersecurity automation engineers: Incorporate dynamic risk modeling and game theoretic thresholds to build adaptive SOAR workflows that adjust for changing attacker behavior.
Authors
Shadeeb Hossain
Abstract
Modern Security Operations Centers struggle with delayed manual incident response, enabling adversaries to advance through the Cyber Kill Chain during early stage reconnaissance. While classical game theoretic defense models optimize strategic resource allocation, they rely on static utility matrices that fail to adapt to dynamic telemetry. This paper presents an integrated, metrics driven decision engine that bridges quantitative risk parameterization and continuous automated response time. Common Vulnerability Scoring Systems exploitability parameters are mapped to attacker success probabilities and evaluate defender log distributions via Factor Analysis of Information Risk Monte Carlo simulations. Real time SIEM logs streams are modeled as Poisson process arrival rates, dynamically updating defender posterior threat belief through sequential Bayesian filtering. A closed form threshold is derived by framing the interaction as a dynamic Bayesian Stackelberg game, where the expected unmitigated risk exceeds proactive containment cost. Parameterized against empirical data from the 2023 MGM Resorts and Caesars Entertainment cyber incident, simulation results demonstrate that the engine suppresses transient background noise while triggering automated SOAR network isolation within seconds of adversarial probing. Multi parameter sensitivity analysis confirms that the decision boundary dynamically adjusts to live perimeter vulnerability, offering a control theoretic foundation for sub minute automated threat containment.