5,330 research outputs found
Game Theory Meets Network Security: A Tutorial at ACM CCS
The increasingly pervasive connectivity of today's information systems brings
up new challenges to security. Traditional security has accomplished a long way
toward protecting well-defined goals such as confidentiality, integrity,
availability, and authenticity. However, with the growing sophistication of the
attacks and the complexity of the system, the protection using traditional
methods could be cost-prohibitive. A new perspective and a new theoretical
foundation are needed to understand security from a strategic and
decision-making perspective. Game theory provides a natural framework to
capture the adversarial and defensive interactions between an attacker and a
defender. It provides a quantitative assessment of security, prediction of
security outcomes, and a mechanism design tool that can enable
security-by-design and reverse the attacker's advantage. This tutorial provides
an overview of diverse methodologies from game theory that includes games of
incomplete information, dynamic games, mechanism design theory to offer a
modern theoretic underpinning of a science of cybersecurity. The tutorial will
also discuss open problems and research challenges that the CCS community can
address and contribute with an objective to build a multidisciplinary bridge
between cybersecurity, economics, game and decision theory
Multi-Layer Cyber-Physical Security and Resilience for Smart Grid
The smart grid is a large-scale complex system that integrates communication
technologies with the physical layer operation of the energy systems. Security
and resilience mechanisms by design are important to provide guarantee
operations for the system. This chapter provides a layered perspective of the
smart grid security and discusses game and decision theory as a tool to model
the interactions among system components and the interaction between attackers
and the system. We discuss game-theoretic applications and challenges in the
design of cross-layer robust and resilient controller, secure network routing
protocol at the data communication and networking layers, and the challenges of
the information security at the management layer of the grid. The chapter will
discuss the future directions of using game-theoretic tools in addressing
multi-layer security issues in the smart grid.Comment: 16 page
Game Theory in Distributed Systems Security: Foundations, Challenges, and Future Directions
Many of our critical infrastructure systems and personal computing systems
have a distributed computing systems structure. The incentives to attack them
have been growing rapidly as has their attack surface due to increasing levels
of connectedness. Therefore, we feel it is time to bring in rigorous reasoning
to secure such systems. The distributed system security and the game theory
technical communities can come together to effectively address this challenge.
In this article, we lay out the foundations from each that we can build upon to
achieve our goals. Next, we describe a set of research challenges for the
community, organized into three categories -- analytical, systems, and
integration challenges, each with "short term" time horizon (2-3 years) and
"long term" (5-10 years) items. This article was conceived of through a
community discussion at the 2022 NSF SaTC PI meeting.Comment: 11 pages in IEEE Computer Society magazine format, including
references and author bios. There is 1 figur
Risk analysis beyond vulnerability and resilience - characterizing the defensibility of critical systems
A common problem in risk analysis is to characterize the overall security of
a system of valuable assets (e.g., government buildings or communication hubs),
and to suggest measures to mitigate any hazards or security threats. Currently,
analysts typically rely on a combination of indices, such as resilience,
robustness, redundancy, security, and vulnerability. However, these indices are
not by themselves sufficient as a guide to action; for example, while it is
possible to develop policies to decrease vulnerability, such policies may not
always be cost-effective. Motivated by this gap, we propose a new index,
defensibility. A system is considered defensible to the extent that a modest
investment can significantly reduce the damage from an attack or disruption. To
compare systems whose performance is not readily commensurable (e.g., the
electrical grid vs. the water-distribution network, both of which are critical,
but which provide distinct types of services), we defined defensibility as a
dimensionless index. After defining defensibility quantitatively, we illustrate
how the defensibility of a system depends on factors such as the defender and
attacker asset valuations, the nature of the threat (whether intelligent and
adaptive, or random), and the levels of attack and defense strengths and
provide analytical results that support the observations arising from the above
illustrations. Overall, we argue that the defensibility of a system is an
important dimension to consider when evaluating potential defensive
investments, and that it can be applied in a variety of different contexts.Comment: 36 pages; Keywords: Risk Analysis, Defensibility, Vulnerability,
Resilience, Counter-terroris
- …