One size does not fit all: A game-theoretic approach for dynamically and effectively screening for threats

An effective way of preventing attacks in secure areas is to screen for threats (people, objects) before entry, e.g., screening of airport passengers. However, screening every entity at the same level may be both ineffective and undesirable. The challenge then is to find a dynamic approach for randomized screening, allowing for more effective use of limited screening resources, leading to improved security. We address this challenge with the following contributions: (1) a threat screening game (TSG) model for general screening domains; (2) an NP-hardness proof for computing the optimal strategy of TSGs; (3) a scheme for decomposing TSGs into subgames to improve scalability; (4) a novel algorithm that exploits a compact game representation to efficiently solve TSGs, providing the optimal solution under certain conditions; and (5) an empirical comparison of our proposed algorithm against the current state-of-the-art optimal approach for large-scale game-theoretic resource allocation problems

Draining the Water Hole: Mitigating Social Engineering Attacks with CyberTWEAK

Cyber adversaries have increasingly leveraged social engineering attacks to breach large organizations and threaten the well-being of today's online users. One clever technique, the "watering hole" attack, compromises a legitimate website to execute drive-by download attacks by redirecting users to another malicious domain. We introduce a game-theoretic model that captures the salient aspects for an organization protecting itself from a watering hole attack by altering the environment information in web traffic so as to deceive the attackers. Our main contributions are (1) a novel Social Engineering Deception (SED) game model that features a continuous action set for the attacker, (2) an in-depth analysis of the SED model to identify computationally feasible real-world cases, and (3) the CyberTWEAK algorithm which solves for the optimal protection policy. To illustrate the potential use of our framework, we built a browser extension based on our algorithms which is now publicly available online. The CyberTWEAK extension will be vital to the continued development and deployment of countermeasures for social engineering.Comment: IAAI-20, AICS-2020 Worksho

Imitative Follower Deception in Stackelberg Games

Information uncertainty is one of the major challenges facing applications of game theory. In the context of Stackelberg games, various approaches have been proposed to deal with the leader's incomplete knowledge about the follower's payoffs, typically by gathering information from the leader's interaction with the follower. Unfortunately, these approaches rely crucially on the assumption that the follower will not strategically exploit this information asymmetry, i.e., the follower behaves truthfully during the interaction according to their actual payoffs. As we show in this paper, the follower may have strong incentives to deceitfully imitate the behavior of a different follower type and, in doing this, benefit significantly from inducing the leader into choosing a highly suboptimal strategy. This raises a fundamental question: how to design a leader strategy in the presence of a deceitful follower? To answer this question, we put forward a basic model of Stackelberg games with (imitative) follower deception and show that the leader is indeed able to reduce the loss due to follower deception with carefully designed policies. We then provide a systematic study of the problem of computing the optimal leader policy and draw a relatively complete picture of the complexity landscape; essentially matching positive and negative complexity results are provided for natural variants of the model. Our intractability results are in sharp contrast to the situation with no deception, where the leader's optimal strategy can be computed in polynomial time, and thus illustrate the intrinsic difficulty of handling follower deception. Through simulations we also examine the benefit of considering follower deception in randomly generated games

Measurement of the production of a W boson in association with a charm quark in pp collisions at √s = 7 TeV with the ATLAS detector

The production of a W boson in association with a single charm quark is studied using 4.6 fb−1 of pp collision data at s√ = 7 TeV collected with the ATLAS detector at the Large Hadron Collider. In events in which a W boson decays to an electron or muon, the charm quark is tagged either by its semileptonic decay to a muon or by the presence of a charmed meson. The integrated and differential cross sections as a function of the pseudorapidity of the lepton from the W-boson decay are measured. Results are compared to the predictions of next-to-leading-order QCD calculations obtained from various parton distribution function parameterisations. The ratio of the strange-to-down sea-quark distributions is determined to be 0.96+0.26−0.30 at Q 2 = 1.9 GeV2, which supports the hypothesis of an SU(3)-symmetric composition of the light-quark sea. Additionally, the cross-section ratio σ(W + +c¯¯)/σ(W − + c) is compared to the predictions obtained using parton distribution function parameterisations with different assumptions about the s−s¯¯¯ quark asymmetry

Search for dark matter produced in association with bottom or top quarks in √s = 13 TeV pp collisions with the ATLAS detector

A search for weakly interacting massive particle dark matter produced in association with bottom or top quarks is presented. Final states containing third-generation quarks and miss- ing transverse momentum are considered. The analysis uses 36.1 fb−1 of proton–proton collision data recorded by the ATLAS experiment at √s = 13 TeV in 2015 and 2016. No significant excess of events above the estimated backgrounds is observed. The results are in- terpreted in the framework of simplified models of spin-0 dark-matter mediators. For colour- neutral spin-0 mediators produced in association with top quarks and decaying into a pair of dark-matter particles, mediator masses below 50 GeV are excluded assuming a dark-matter candidate mass of 1 GeV and unitary couplings. For scalar and pseudoscalar mediators produced in association with bottom quarks, the search sets limits on the production cross- section of 300 times the predicted rate for mediators with masses between 10 and 50 GeV and assuming a dark-matter mass of 1 GeV and unitary coupling. Constraints on colour- charged scalar simplified models are also presented. Assuming a dark-matter particle mass of 35 GeV, mediator particles with mass below 1.1 TeV are excluded for couplings yielding a dark-matter relic density consistent with measurements

Measurement of W± and Z-boson production cross sections in pp collisions at √s=13 TeV with the ATLAS detector

See paper for full list of authors - 17 pages plus author list + cover pages (34 pages total), 5 figures, 3 tables, submitted to Phys. Lett. B, All figures including auxiliary figures are available at https://atlas.web.cern.ch/Atlas/GROUPS/PHYSICS/PAPERS/STDM-2015-03/International audienceMeasurements of the $W^{\pm} \rightarrow \ell^{\pm} \nu$ and $Z \rightarrow \ell^+ \ell^-$ production cross sections (where $\ell^{\pm}=e^{\pm},\mu^{\pm}$) in proton-proton collisions at $\sqrt{s}=13$ TeV are presented using data recorded by the ATLAS experiment at the Large Hadron Collider, corresponding to a total integrated luminosity of 81 pb$^{-1}$. The total inclusive $W^{\pm}$-boson production cross sections times the single-lepton-flavour branching ratios are $\sigma_{W^+}^{tot}= 11.78 \pm 0.02 (stat) \pm 0.32 (sys) \pm 0.59 (lumi)$ nb and $\sigma_{W^-}^{tot} = 8.75 \pm 0.02 (stat) \pm 0.24 (sys) \pm 0.44 (lumi)$ nb for $W^+$ and $W^-$, respectively. The total inclusive $Z$-boson production cross section times leptonic branching ratio, within the invariant mass window $66 < m_{\ell\ell} < 116$ GeV, is $\sigma_{Z}^{tot} = 1.97 \pm 0.01 (stat) \pm 0.04 (sys) \pm 0.10 (lumi)$ nb. The $W^+$, $W^-$, and $Z$-boson production cross sections and cross-section ratios within a fiducial region defined by the detector acceptance are also measured. The cross-section ratios benefit from significant cancellation of experimental uncertainties, resulting in $\sigma_{W^+}^{fid}/\sigma_{W^-}^{fid} = 1.295 \pm 0.003 (stat) \pm 0.010 (sys)$ and $\sigma_{W^{\pm}}^{fid}/\sigma_{Z}^{fid} = 10.31 \pm 0.04 (stat) \pm 0.20 (sys)$. Theoretical predictions, based on calculations accurate to next-to-next-to-leading order for quantum chromodynamics and next-to-leading order for electroweak processes and which employ different parton distribution function sets, are compared to these measurements

Dijet production in √s = 7 TeV pp collisions with large rapidity gaps at the ATLAS experiment

A 6.8 nb−¹ sample of pp collision data collected under low-luminosity conditions at √s = 7 TeV by the ATLAS detector at the Large Hadron Collider is used to study diffractive dijet production. Events containing at least two jets with pT > 20 GeV are selected and analysed in terms of variables which discriminate between diffractive and non-diffractive processes. Cross sections are measured differentially in ΔηF, the size of the observable forward region of pseudorapidity which is devoid of hadronic activity, and in an estimator, ξ˜, of the fractional momentum loss of the proton assuming single diffractive dissociation (pp → p X). Model comparisons indicate a dominant non-diffractive contribution up to moderately large ηF and small ξ˜, with a diffractive contribution which is significant at the highest ΔηF and the lowest ξ˜. The rapidity-gap survival probability is estimated from comparisons of the data in this latter region with predictions based on diffractive parton distribution functions