How Shall We Play a Game?youzhib/poster/bao2016.pdfHow Shall We Play a Game?...
1
How Shall We Play a Game? A Gametheore,cal Model for Cyberwarfare Games 1 Carnegie Mellon University, 2 University of California, Santa Babara Tiffany Bao 1 , Yan Shoshitaishvili 2 , Ruoyu Wang 2 , David Brumley 1 Goals • Fully Autonomous Systems becomes possible: Mayhem in the Cyber Grand Challenge. • The Strategy Generator is a key component to instruct the system. • The goal is to automa,cally find the best strategy of the system. AGacking Tool Patching Tool Exploit GeneraKon Tool DetecKon Tool Other Players’ Computers The Player’s Computers Detect an aGack Discover an exploit Patch Exploit Other players disclose a vulnerability u i (t) Game Parameters Parameter Defini,on The probability distribuKon over Kme that player i discovers a vulnerability at round t. The probability to launch a ricochet aGack with exploits that player i received in the previous round. The raKo of the amount of patched vulnerable resources over the total amount of vulnerable resources at round t. The number of rounds required by player i to generate a patchbased exploit aRer a vulnerability and the corresponding patch are disclosed. The dynamic uKlity that player i gains by aGacking his opponents at round t. The Cyberwarfare Game in MulKple Rounds EvaluaKon • Performance: for a game with 50 Kme slots, we found the best strategy in 10 seconds. • ParKal Observable StochasKc Game (POSG) • Players do not know if the other players have discovered a vulnerability or the other players’ acKons. • Finding the best strategy of POSG: PPADhard problem (which cannot be scalable). • We divide the game into two subgames in order to find the best strategy by dynamic programing. • Subgame 1: before vulnerability disclosure • Subgame 2: aRer vulnerability disclosure • ObservaKon: When a player discloses a vulnerability, the other players should aGack right aRer they generate the aGack. Vulnerability introduced Vulnerabilitybased Exploit Patch released Patching completed AGackbased Exploit Patchbased Exploit … One Round Timeline AGack launched Strategy Generator q i (t) h i (t) p i (t) u i (t) δ i u i (t) h i (t) δ i q i (t) p i (t)
Transcript of How Shall We Play a Game?youzhib/poster/bao2016.pdfHow Shall We Play a Game?...
How Shall We Play a Game? A Game-‐theore,cal Model for Cyber-‐warfare Games
1Carnegie Mellon University, 2University of California, Santa Babara
Tiffany Bao1, Yan Shoshitaishvili2, Ruoyu Wang2, David Brumley1
Goals • Fully Autonomous Systems becomes possible: Mayhem in the Cyber Grand Challenge.
• The Strategy Generator is a key component to instruct the system.
• The goal is to automa,cally find the best strategy of the system.
AGacking Tool
Patching Tool
Exploit GeneraKon
Tool
DetecKon Tool
Other Players’
Computers
The Player’s Computers
Detect an aGack
Discover an exploit
Patch
Exploit
Other players disclose a vulnerability
ui(t)
Game Parameters
Parameter Defini,on The probability distribuKon over Kme that player i discovers a vulnerability at round t. The probability to launch a ricochet aGack with exploits that player i received in the
previous round. The raKo of the amount of patched vulnerable resources over the total
amount of vulnerable resources at round t. The number of rounds required by player i to generate a patch-‐based exploit aRer a vulnerability and the corresponding patch
are disclosed. The dynamic uKlity that player i gains by
aGacking his opponents at round t.
The Cyber-‐warfare Game in MulKple Rounds EvaluaKon • Performance: for a game with 50 Kme slots, we found the best strategy in 10 seconds.
• ParKal Observable StochasKc Game (POSG) • Players do not know if the other players have
discovered a vulnerability or the other players’ acKons.
• Finding the best strategy of POSG: PPAD-‐hard problem (which cannot be scalable).
• We divide the game into two sub-‐games in order to find the best strategy by dynamic programing. • Sub-‐game 1: before vulnerability disclosure • Sub-‐game 2: aRer vulnerability disclosure
• ObservaKon: When a player discloses a vulnerability, the other players should aGack right aRer they generate the aGack.
Vulnerability introduced
Vulnerability-‐based Exploit
Patch released Patching completed
AGack-‐based Exploit
Patch-‐based Exploit
… One Round
Timeline
AGack launched
Strategy Generator
qi(t) hi(t)
pi(t) ui(t)
�iui(t)
hi(t)
�i
qi(t)
pi(t)
