# Analyzing Advanced Persistent Threats Using Game
Theory: A Critical Literature Review

Rajesh Kumar, Siddhant Singh, Rohan Kela

► To cite this version:

Rajesh Kumar, Siddhant Singh, Rohan Kela. Analyzing Advanced Persistent Threats Using Game
Theory: A Critical Literature Review. 15th International Conference on Critical Infrastructure Pro-
tection (ICCIP), Mar 2021, Virtual, United States. pp.45-69, 10.1007/978-3-030-93511-5_3. hal-
05300048

HAL Id: hal-05300048

https://inria.hal.science/hal-05300048v1

Submitted on 6 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

Chapter 3

ANALYZING ADVANCED PERSISTENT
THREATS USING GAME THEORY:
A CRITICAL LITERATURE REVIEW

Rajesh Kumar, Siddhant Singh and Rohan Kela

**Abstract** Advanced persistent threats present significant security challenges due to their customized, stealthy and adaptive nature. Since no generic solution exists to combat advanced persistent threats, the recommended option is to employ information security best practices. While practitioner-oriented security guidelines have been published by the International Organization for Standardization and the U.S. National Institute of Standards and Technology, they cannot be employed in rigorous quantitative analyses required for objective decision making such as choosing countermeasures that balance security, cost and usability. In contrast, game-theoretic approaches, which express the behavior of rational agents that maximize their utility, provide appropriate models for objective decision making.

This chapter conducts a critical analysis of several game-theoretic
approaches for analyzing advanced persistent threats. Eleven highly-
cited, peer-reviewed articles from the research literature are examined
in terms of their objectives, features, game models and solutions. The
models provide valuable insights into advanced persistent threat behav-
ior, support resource-optimal decision making and can be mapped to
the various risk management stages. However, they have some deli-
cate modeling and analysis limitations. The critical analysis exposes
the omissions in the literature and points to future research focused
on integrating practitioner perspectives in game-theoretic approaches
to advance information security risk management.

**Keywords:** Advanced persistent threats, game theory, literature review

# 1. Introduction

Critical infrastructure assets utilize advanced automation, computa-
tion and communications technologies to provide vital goods and ser-
vices [39]. However, these assets, which were historically isolated from
the outside world, now connect directly or indirectly to the Internet. The
increased connectivity exposes the assets to cyber attacks that exploit
vulnerabilities arising from connecting multiple heterogeneous compo-
nents.

Advanced persistent threats are a sophisticated and dreaded class of
attacks that have received much attention in the context of industrial
control systems used across the critical infrastructure sectors [6]. These
threats, which are manifested by expert and well-resourced adversaries,
are customized, stealthy and adaptive in nature. As a result, they can
cause significant harm to critical infrastructure assets. An example is
the notorious Stuxnet virus that reportedly damaged nearly a thousand
uranium hexafluoride centrifuges in Iran's Natanz facility [23].

Advanced persistent threats are difficult to combat because they are highly sophisticated and customized. In fact, accurate detection and prevention of advanced persistent threats are considered to be impractical [41]. Therefore, the best option is to plan ahead of the attackers by instituting pervasive information security hygiene that adopts security best practices, customizes security needs based on the perceived threats, patches vulnerabilities, devises back-up plans for emergencies and compromises, institutes security awareness and training, etc. While numerous security guidelines have been published by entities such as the International Organization for Standardization [19] and the National Institute of Standards and Technology [40], they cannot be engaged in rigorous quantitative analysis models required for objective decision making such as selecting countermeasures that balance security, cost and usability.

Game-theoretic approaches, which express the behavior of rational
agents that maximize their utility, are well-suited for objective decision
making. This chapter conducts a critical analysis of game-theoretic ap-
proaches for analyzing advanced persistent threats. Eleven highly-cited,
peer-reviewed articles from the research literature are examined in terms
of their objectives, features, game models and solutions. The models pro-
vide valuable insights into advanced persistent threat behavior, support
resource-optimal decision making and can be mapped to the various risk
management stages. However, they have some delicate modeling and
analysis limitations. The critical analysis also exposes the omissions in
the literature and points to future research focused on integrating practi-
tioner perspectives in game-theoretic approaches to advance information
security risk management.
<figure><img src="image_4.png" /><figcaption>Figure 1. Advanced persistent threat attack stages.</figcaption></figure>

## 2. Preliminaries

This section briefly discusses advanced persistent threats, information security risk management and game theory.

### 2.1 Advanced Persistent Threats

An advanced persistent threat is an adversary with sophisticated expertise and significant resources that enable it to create opportunities to achieve its objectives by leveraging multiple attack vectors [20]. An advanced persistent threat attack is sophisticated and customized to the vulnerabilities of the targeted entity.

Figure 1 shows the typical stages in an advanced persistent threat attack. The attack involves five stages:

* **Reconnaissance:** The attacker scans and monitors the targeted entity, understands the landscape and hunts the network for potential entry points. After an entry point is identified, the attacker harvests information from websites, social media and other available resources to bootstrap an attack.

* **Foothold Establishment:** The attacker identifies vulnerabilities to exploit and/or employs social engineering techniques in order to infiltrate the targeted system.

* **Lateral Movement:** Upon gaining a foothold, the attacker scans the internal network environment and searches for vulnerabilities that may not be visible from outside the network. The attacker exploits the identified vulnerabilities, creates multiple covert communications channels and moves within the network, all the while attempting to escalate its privileges and move to its goal.

* **Exfiltration:** Having gained access to sensitive information in the network, the attacker exfiltrates the information using its covert
<figure><img src="image_5.png" /><figcaption>Figure 2. Information security risk management stages.</figcaption></figure>

communications channels. Depending on the motive, the attacker may vitiate and/or impair hardware and software systems in the compromised network.

*   **Post Exfiltration:** Upon attaining its objective, the attacker removes all traces of its presence and may leave backdoors to target the entity in the future.

## 2.2 Information Security Risk Management

Information security risk is the potential that a threat will exploit the vulnerabilities of an asset or group of assets belonging to an entity and cause harm [40]. Information security risk management involves the continuous identification, review, treatment and monitoring of information security risks to achieve risk acceptance [47].

Figure 2 shows the information security risk management stages based on the ISO 31000 guidelines [19]. The five information security risk management stages are:
* **Context Establishment:** The entity establishes the scope and boundaries of risk management. To set the criteria against which risk will be assessed, the context must align with the objectives of the entity. A study is conducted to understand the landscape of the entity and determine the internal and external parameters for managing risk.

* **Risk Identification:** The events that hinder, alter or delay the achievement of the entity's objective are identified and elucidated. This includes a complete decomposition of the entity's assets, associated vulnerabilities and potential threats. Risks that are not identified during this stage are not revisited in the ensuing stages. Therefore, comprehensive risk identification is essential.

* **Risk Analysis:** An understanding of the risk is developed. For each scenario, the consequences of the risk and its likelihood of occurrence are evaluated against the baseline security measures. The results help identify the risk treatment options.

* **Risk Evaluation:** The outcomes of risk analysis are classified and ranked. This enables security practitioners to allocate resources for mitigation actions.

* **Risk Treatment:** A range of controls are considered to mitigate the risk. The efficacy of each option is assessed and a decisive plan is executed to implement the selected controls.

## 2.3 Game Theory

Game theory is the study of mathematical models of conflict and co-operation between intelligent and rational decision makers [32]. It provides an elegant framework to reason about advanced persistent threat attributes such as stealth and uncertainty. Consequently, game theory is a natural choice for formally reasoning about strategic interactions and capturing constraints on attacker incentives, defense resource allocations and attack impacts.

Game theory has been applied to a variety of important information security and decision-theoretic problems. Applications of game theory include intrusion detection [22], network security [26], cyber insurance [43] and smart grids [48]. Interested readers are referred to [14, 16, 25, 46] for additional details about game theory.
## 3. Literature Review

This chapter critically analyzes the highly-cited literature on game-theoretic approaches for advanced persistent threat analysis. Unlike seminal surveys of advanced persistent threats that enumerate historical advanced persistent threats [2, 21] or identify the characteristics or stages of advanced persistent threats [3, 6], this work focuses on advanced persistent threats from the information security risk management perspective. Information security risk management refers to the techniques and tools used to predict and prioritize risks, and identify and deploy the most appropriate countermeasures that minimize the residual risk. This perspective provides a wide lens to analyze advanced persistent threats focused on critical infrastructure assets and target their entire lifecycles via prevention, monitoring, assessment and response.

Following the systematic literature review process of Luh et al. [27], eleven articles were curated for the survey. The articles were selected using keyphrase searches at three popular academic research websites, Google Scholar [15], Microsoft Academic [30] and ScienceDirect [10]. Three sets of keyphrases were used: (i) advanced persistent threat + game theory, (ii) APT + game theory and (iii) Stuxnet + game theory.

The search results were reviewed manually. Articles not in English, articles published before 2010 and survey papers, magazine articles, workshop reports and commercial reports were excluded. The search results were filtered according to the number of citations on Google Scholar as of December 15, 2020. An initial suitability review was conducted by judging the title, abstract and conclusions. The primary focus during article curation was to cover the breadth of techniques and applications.

The next step was to select articles that present a framework, model or method focused on targeted attacks, multistage attacks and other attacks with characteristics of advanced persistent threats. Additionally, the selected articles had to focus on representing, detecting and/or preventing advanced persistent threat attacks. Also, the articles had to adopt holistic perspectives of advanced persistent threat attacks instead of merely focusing on specific security mechanisms.

The literature on game-theoretic approaches for advanced persistent threats is sparse, with most works published between 1995 and 2019. Although the final selection of eleven articles may seem low, steps were taken during the curation to ensure that the articles adequately covered game models, solutions and application areas. The articles are classified into two broad categories, application areas discussed in Section 4 and metrics discussed in Section 5.
# 4. Application-Area-Based Classification

This section discusses the surveyed game-theoretic approaches used for advanced persistent threat analysis. The surveyed articles are placed in four classes based on their application areas: (i) resource allocation, (ii) cyber deception, (iii) information leakage and (iv) optimal design. The goal of the classification is to organize the diverse approaches for clarity. Tables 1 and 2 summarize the surveyed articles, including their objectives, features, game models and solutions.

## 4.1 Resource Allocation

Resource allocation is the optimal distribution of resources to minimize the likelihood of an attack and its potential damage by prioritizing the order of protection of critical assets. Three articles are placed in the resource allocation class.

The article by Huang and Zhu [18] models attacker and defender interactions as a multistage dynamic game. The model assumes that the defender has already deployed some countermeasures at each stage that can thwart the attacker. The model comprises *k* stages, where each stage corresponds to a sub-game. At the end of each stage, the two players obtain payoffs based on their interactions. The attacker has two payoff configurations labeled adversarial and legitimate. The defender has two payoff configurations labeled sophisticated and primitive.

The players receive rewards and penalties based on their interactions. Each player seeks to maximize the expected cumulative utility. At each stage, a player performs an action based on available information and forms a belief about the other player. At the end of a stage, the beliefs are updated using a Bayesian rule with Markov approximations. The solution obtained using an iterative dynamic programming algorithm is a perfect Bayesian Nash equilibrium. The article demonstrates the utility of the approach using a hypothetical case study involving the compromise of a SCADA system that manages the well-known Tennessee Eastman process in which an attacker seeks to reduce the operational efficiency.

The article by Rass and Zhu [37] models attacker and defender interactions as a multistage dynamic game. Defensive strategies are designed to prevent the attacker from reaching a central asset. The model input is a system that is segmented into layers according to their distances from the central asset. The game model is a sequence of nested games, where the attacker seeks to reach the target from the outermost layer. During the game, the attacker may be detected via random inspection by the defender. Upon succeeding with a certain likelihood at a given
<table><caption>Table 1. Summary of the game-theoretic advanced persistent threat approaches.</caption><thead><tr><th>Article (Year, Citations)</th><th>Objective</th><th>Features</th><th>Game Model</th><th>Solution</th></tr></thead><tbody><tr><td>Huang and Zhu [18] (2020, 32)</td><td>Defense in depth</td><td>Multistage game, Dynamic programming algorithm</td><td>Dynamic nonzero-sum game with incomplete information</td><td>Perfect Bayesian Nash equilibrium (PBNE) (mixed strategy), β-PBNE</td></tr><tr><td>Rass and Zhu [37] (2016, 38)</td><td>Defense in depth</td><td>Multistage game, Sequential finite recursive game, Complete information</td><td>Two-player zero-sum game</td><td>Saddle-point equilibrium</td></tr><tr><td>Hu et al. [17] (2015, 110)</td><td>Model of a malicious insider</td><td>Continuous time, Imperfect information, Static and dynamic attack rates/recapture rates</td><td>Two-player differential game</td><td>Nash equilibrium</td></tr><tr><td>Min et al. [31] (2018, 39)</td><td>Optimal CPU allocation</td><td>Colonel Blotto game, Complete information, Reinforcement learning, Cloud security</td><td>Two-player zero-sum game</td><td>Nash equilibrium (mixed strategy)</td></tr><tr><td>Xiao et al. [49] (2017, 77)</td><td>Attack deterrence via optimal scanning of storage devices</td><td>Prospect theory, Cloud storage, Bounded rationality, Q-learning, Asymmetric information</td><td>Two-player static and dynamic game</td><td>Nash equilibrium (pure strategy, mixed strategy)</td></tr><tr><td>Yang et al. [50] (2018, 38)</td><td>Optimal repair</td><td>Repair strategies, Epidemic modeling, Dynamic game</td><td>Two-player differential game</td><td>Nash equilibrium</td></tr></tbody></table>
<table><caption>Table 2. Summary of the game-theoretic advanced persistent threat approaches (continued).</caption><thead><tr><th>Article (Year, Citations)</th><th>Objective</th><th>Features</th><th>Game Model</th><th>Solution</th></tr></thead><tbody><tr><td>Tian et al. [42] (2019, 7)</td><td>Optimal honeypot allocation strategy</td><td>Incomplete information, Honeypot, Resource constraints, One-shot game</td><td>Bayesian game</td><td>Bayesian Nash equilibrium</td></tr><tr><td>Zhu and Basar [51] (2013, 118)</td><td>Dynamic reconfiguration of attack surface under minimum cost</td><td>Multistage game, Online learning, Continuous time, Complete/incomplete information</td><td>Two-player zero-sum game</td><td>Saddle-point equilibrium (mixed strategy)</td></tr><tr><td>van Dijk et al. [44] (2012, 233)</td><td>Control of a shared resource with minimum cost</td><td>Infinite game, adaptive/non-adaptive strategies, Complete information, Continuous time</td><td>Two player multistage game</td><td>Nash equilibrium</td></tr><tr><td>Pawlick et al. [35] (2015, 78)</td><td>Trust in the cloud</td><td>Signaling game, FlipIt game, Continuous time, Periodic strategy, Incomplete information</td><td>Dynamic Bayesian game plus two-player multistage game</td><td>Gestalt equilibrium</td></tr><tr><td>Rass et al. [36] (2017, 69)</td><td>Multi-criteria decision making</td><td>Complete information, Loss distribution, Fictitious play algorithm, Asymmetric information, Qualitative data, Uncertain payoff</td><td>Two-player zero-sum game</td><td>Saddle-point equilibrium</td></tr></tbody></table>
stage, the attacker chooses to enter the next stage or remain at the same stage. The attacker incurs a cost during a move. The defender deploys preventive and detective measures with a randomized inspection strategy to maximize the cost to the attacker. Each sub-game is a finite zero-sum game in which the strategic attacker-defender interactions determine the structure of the sub-game in the next stage. The article presents a closed-form recursive approach to obtain a saddle-point equilibrium. Toy examples are used to demonstrate the applicability of the approach. However, the article does not describe any tool support for the approach.

The article by Rass et al. [36] models attacker and defender interactions as a two-player zero-sum game. Several attacker attributes typical of advanced persistent threat scenarios, such as attacker moves, data uncertainty and attacker payoff uncertainty, are considered. The attributes are quantified using continuous, totally-ordered distributions as payoffs. The distributions are constructed based on qualitative data provided by experts. The input to the model is a set of attack paths obtained using topological vulnerability analysis and a set of countermeasures. The set of attack paths comprises all the advanced persistent threat scenarios. A saddle-point equilibrium solution is obtained. Several toy examples and simulations are provided to demonstrate the utility of the approach.

## 4.2 Cyber Deception

Cyber deception tricks attackers and defenders by propagating false beliefs and behaving against their vested interests [34]. Two articles are placed in this class due to their use of cyber deception techniques, namely, honeypots and moving target defenses.

The article by Tian et al. [42] models the interactions between an advanced persistent threat attacker and resource-constrained honeypot defender as an incomplete static game. The defender can employ two types of honeypots, high interaction and low interaction honeypots. A high interaction honeypot emulates a real server and provides adequate information about attacker malicious behavior, but its maintenance requires considerable human effort. A low interaction honeypot provides limited functionality and is less expensive to maintain. Two types of attacks are considered, strong access and weak access, based on attack costs. The resource constraints for a defender are personnel costs for analyzing honeypot data and operating system costs. The asymmetric information game model assumes that the defender's actions are observable. A Bayesian Nash equilibrium solution is obtained. Numerical simulations are provided to demonstrate the approach.
The article by Zhu and Basar [51] models the strategic interactions between an attacker and defender as a two-player zero-sum game. The input is a multilayered system in which an attacker seeks to launch a multistage attack, conducting intrusions and compromising the assets in each layer. The defender deploys a moving target defense as a proactive measure by varying the system configurations across the layers to manufacture the attack surface dynamically and minimize the damage. Increased security using moving target defense contributes to an increased usability cost. An optimal configuration policy is sought that minimizes the damage inflicted by the attacker. A saddle-point equilibrium solution under a mixed strategy is obtained after repeated plays. Numerical simulations of toy examples are provided to demonstrate the utility of the approach.

## 4.3 Information Leakage

Information leakage is the intentional or inadvertent disclosure of sensitive information [1]. Two articles are placed in this class, one involving malicious insiders and the other involving information leakage from the cloud.

The article by Hu et al. [17] investigates the interactions between an advanced persistent threat attacker who works with malicious insiders to trade information in lieu of benefits against a defender. A two-layer game model is employed, where the first layer models the strategic interactions between the attacker and defender, and the second layer models the interactions between the attacker and malicious insiders. The inputs are the system model, one advanced persistent threat attacker, one defender and a certain number of insiders. The state of the system evolves with time, with the attacker capturing the resources at some rate and defender recapturing the compromised resources at some rate. The actions of the attacker and defender result in instantaneous costs based on the state evolution at any time instant, capture and recapture rates, required resources and risk appetites of the players. The defender seeks to minimize the damage while the attacker seeks to minimize the attack cost. The insiders seek to maximize their individual profits over the long term. The system state is modeled as a differential equation. Two settings are considered, static and dynamic. In the static case, the attacker cannot adapt to the system state (i.e., the capture and recapture rates are set). In the dynamic case, the players can choose their optimal actions according to the system state. In both cases, the optimal solutions are Nash equilibria. An iterative numerical solution employing the
steepest descent method is obtained for the dynamic case. Numerical simulations of toy examples are used to demonstrate the approach.

The article by Pawlick et al. [35] studies interactions between three players, an advanced persistent threat attacker, cloud device and remote cloud-controlled device. The cloud can be compromised by the attacker without being detected. The device can follow its onboard autonomous operation system if it believes a message it receives is from the compromised cloud. The problem is modeled as two coupled games, a signaling game between the device and possibly compromised cloud, and a repeated game similar to a FlipIt game [44] between the attacker and cloud defender. The solution is a Gestalt equilibrium, an equilibrium where a perfect Bayesian equilibrium in the signaling game and Nash equilibrium in the FlipIt game are satisfied simultaneously. A case study involving a cloud-controlled vehicle is used to illustrate the approach.

## 4.4 Optimal Design

Optimal design is concerned with establishing a desirable equilibrium by varying the design parameters. The objective is to obtain the highest return by balancing security against usability, budget, etc. [5]. Four articles are placed in the optimal design class. The articles deal with the optimal number of scanning devices in cloud storage to ensure minimum information leakage, optimal scan interval for a defender, optimal repair strategy and cost-optimal strategy for controlling shared resources.

The article by Min et al. [31] focuses on the optimal allocation of central processing units (CPUs) to storage devices under resource constraints. The defender uses the CPUs to scan the storage devices to detect and minimize information leakage whereas the attacker uses the CPUs to steal data while remaining stealthy. The CPU allocation problem is modeled as a Colonel Blotto game, a type of two-player zero-sum game. The solution is a Nash equilibrium under a mixed strategy. Each player randomizes its actions to deceive the opponent. The attacker seeks to steal as much data as possible from the storage devices using a subset of the CPUs while remaining undetected. The defender seeks to scan the storage devices using a subset of CPUs to detect the advanced persistent threat and minimize damage. The attacker and defender can use a time-division technique to scan the storage devices using a single CPU in a time slot. If the number of CPUs used by the attacker is greater than the number of CPUs used by the defender at any time, the data is considered to be at risk. The utility to the attacker or defender depends on the data that is safe and the amount of data in the storage devices at
a given time due to defender intervention. The CPU allocation problem is modeled as a Markov decision process, where the defender observes the CPU allocation in the previous attack and the current data storage distribution. Improved policy learning algorithms, specifically, the host booting policy hill climbing and deep-Q network algorithms, are used to accelerate learning in the Markov decision process. Numerical results are used to showcase the utility of the approach.

The article by Xiao et al. [49] studies the influence of subjective attacker decisions against a defender. Both the agents attempt to control storage devices. The model inputs are the number of storage devices that can be scanned by an advanced persistent threat attacker upon choosing an attack interval/action and a defender who chooses a scan interval to recapture the compromised storage devices. The attacker bears the attack cost and the defender is rewarded with a gain for detection. The game model seeks to derive the optimal defender strategy for controlling the resources. The subjectivity involved in attacker decisions is modeled using prospect theory and Prelec weighting functions. The game is formulated in two ways, one is a static game with complete information and the other is a dynamic game used when the attacker model is not known; both the variations use pure and mixed strategies. The dynamic game employs a Markov decision process and Q-learning to obtain the optimal action policy. The game solution is a Nash equilibrium. Numerical examples are used to demonstrate how subjective attacker strategies impact the utility to the defender.

The article by Yang et al. [50] investigates optimal repair strategies for compromised hosts under the manpower and cost constraints. The model input is a system comprising a storage device and a number of hosts, each of which is in the on or off state. A host in the on (active) state can communicate with a storage server as well as other hosts that are in the on state; hosts in the off state are inactive. The hosts move between the on and off states depending on their required activity. Active hosts can be in the secure or insecure mode; they move from one mode to another based on the advanced persistent threat attack, lateral movement and repair policy. Cost functions are used to quantify the attacker reward based on the worst-case loss of sensitive information. Similarly, the defender pays a penalty for information leakage. The continuous-time dynamic system state evolution is modeled using a differential equation. The game solution is a Nash equilibrium. Numerical examples with toy examples and small case studies are used to demonstrate the utility of the approach.

The article by van Dijk et al. [44] considers an advanced persistent threat attacker that competes with a defender to control a shared re-
source. Each player can take an action to control the resource, which generates a payoff to the owner. The attacker seeks to learn the system configuration incrementally, remaining stealthy while minimizing the cost of movement. The defender seeks to control the shared resource using the minimum number of moves because each movement inflicts a cost. Each player can make a move at any point in time. If the players make a move at the same time, then the control of the resource is unchanged. The players are unaware of each other's moves and the controller of the shared resource, which is only revealed after they make their moves. Several types of feedback that players receive after their moves are considered, ranging from non-adaptive (renewal, periodic and exponential) to adaptive (full history and last move). In addition to player strategies, additional information is also considered when the game starts (no information, rate of play and knowledge of strategy). Numerical examples and simulations are provided to showcase the applicability of the approach.

# 5. Metric-Based Classification

Most of the surveyed game-theoretic approaches focus on the equilibrium strategies of attackers and defenders, which depend on the types of game models used to represent the strategic situations. Therefore, the first classification of the surveyed articles (following the approach of Do et al. [9]) is based on game model types and solutions. Note that Tables 1 and 2 summarize the eleven surveyed articles based on objectives, features, game models and solutions.

The previous section classifies the articles based on their application areas. This section classifies the articles based on their mappings to the risk management process. To accomplish this, several metrics are specified in this section.

## 5.1 Mitigation Measures

Mitigation measures are broadly classified as proactive measures and reactive measures [2]:

- **Proactive Measures (PRO):** Proactive mitigation keeps a defender ahead of an attacker by deploying controls that dynamically change the attack surface. Proactive measures include moving target defense [24], randomization and honeypots [7].

- **Reactive Measures (REA):** In reactive mitigation, a defender follows the steps taken by an attacker all the while attempting to prevent its advances, limit its spread and reduce the damage.
Reactive measures are applied in the prevent, detect and respond phases:

- **Prevent (P):** Prevent measures seek to restrict the movements of attackers. An attack is slowed or mitigated based on attacker capabilities and ability to subvert defenses. For example, access control mechanisms can block attacker progress until the mechanisms are subverted by the attacker.

- **Detect (D):** Detect measures seek to identify attacks. An example is signature-based intrusion detection. Note that detect measures are distinct from prevent measures in that they do not hinder the attacker.

- **Respond (R):** Respond measures seek to contain attacks in a timely manner. An example is the installation of a software patch to address a vulnerability. Respond measures can be viewed in a broader context to include measures that ensure continuity of service, for example, by rebooting, repairing and reallocating more resources. Also, respond measures can reduce the damage due to attacks, for example, by using a risk transfer technique such as cyber insurance.

The second column in Table 3 shows the classification of articles based on mitigation measures. Analysis of the eleven articles reveals that the majority of the models adopt reactive measures. Only three articles, by Huang and Zhu [18], Tian et al. [42] and Zhu and Basar [51], leverage proactive mitigation strategies. The articles dealing with reactive measures mainly focus on the prevent and respond phases. Only the article by Rass and Zhu [37] focuses on the detect phase.

## 5.2 Risk Management Stages

Risk management stages adhering to the ISO 31000 guidelines [19] are considered in this work. The five risk management stages are: (i) context establishment (CE), (ii) risk identification (RI), (iii) risk analysis (RA), (iv) risk evaluation (RE) and (v) risk treatment (RT).

The third column in Table 3 shows the classification of articles based on their coverage of the risk management stages. All the reviewed articles deal with risk analysis while only a few deal with risk treatment. The risk identification and risk evaluation stages are not emphasized in any of the surveyed articles. Additionally, most of the articles do not focus on context establishment. This is because context establishment is an informal process that is not amenable to formal analysis using a game-theoretic model.
<table><caption>Table 3. Metric-based classification of the game-theoretic advanced persistent threat approaches.</caption><thead><tr><th>Article</th><th>Mitigation Measures (Phases)</th><th>Risk Management Stages</th><th>APT Stages</th><th>Validation Methods</th><th>Model Assumptions</th><th>Tool Support</th></tr></thead><tbody><tr><td>Huang and Zhu [18]</td><td>REA (P, R), PRO</td><td>RA, RT</td><td>All</td><td>THE, HYP</td><td>IND, STA, RAT</td><td>None</td></tr><tr><td>Rass and Zhu [37]</td><td>REA (P, D)</td><td>RA</td><td>All</td><td>HYP, THE</td><td>RAT, STA, IND</td><td>None</td></tr><tr><td>Hu et al. [17]</td><td>REA (R)</td><td>RA</td><td>All</td><td>HYP, THE</td><td>RAT</td><td>None</td></tr><tr><td>Min et al. [31]</td><td>REA (R)</td><td>RA, RT</td><td>Ex</td><td>HYP, THE</td><td>RAT, IND</td><td>None</td></tr><tr><td>Xiao et al. [49]</td><td>REA (R)</td><td>RA</td><td>Ex</td><td>HYP, THE</td><td>IND</td><td>None</td></tr><tr><td>Yang et al. [50]</td><td>REA (R)</td><td>RT</td><td>PEx</td><td>HYP, THE, SIM</td><td>RAT</td><td>None</td></tr><tr><td>Tian et al. [42]</td><td>PRO</td><td>RA</td><td>RE</td><td>THE, HYP</td><td>STA, RAT</td><td>None</td></tr><tr><td>Zhu and Basar [51]</td><td>PRO</td><td>RA</td><td>All</td><td>HYP, THE</td><td>RAT, IND</td><td>None</td></tr><tr><td>van Dijk et al. [44]</td><td>REA (P, R)</td><td>RA, RT</td><td>All</td><td>THE, HYP</td><td>RAT, IND</td><td>None</td></tr><tr><td>Pawlick et al. [35]</td><td>REA (P)</td><td>RA</td><td>Ex</td><td>THE, HYP</td><td>STA, RAT</td><td>None</td></tr><tr><td>Rass et al. [36]</td><td>REA (P)</td><td>RA</td><td>All</td><td>THE, HYP</td><td>RAT, STA, IND</td><td>None</td></tr></tbody></table>
## 5.3 Advanced Persistent Threat Stages

The five advanced persistent threat stages considered in this work are: (i) reconnaissance (RE), (ii) foothold establishment (FE), (iii) lateral movement (LM), (iv) exfiltration (Ex) and (v) post exfiltration (PEx).

The fourth column in Table 3 shows the classification of articles based on their coverage of the advanced persistent threat stages. Most of the reviewed articles cover the spectrum of advanced persistent threat stages. However, the articles by Tian et al. [42] and Yang et al. [50] focus exclusively on reconnaissance and post exfiltration, respectively; the approaches are not relevant to any of the other stages.

## 5.4 Validation Methods

The validation methods considered in this work are drawn from Verendel [45]. The four types of validation methods are:

- **Empirical (EMP):** Empirical methods involve systematic experimental gathering of data from operational settings.

- **Hypothetical (HYP):** Hypothetical methods employ hypothetical (conceptual as opposed to realistic) examples that may not be closely related to actual phenomena and have limited degrees of realism.

- **Simulation (SIM):** Simulation methods rely on simulations.

- **Theoretical (THE):** Theoretical methods engage formal or precise theoretical arguments to support the results.

The fifth column in Table 3 shows the classification of articles based on validation methods. The surveyed articles primarily employ hypothetical and theoretical validation methods. This is a drawback because no comments can be made about model scalability and practical applications.

## 5.5 Model Assumptions

The model assumptions used to evaluate the surveyed game-theoretic approaches are inspired by Verendel [45]. However, compositionality is not considered because it not deeply rooted in game theory. The three model assumptions are:

- **Rationality (RAT):** Most game-theoretic models are based on expected utility theory, which assumes rational player behavior. Given several actions, a player always chooses the action that yields
the highest utility. This assumption may not always hold in in-
formation security settings. As a result, several game-theoretic
models do not use expected utility theory and instead employ, for
example, prospect theory [29].

* **Stationarity (STA):** Stationarity implies that the model parameters are invariant with time. This is an important metric, because in real scenarios, player actions are continuous over time. Many game-theoretic model assume stationarity to simplify computations.

* **Independence (IND):** Many models, especially stochastic models, consider random events to be independent (e.g., exponential distribution). This assumption may not be realistic, but it simplifies model computations.

The sixth column in Table 3 shows the classification of articles based on model assumptions. Note that the vast majority of surveyed articles assume rational player behavior, which may not hold in practice.

## 5.6 Tool Support

The tool support metric considers if a model is supported by a practitioner-usable tool. The seventh column in Table 3 shows the classification of articles based on tool support. Unfortunately, none of the surveyed articles explicitly mention a commercial tool or prototype that could support its game-theoretic approach.

## 6. Critical Analysis

Advanced persistent threat attacks are sophisticated. Addressing them is challenging due to the uncertainty about attacker moves and the fact that customized instead of generic defensive solutions are needed. At best, an entity can attempt to keep ahead of the unknown adversary by patching known vulnerabilities, closing potential backdoors and adopting risk management best practices. Even if a defender is constantly alert to attacks, it cannot be sure of the presence of the invisible adversary, let alone its actions and incentives.

Game theory is a promising paradigm for tackling the uncertainty inherent in advanced persistent threats. Its mathematical rigor empowers security practitioners with techniques and tools to make informed, objective and transparent decisions. The growing popularity of game-theoretic models is evidenced by the rich set of articles on the subject that target diverse application areas.
This chapter has explored game-theoretic models designed at different abstractions, each with varying assumptions about the available information, agent incentives, moves, resource constraints, etc. The strategic situations vary from modeling a single application domain such as cloud security to supporting a multilayered approach such as defense in depth. A few articles consider malicious insiders during the important reconnaissance stage of advanced persistent threats. Other articles provide different mitigation solutions, target different advanced persistent threat stages and lay the foundation for security by design. Some articles consider the use of proactive defenses with adaptive strategies, such as honeypots and moving target defense mechanisms, to detect and block attackers at an early stage. The game-theoretic models are diverse – games with incomplete information, stochastic games, extensive form games, Bayesian games, inspection games and multi-player games with complete/incomplete information.

While game-theoretic models can help understand attacker behaviors and incentives, they are founded on certain assumptions, such as unbounded rationality on the part of players, which may not be realistic. This is a limitation in many of the surveyed articles. However, there are articles in which such constraints are relaxed. For example, Xiao et al. [49] employ prospect theory and Prelec weighting functions to model bounded rational behavior.

Certain challenges must be surmounted before game theory can be incorporated in practical information security risk management tools. The two challenges, unrealistic model assumptions and limited input data, are discussed below.

**Model Assumptions.** Game-theoretic models are mathematical abstractions. Kiennert et al. [22] note that the models rely on subtle and implicit assumptions that limit their practical applications in security scenarios.

The game-theoretic models in most of the surveyed articles assume a limited action set comprising an attacker and a defender. In real scenarios, the situation is more complex. Often, the environments in which players make their moves are noisy with dynamic system updates, reconfigurations, repairs and scheduled maintenance. Additionally, there may be other players in addition to attackers and defenders. For example, Hu et al. [17] consider malicious insiders as the third type of player. While modeling real scenarios as two-player games can be helpful, such treatments are overly simplified. In other cases, for example, in the articles by Rass and Zhu [37] and van Dijk et al. [44], complete information about attacker payoffs is assumed, which is unrealistic and impractical.
Some of the game-theoretic models analyzed in this chapter are overly simplified whereas others are complex. The most representative models, such as those with continuous-time, multistage and two-sided incomplete information attributes, are closer to real advanced persistent threat scenarios. However, they quickly become impractical (e.g., complex algorithms, no closed-form solutions and difficult-to-achieve equilibria).

For example, a stochastic game is an appropriate choice for a multistage advanced persistent threat scenario. However, it is marred by assumptions about payoffs (analysis is restricted to zero-sum stochastic games because a general resolution algorithm is known only for zero-sum games) and states (most models are restricted to completely-observable states). Overly simple two-player zero-sum games do not adequately model advanced persistent threat scenarios where, due to asymmetric information, player incentives are unknown. Similarly, models based on repeated plays of a game assume that the same game is played over time. However, in multistage advanced persistent threat scenarios, a game is not actually repeated because it may not be reset to the original configuration before a repetition [44]. In such scenarios, stochastic models with adaptive learning and evolutionary strategies hold promise [28].

A more compelling question is how to obtain the right game-theoretic model. Many of the authors of the surveyed articles have used intuition to produce stylistic models that are rarely based on historical data, log data or testbed data. Most of the surveyed articles rely on simulations of inferences to demonstrate player utilities at equilibrium, which are prone to parameter perturbations. Among all the surveyed articles, only the article by Huang and Zhu [18] handles parameter perturbations using sensitivity analysis. Finally, none of the surveyed articles describe a testbed or empirical validation of the results using red-blue team penetration testing.

**Input Data.** Game-theoretic models are data intensive. The equilibrium strategies are based on the player utilities that are usually expressed using real-valued data. Although the availability of precise information about payoffs constrains game-theoretic models, most of the models work well with ordered data. This raises the issue of how ordered data can be obtained. Rass et al. [36] note that, most of the time, limited historical data is available and it is mostly based on practitioner experience about asset value and damage.

Game-theoretic models rely on quantitative data. Extending a model with qualitative data is a potential research area [36]. Another approach is to base a model on noisy payoffs as in [18]. Other approaches that draw
on Dempster-Shafer evidence theory [8] and fuzzy logic [11] can support
quantitative analyses using qualitative data with degrees of uncertainty.

**Looking Forward.** From a practitioner's point of view, game-theoretic approaches are cumbersome when working directly with the mathematical models. To render a rigorous game-theoretic approach amenable for use by the security community, it is prudent to create a practitioner tool that wraps the mathematical engine within a graphical user interface. Additionally, instead of using toy examples, case studies involving real scenarios should be employed to demonstrate the applicability and scalability of game-theoretic approaches. Unfortunately, the survey results are disappointing on both these fronts. No reviewed article mentions tool support and very few articles provide real case studies.

**7. Conclusions**

Game-theoretic approaches, which express the behavior of rational agents and maximize their utility, hold promise for making objective decisions about countermeasures against advanced persistent threats that balance security, cost and usability. The critical analysis of game-theoretic approaches for analyzing advanced persistent threats presented in this chapter examines the approaches in terms of their objectives, features, game models and solutions. Additionally, the game-theoretic approaches are classified according to their applications areas as well as their mappings to the ISO 31000 information security risk management stages. The critical analysis exposes the delicate modeling and analysis limitations of the game-theoretic approaches and their omissions. The analysis also points to future research focused on integrating practitioner perspectives in game-theoretic approaches to advance information security risk management.

**References**

[1] M. Ahmadian and D. Marinescu, Information leakage in cloud data warehouses, *IEEE Transactions on Sustainable Computing*, vol. 5(2), pp. 192–203, 2020.

[2] A. Alshamrani, S. Myneni, A. Chowdhary and D. Huang, A survey of advanced persistent threats: Techniques, solutions, challenges and research opportunities, *IEEE Communications Surveys and Tutorials*, vol. 21(2), pp. 1852–1877, 2019.

[3] R. Brewer, Advanced persistent threats: Minimizing the damage, *Network Security*, vol. 2014(4), pp. 5–9, 2014.
[4] L. Busoniu, R. Babuska and B. De Schutter, A comprehensive survey of multiagent reinforcement learning, *IEEE Transactions on Systems, Man and Cybernetics, Part C (Applications and Reviews)*, vol. 38(2), pp. 156-172, 2008.

[5] H. Cavusoglu, S. Raghunathan and B. Mishra, Optimal design of information technology security architectures, *Proceedings of the International Conference on Information Systems*, pp. 749-756, 2002.

[6] P. Chen, L. Desmet and C. Huygens, A study on advanced persistent threats, in *Communications and Multimedia Security*, B. De Decker and A. Zuquete (Eds.), Springer, Berlin Heidelberg, Germany, pp. 63-72, 2014.

[7] F. Cohen, The use of deception techniques: Honeypots and decoys, in *Handbook of Information Security, Volume 3*, H. Bidgoli (Ed.), John Wiley, Chichester, United Kingdom, pp. 646-655, 2006.

[8] X. Deng, X. Zheng, X. Su, F. Chan, Y. Hu, R. Sadiq and Y. Deng, An evidential game theory framework for a multi-criteria decision making process, *Applied Mathematics and Computation*, vol. 244, pp. 783-793, 2014.

[9] T. Do, N. Tran, C. Hong, C. Kamhoua, K. Kwiat, E. Blasch, S. Ren, N. Pissinou and S. Iyengar, Game theory for cyber security and privacy, *ACM Computing Surveys*, vol. 50(2), article no. 30, 2017.

[10] Elsevier, ScienceDirect, Amsterdam, The Netherlands (www.sciencedirect.com), 2020.

[11] C. Esposito, M. Ficco, F. Palmieri and A. Castiglione, Smart cloud storage service selection based on fuzzy logic: Theory of evidence and game theory, *IEEE Transactions on Computers*, vol. 65(8), pp. 2348-2362, 2016.

[12] J. Filar and B. Tolwinski, On the algorithm of Pollatschek and Avilztzhak, in *Stochastic Games and Related Topics*, T. Raghavan, T. Ferguson, T. Parthasarathy and O. Vrieze (Eds.), Springer, Dordrecht, The Netherlands, pp. 59-70, 1991.

[13] A. Fink, Equilibrium in a stochastic n-person game, *Journal of Sciences of the Hiroshima University, Series A-I (Mathematics)*, vol. 28(1), pp. 89-93, 1964.

[14] D. Fudenberg and J. Tirole, *Game Theory*, MIT Press, Cambridge, Massachusetts, 2000.

[15] Google, Google Scholar, Mountain View, California (scholar.google.com), 2020.
[16] J. Harrington, *Games, Strategies and Decision Making*, Worth Publishers, New York, 2009.

[17] P. Hu, H. Li, H. Fu, D. Cansever and P. Mohapatra, Dynamic defense strategy against advanced persistent threat with insiders, *Proceedings of the IEEE Conference on Computer Communications*, pp. 747-755, 2015.

[18] L. Huang and Q. Zhu, A dynamic games approach to proactive defense strategies against advanced persistent threats in cyberphysical systems, *Computers and Security*, vol. 89, article no. 101660, 2020.

[19] International Organization for Standardization, ISO 31000:2018 Risk Management – Guidelines, Geneva, Switzerland, 2018.

[20] Joint Task Force Transformation Initiative, Managing Information Security Risk: Organization, Mission and Information System View, NIST Special Publication 800-39, National Institute of Standards and Technology, Gaithersburg, Maryland, 2011.

[21] N. Kaloudi and J. Li, The AI-based cyber threat landscape: A survey, *ACM Computing Surveys*, vol. 53(1), article no. 20, 2020.

[22] C. Kiennert, Z. Ismail, H. Debar and J. Leneutre, A survey of game-theoretic approaches for intrusion detection and response optimization, *ACM Computing Surveys*, vol. 51(5), article no. 90, 2018.

[23] D. Kushner, The real story of Stuxnet, *IEEE Spectrum*, vol. 50(3), pp. 48-53, 2013.

[24] C. Lei, H. Zhang, J. Tan, Y. Zhang and X. Liu, Moving target defense techniques: A survey, *Security and Communication Networks*, vol. 2018, article no. 3759626, 2018.

[25] K. Leyton-Brown and Y. Shoham, *Essentials of Game Theory: A Concise Multidisciplinary Introduction*, Morgan and Claypool Publishers, San Rafael, California, 2008.

[26] X. Liang and Y. Xiao, Game theory for network security, *IEEE Communications Surveys and Tutorials*, vol. 15(1), pp. 472-486, 2013.

[27] R. Luh, S. Marschalek, M. Kaiser, H. Janicke and S. Schrittwieser, Semantics-aware detection of targeted attacks: A survey, *Journal of Computer Virology and Hacking Techniques*, vol. 13(1), pp. 47-85, 2017.

[28] J. Marden and J. Shamma, Game theory and distributed control, in *Handbook of Game Theory with Economic Applications, Volume 4*, H. Young and S. Zamir (Eds.), Elsevier, Amsterdam, The Netherlands, pp. 861-899, 2015.
[29] R. McDermott, *Risk-Taking in International Politics*, University of Michigan Press, Ann Arbor, Michigan, 2001.

[30] Microsoft, Microsoft Academic, Redmond, Washington (*academic.microsoft.com/home*), 2020.

[31] M. Min, L. Xiao, C. Xie, M. Hajimirsadeghi and N. Mandayam, Defense against advanced persistent threats in dynamic cloud storage: A Colonel Blotto game approach, *IEEE Internet of Things Journal*, vol. 5(6), pp. 4250–4261, 2018.

[32] R. Myerson, *Game Theory: Analysis of Conflict*, Harvard University Press, Cambridge, Massachusetts, 1991.

[33] J. Osborne and A. Rubinstein, *A Course in Game Theory*, MIT Press, Cambridge, Massachusetts, 1994.

[34] J. Pawlick, E. Colbert and Q. Zhu, A game-theoretic taxonomy and survey of defensive deception for cyber security and privacy, *ACM Computing Surveys*, vol. 52(4), article no. 82, 2019.

[35] J. Pawlick, S. Farhang and Q. Zhu, Flip the cloud: Cyber-physical signaling games in the presence of advanced persistent threats, in *Decision and Game Theory for Security*, M. Khouzani, E. Panaousis and G. Theodorakopoulos (Eds.), Springer, Cham, Switzerland, pp. 289–308, 2015.

[36] S. Rass, S. Konig and S. Schauer, Defending against advanced persistent threats using game theory, *PLOS ONE*, vol. 12(1), article no. e0168675, 2017.

[37] S. Rass and Q. Zhu, GADAPT: A sequential game-theoretic framework for designing defense-in-depth strategies against advanced persistent threats, in *Decision and Game Theory for Security*, Q. Zhu, T. Alpcan, E. Panaousis, M. Tambe and W. Casey (Eds.), Springer, Cham, Switzerland, pp. 314–326, 2016.

[38] L. Shapley, Stochastic games, *Proceedings of the National Academy of Sciences*, vol. 39(10), pp. 1095–1100, 1953.

[39] J. Stankovic, J. Sturges and J. Eisenberg, A 21st century cyber-physical systems education, *IEEE Computer*, vol. 50(12), pp. 82–85, 2017.

[40] G. Stoneburner, A. Goguen and A. Feringa, Risk Management Guide for Information Technology Systems, NIST Special Publication 800-30, National Institute of Standards and Technology, Gaithersburg, Maryland, 2002.

[41] B. Tarzey, The trouble heading for your business in 2013, *Computer Weekly*, March 1, 2013.
[42] W. Tian, X. Ji, W. Liu, J. Zhai, G. Liu, Y. Dai and S. Huang, Honeypot game-theoretical model for defending against APT attacks with limited resources in cyber-physical systems, *Electronics and Telecommunications Research Institute Journal*, vol. 41(5), pp. 585-598, 2019.

[43] D. Tosh, I. Vakilinia, S. Shetty, S. Sengupta, C. Kamhoua, L. Njilla and K. Kwiat, Three-layer game theoretic decision framework for cyber investment and cyber insurance, in *Decision and Game Theory for Security*, S. Rass, B. An, C. Kiekintveld, F. Fang and S. Schauer (Eds.), Springer, Cham, Switzerland, pp. 519-532, 2017.

[44] M. van Dijk, A. Juels, A. Oprea and R. Rivest, FlipIt: The game of "stealthy takeover," *Journal of Cryptology*, vol. 26(4), pp. 655-713, 2013.

[45] V. Verendel, Quantified security is a weak hypothesis: A critical survey of results and assumptions, *Proceedings of the New Security Paradigms Workshop*, pp. 37-50, 2009.

[46] K. Wang, M. Du, D. Yang, C. Zhu, J. Shen and Y. Zhang, Game-theory-based active defense for intrusion detection in cyber-physical embedded systems, *ACM Transactions on Embedded Computing Systems*, vol. 16(1), article no. 18, 2016.

[47] G. Wangen, C. Hallstensen and E. Snekkenes, A framework for estimating information security risk assessment method completeness, *International Journal of Information Security*, vol. 17(6), pp. 681-699, 2018.

[48] H. Wu and W. Wang, A game theory based collaborative security detection method for Internet of Things systems, *IEEE Transactions on Information Forensics and Security*, vol. 13(6), pp. 1432-1445, 2018.

[49] L. Xiao, D. Xu, C. Xie, N. Mandayam and H. Poor, Cloud storage defense against advanced persistent threats: A prospect-theoretic study, *IEEE Journal on Selected Areas in Communications*, vol. 35(3), pp. 534-544, 2017.

[50] L. Yang, P. Li, Y. Zhang, X. Yang, Y. Xiang and W. Zhou, Effective repair strategy against advanced persistent threats: A differential game approach, *IEEE Transactions on Information Forensics and Security*, vol. 14(7), pp. 1713-1728, 2019.

[51] Q. Zhu and T. Basar, Game-theoretic approach to feedback-driven multistage moving target defense, in *Decision and Game Theory for Security*, S. Das, C. Nita-Rotaru and M. Kantarcioglu (Eds.), Springer, Cham, Switzerland, pp. 246-263, 2013.