Honeypot game‐theoretical model for defending against APT attacks with limited resources in cyber‐physical systems

ETRI JournalVolume 41, Issue 5 p. 585-598 SPECIAL ISSUEFree Access Honeypot game-theoretical model for defending against APT attacks with limited resources in cyber-physical systems Wen Tian, Wen Tian orcid.org/0000-0003-1648-3863 School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this authorXiao-Peng Ji, Corresponding Author Xiao-Peng Ji jixiaopeng_nj@163.com orcid.org/0000-0001-6094-4626 School of Automation, Nanjing University of Science and Technology, Nanjing, China Correspondence Xiao-Peng Ji, School of Automation, Nanjing University of Science and Technology, Nanjing, China Email: jixiaopeng_nj@163.comSearch for more papers by this authorWeiwei Liu, Weiwei Liu School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this authorJiangtao Zhai, Jiangtao Zhai School of Electrics and Information Engineering, Jiangsu University of Science and Technology, Zhenjiang, ChinaSearch for more papers by this authorGuangjie Liu, Guangjie Liu School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this authorYuewei Dai, Yuewei Dai School of Electrics and Information Engineering, Jiangsu University of Science and Technology, Zhenjiang, ChinaSearch for more papers by this authorShuhua Huang, Shuhua Huang School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this author Wen Tian, Wen Tian orcid.org/0000-0003-1648-3863 School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this authorXiao-Peng Ji, Corresponding Author Xiao-Peng Ji jixiaopeng_nj@163.com orcid.org/0000-0001-6094-4626 School of Automation, Nanjing University of Science and Technology, Nanjing, China Correspondence Xiao-Peng Ji, School of Automation, Nanjing University of Science and Technology, Nanjing, China Email: jixiaopeng_nj@163.comSearch for more papers by this authorWeiwei Liu, Weiwei Liu School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this authorJiangtao Zhai, Jiangtao Zhai School of Electrics and Information Engineering, Jiangsu University of Science and Technology, Zhenjiang, ChinaSearch for more papers by this authorGuangjie Liu, Guangjie Liu School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this authorYuewei Dai, Yuewei Dai School of Electrics and Information Engineering, Jiangsu University of Science and Technology, Zhenjiang, ChinaSearch for more papers by this authorShuhua Huang, Shuhua Huang School of Automation, Nanjing University of Science and Technology, Nanjing, ChinaSearch for more papers by this author First published: 23 September 2019 https://doi.org/10.4218/etrij.2019-0152Citations: 9AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract A cyber-physical system (CPS) is a new mechanism controlled or monitored by computer algorithms that intertwine physical and software components. Advanced persistent threats (APTs) represent stealthy, powerful, and well-funded attacks against CPSs; they integrate physical processes and have recently become an active research area. Existing offensive and defensive processes for APTs in CPSs are usually modeled by incomplete information game theory. However, honeypots, which are effective security vulnerability defense mechanisms, have not been widely adopted or modeled for defense against APT attacks in CPSs. In this study, a honeypot game-theoretical model considering both low- and high-interaction modes is used to investigate the offensive and defensive interactions, so that defensive strategies against APTs can be optimized. In this model, human analysis and honeypot allocation costs are introduced as limited resources. We prove the existence of Bayesian Nash equilibrium strategies and obtain the optimal defensive strategy under limited resources. Finally, numerical simulations demonstrate that the proposed method is effective in obtaining the optimal defensive effect. 1 INTRODUCTION A cyber-physical system (CPS) is a new mechanism controlled or monitored by computer algorithms, which intertwines physical and software components such as smart grids, autonomous automobile systems, medical monitoring, process control systems, robotics systems, and automatic pilot avionics 1. Unlike traditional systems, a full-fledged CPS is typically designed as a network of interacting elements with physical inputs and outputs, rather than as standalone devices. Therefore, although the development of algorithms and technologies can significantly improve the resilience of integrated systems, as the number of cyber-attacks continues to increase, CPS security has become an important subject of research and development 2. Cyber security is constantly evolving in response to increasingly sophisticated cyber attacks. Advanced persistent threats (APTs) 3 are becoming a major cyber security issue, making traditional defense mechanisms gradually ineffective. Their salient features are as follows: First, they are usually initiated by an incentive-driven entity with specific targets. Second, they are persistent in achieving their goals and may involve multiple stages or long-term ongoing operations. Third, they are highly adaptive and stealthy to avoid being detected. In fact, there are hundreds of malware variations, which render the protection from APT attacks extremely challenging 4. However, APT-related command and control network traffic can be detected using sophisticated methods at the cyber layer, where both deep log analyses and log correlation from various sources can assist in detecting APT activities 5. Honeypots are an active defense technology 6 whereby some hosts, network services, or information are arranged as bait so that attack behaviors may be detected and analyzed 7. Therefore, honeypots are an effective complement to traditional security systems against APT attacks. Unlike other security tools, most honeypots can only generate logs, owing to their low degree of automation; hence, human involvement is required to detect and analyze the attacks on most honeypots. In addition, honeypots may be either high-interaction (HIH) or low-interaction (LIH). The former can completely mimic real servers 8, whereas the latter can provide only partial service 9. To the best of our knowledge, there is currently little work on the use of honeypots in the APT attack-defense game. Considering their limited resources and classification, honeypots are not sufficient for handling actual attacks, which motivates the present study. In this study, the traditional honeypot cost requirement is exceeded because the human analysis cost is also considered 10. Hence, we propose a honeypot game-theoretical model with low- and high-interaction modes (LHHG) to study the offensive and defensive CPS interactions and processes as an incomplete information game with limited resources. We prove the existence of several Bayesian Nash equilibria (BNE) in different situations and obtain the optimal defensive strategy. We further optimize the detection effect by allocating deployment resources and distributing human analysis costs between LIHs and HIHs. The results demonstrate that the proposed model and method can optimize the defensive effect with limited resources. The main contributions are summarized below. We introduce a new honeypot game-theoretical model for CPS security against APT-attacks. Moreover, we classify honeypots into high- and low-interaction modes for a more accurate interaction process. We also introduce honeypot allocation and human analysis costs as limited resources in the honeypot game-theoretical model and optimize the defense payoff, as the defender's budget is usually insufficient in practice. The rest of the paper is organized as follows. Section 2 provides a summary of related work. Section 3 describes the proposed honeypot game-theoretical model based on limited resources. In Section 4, the existence of BNE is proved, and the defensive effect with limited resources is optimized. In Section 5, extensive numerical simulations using MATLAB are carried out to evaluate the proposed method. Finally, Section 6 concludes the paper. 2 RELATED WORK In this section, we briefly summarize related work on security issues in CPSs, honeypots for network attacks, and the use of game theory for modeling offense and defense processes. 2.1 Security issues in cyber-physical systems This study is related to recent investigations into several prominent security issues in CPSs, such as smart grids, high confidence medical devices and systems, robots, distributed robotics, and transportation. Some studies primarily focus on intrusion detection. For example, Faisal et al 11 proposed an intrusion detection system (IDS) architecture that uses the AMI data flow in a smart grid to analyze the performance of existing data flow mining algorithms and IDS data sets. However, IDSs are less effective in defending against several long-term delitescence attacks such as APT attacks. Howser et al 12 proposed a modal model for Stuxnet attacks that use the operator's trust to remain undetected. They defined operators that allow the manipulation of belief and trust states within the model. In fact, trust in a CPS is a key to the success of the attack. We list several possible APT threats related to CPS security as follows: (i) high complexity may cause unknown vulnerabilities; (ii) CPSs contain different networks, whose interaction may easily lead to new types of attacks and, eventually, to the collapse of the defense system; and (iii) multiple nodes in the network are potential threats because they are highly vulnerable to attackers. 2.2 Honeypots for advanced persistent threat attacks Existing studies focus on the use of different types of defense mechanisms for APT-related attacks on both the cyber and physical layers of the system. Cyber solutions include moving target defense 13, trust mechanisms, and defense-in-depth techniques 14. Physical-layer solutions include watermarking, adding redundancies, and resilient control mechanisms. In addition, holistic cyber-physical solutions for APT-related attacks have been studied in 15. That study presents a secure and resilient mechanism that employs customized cryptographic tools to encrypt the data of a control problem and develops verification methods to ensure the integrity of the computational results from the cloud. Although this mechanism can achieve data confidentiality and integrity, its defensive process is passive and leads to increased security input cost. Honeypots are an active defense technology and are used to induce attacks so that attack behaviors may be detected and analyzed. Therefore, honeypots are an effective supplement to CPS defense systems against APT attacks. The concept of honeypot first appeared in the book “The Cuckoo's Egg” 16, where honeypot technology is used to discover and trace the story of a commercial espionage case. Since 1998, this technology has gradually attracted the attention of security researchers who have developed honeypot software tools specifically designed to deceive attackers. Provos 17 presented “honeyd,” which is a honeypot software package that monitors large-scale honeynets. Vetsch 18 focused on Web application attacks, such as remote and local file packages, to simulate the exploit process and generate response results. In addition, the realization of the spoofing environment construction mechanism determines the degree of interaction that the honeypot can provide to the attacker. To the best of our knowledge, most APT-related research primarily uses security vulnerabilities or configuration weaknesses in network services to pose a threat to the target CPS. Xiao et al 19 proposed a Q-learning-based cloud storage defense scheme for detecting APTs and investigated its performance against subjective APT attackers in dynamic subjective APT games. However, most existing APT games ignore the strict resource constraints in the APT defense, such as the limited number of central processing units (CPUs) of a storage defender and an APT attacker. Therefore, Min et al 20 proposed a hot booting PHC-based CPU allocation scheme that chooses the number of CPUs on each storage device based on the current state. However, as effective security vulnerability defense tools, honeypots have not been widely adopted or used to defend APT attacks in CPSs. Fronimos et al 21 discussed the utilization of LIHs that could indicate early signs of jeopardy from APT attacks. Jasek et al 22 described the methods and procedures of APT attacks, and analyzed and proposed solutions for detecting these threats using HIHs. In addition, some previous studies pointed out the idea that honeypots can be deployed in a CPS for defense against DDoS attacks 23. It should be noted that the impact of human analysis cost on the honeypot defensive effect has been ignored in previous studies. 2.3 Game theory for modeling The application of game theory (which is a useful method for modeling offensive and defensive process in CPSs) to APT modeling has been studied in 24 and 25. In 24, the FlipIt game is proposed as the framework for an offensive and defensive process in which players compete to obtain a shared resource. The attacker can periodically compromise a system completely, in the sense of learning its entire state, including its secret keys. In 25, moving target defense is used as a defense mechanism to mitigate the impact of APT attacks. Both studies analyze the offensive and defensive strategy based on a complete information game. However, the information of both offensive and defensive sides is usually not equal in practice. Therefore, a Bayesian game is a suitable model, as the interaction between the attacker and the defender is usually an incomplete information game in which the defender or attacker is not sure of the type of other players. Wang et al 23 analyzed the interactions between the attacker and the defender, derived optimal strategies for both sides through a Bayesian game, and assumed that the resources of the defender are sufficient. In addition, some studies proposed using deception in game models. Zhuang et al 26 applied game theory to model strategies of secrecy and deception in a multiple-period attacker—defender resource allocation and signaling game with incomplete information. Ceker et al 27 used a formulation method similar to Zhuang's for single-period games. References 26 and 27 focused on cyber security and did not consider physical components. Rao et al 28 studied the strategic interactions between an attacker and a defender using game-theoretic models that consider both cyber and physical components. Moreover, Rao et al 29 further studied a class of infrastructures characterized by the number of discrete components that can be disrupted by either cyber or physical attacks and are protected from cyber and physical reinforcements. In contrast with the above studies, the present study introduces honeypot technology as an active defense mechanism for detecting APT attacks. Under normal circumstances, the defense resource is budgeted. Although most studies currently consider defensive resources to be sufficient, the reality is that defensive resources are always insufficient. In addition, owing to the incomplete information, a reasonable CPS security assumption is that an attacker can observe and learn the defender's behavior before taking action, and the defender may not even be aware of the attacker's existence. Therefore, we consider the constraints of the honeypot allocation and human analysis costs in the study of defensive strategy and effect; this is closer to reality. Regardless of the behavior analysis of an industrial or virtual network, application scenarios are essentially based on strategy selection. Accordingly, an investigation of strategy selection with limited resources is more general. 3 GAME MODEL In this section, we describe the proposed honeypot game-theoretical model, including its information structure, the action spaces of both attacker and defender, and their payoffs. The model extends the single-mode honeypot in 23 to a multimode honeypot and includes limited resources for the defender. 3.1 Basic game model In the proposed honeypot game-theoretical model, we study the interaction between visitors and a CPS. When a visitor is a legitimate user, the router assigns the visitor to the normal server. However, if the visitor is an attacker, he/she will be tricked into accessing a honeypot that actively exposes its vulnerability. Despite the assumption that HIHs and LIHs can be accessed with equal probability, the extension from the single-mode to the multi-node case is still challenging owing to the complexity of the generalized BNE with limited resources. The player, who is the legitimate user/owner of the honeypots, is called the service provider (SP), whereas the other player is called the attacker. The SP benefits from detecting APT attacks through LIHs and HIHs, where an HIH imitates server activities in the CPS and collects large amounts of information. The attacker can access all commands and files in the system with access right. Thus, this honeypot mode has the greatest chance of collecting APT information but consumes the greatest defense resources as well. Unlike HIHs, an LIH imitates partial server activities and is thus less risky and less complex to maintain. The attacker benefits from identifying honeypots and compromising real servers. In addition, we assume that the attacker has two types of APTs: strong and weak access attacks. In the former, compromised systems are exploited so that other systems may be attacked and restrictions such as those set by firewalls may be avoided; the latter indicates an APT attack type that has been publicly exploited 3. Compared with other threats, an APT first invades the system, then continuously collects data and passes them on to the attacker, and finally decides whether to interrupt the normal operation of physical devices. In this scenario, we did not model the entire APT attack. Instead, we modeled an important stage in which the APT intrusion invaded the system to identify the honeypots. For CPS security, we will use vulnerabilities to enter the network and identify honeypots so that a real server attack may be detected; this is considered the early stage of an APT attack. Hence, it is conceivable that the SP participating in the game includes only honeypots without real servers. In this study, we introduce a strict defense resource constraint for the SP. This is a practical assumption that has been ignored in most previous studies. We define the honeypot game-theoretical model as a tuple . Z ∊ {Z1, Z2} is the SP mode, where Z1 denotes an LIH and Z2 denotes an HIH. W ∊ {W1, W2} is the type of access attack, where W1 denotes weak access attack and W2 denotes strong access attack. FZ ∊ {Ω1, Ω2} is a binary strategy used by SP in mode Z, where Ω1 indicates that the SP operates normally and Ω2 indicates that services are not provided. FW ∊ {ν1, ν2} is a binary strategy used by attackers of type W, where ν1 indicates that access attack is launched and ν2 indicates attack access is not launched. () is a set of game strategies for the attacker and SP. UZ and UW represent the payoffs of the SP and attacker, respectively. The detailed list of notations is provided in Table 1. Table 1. List of symbols Symbols Description Symbols Description Z 1 LIH Z 2 HIH W 1 Weak offensive access W 2 Strong offensive access ν 1 Access attack launched ν 2 Access attack not launched ε 1 Reward of LIH ε 2 Reward of HIH γ 1 The cost of weak access attack γ 1 Cost of strong access attack lc Human analysis cost of LIH hc Human analysis cost of HIH Ω 1 SP provides service Ω 2 SP does not provide service ζ 1 Allocation cost of LIH ζ 2 Allocation cost of HIH Number of LIHs with human analysis cost Number of LIHs without human analysis cost Number of HIHs with human analysis cost Number of HIHs without human analysis cost N Number of honeypots m Number of HIHs n Number of LIHs C Total cost of deployment C h Total cost of human analysis β Reward of CPS under normal operation Specifically, ɛ1 or ɛ2 is the value of the attacker identifying the honeypot and interrupting the normal operation of physical devices; lc or hc denotes the human analysis cost required for LIH or HIH, respectively; Ϛ1 or Ϛ2 is the deployment cost required for LIH or HIH, respectively; β indicates the value of the physical system under normal operation. For example, if the CPS is a power grid, ɛ1 and ɛ2 represent the load cut by the grid, and β represents the electricity fee charged by the grid under normal operation. As in 30, we consider an asymmetric model in which the attacker's information is stealthy and the SP's information is observable. This asymmetric information structure is crucial in modeling stealthy attacks in cyber security. 3.2 Service provider's problem The probability of honeypots detecting APT attacks is related to the mode of honeypots. Table 2 shows the probability Pi of failing to detect APT attacks, which is also the probability that LIHs and HIHs fail to detect the two types of APT attacks. Hence, when an LIH provides effective service and a weak access attack is not detected, the payoff for the SP is −Ϛ1 (Ϛ1 > 0 denotes the reward for successfully attacking LIHs). However, if a weak access attack is detected, the payoff for the SP is β (β > 0 denotes the reward of CPS under normal operation). Similarly, when an LIH provides services and a strong access attack is not detected, the payoff for the SP is −Ϛ1. In contrast, when a strong access attack is detected, the payoff for the SP is β. Furthermore, if an HIH provides effective service and a weak access attack is not detected, the payoff for the SP is −Ϛ2 (Ϛ2 > Ϛ1 denotes the reward for attacking HIHs). Moreover, if an HIH provides effective service and a strong access attack is not detected, the payoff for the SP is −Ϛ2. Table 2. Probability of failing to detect access attack Probability LIH HIH Weak access attack Strong access attack The detection probability for LIHs and HIHs varies with their number. The expected non-detection probability of strong and weak access attacks with respect to the number num of LIHs and HIHs is given by the function , where (a) is a binary variable, and denotes the non-detection probability with human analysis cost, (b) because if there is only one honeypot, the non-detection probability of access attacks for the SP is the non-detection probability for the honeypot, (c) is a binary variable, and is the minimum non-detection probability of an access attack with human analysis cost, (d) k is also a binary variable, and k = 1 indicates that human analysis cost is included, and (e) Ψi is strictly decreasing and convex because the non-detection probability of similar access attacks by similar honeypots decreases and finally flattens out as the number of similar honeypots increases 31. This set of conditions on the function Ψi is referred to as generic conditions, and those functions that satisfy the generic conditions are referred to as generic functions. In the honeypot game-theoretical model, the SP does not know the type of access attacks in advance, but it has a priori information about certain statistical metrics, such as the distribution of access types. Hence, we assume that p(W1) = 1 − α, p(W2) = α, where α is the probability of strong access attack. In addition, as the SP should understand the attacker's strategy, we use Bayesian rules to obtain the posterior probability of the SP's behavior and use it to calculate the expected maximum benefit of the SP. Obviously, the strategies () that the SP may use are as follows: {(Ω1, Ω1), (Ω1, Ω2), (Ω2, Ω1), (Ω2, Ω2)}, where () indicates the strategies of both LIHs and HIHs. We call these strategies as follows: (Ω1, Ω1) is strategy1, (Ω1, Ω2) is strategy2, (Ω2, Ω1) is strategy3, and (Ω2, Ω2) is strategy4. 3.3 Attacker's problem In the honeypot game-theoretical model, the attacker should be trapped by a honeypot and should therefore attack on either an LIH or an HIH. Accordingly, the attacker should select an attack strategy that maximizes its payoff. If a weak access attack on an LIH is not detected, the payoff for the attacker is Ϛ1 − γ1 (γ1 represents the cost of a weak access attack). However, if a weak access attack is detected by an LIH, the payoff for the attacker is −γ1. Similarly, if a strong access attack on an LIH is not detected, the payoff for the attacker is Ϛ1 − γ2 (γ2 > γ1 represents the cost of a strong access attack). By contrast, if a strong access attack is detected by an LIH, the payoff for the attacker is −γ2. Furthermore, if a weak access attack on an HIH is not detected, the payoff for the attacker is Ϛ2 − γ1. However, if a weak access attack is detected by an HIH, the payoff for the attacker is −γ1. Similarly, if a strong access attack on an HIH is not detected, the payoff for the attacker is Ϛ2 − γ2. By contrast, if a strong access attack is detected by an HIH, the payoff for the attacker is −γ2. In addition, the attacker does not know the probability distribution of the SP mode, where , . Analogously, all potential strategies () that the attackers can use are {(ν1, ν1), (ν1, ν2), (ν2, ν1), (ν2, ν2)}, which indicates the strategies for both weak and strong access attacks. These strategies are called as follows: (ν1, ν1) is strategy1, (ν1, ν2) is strategy2, (ν2, ν1) is strategy3, and (ν2, ν2) is strategy4. 4 OPTIMAL DEFENSIVE STRATEGY OF SERVICE PROVIDER In this section, we study the set of BNE of the honeypot game-theoretical model and analyze the optimal strategies for both players. We then optimize the defensive effect to maximize the payoff for the SP by allocating limited resources between LIHs and HIHs under certain BNE. 4.1 Bayesian Nash equilibria of game model To analyze the set of BNE, we first express the payoff of the SP based on different modes under different strategies. When an LIH provides service, the payoff is (1)where ULIH,Weak(Ω1) indicates that the LIH faces weak access attack and provides service, whereas ULIH,Strong(Ω1) indicates that the LIH faces strong access attack and provides service. ULIH,Weak(Ω1) and ULIH,Strong(Ω1) are defined below. (2)When an LIH does not provide service, the payoff can be computed as (3)Similarly, when a HIH provides service, the payoff is (4)where UHIH,Weak(Ω1) indicates that an HIH faces weak access attack and provides service, whereas UHIH,Strong(Ω1) indicates that an HIH faces strong access attack and provides service. UHIH,Weak(Ω1) and UHIH,Strong(Ω1) are defined below. (5)Analogously, when an HIH does not provide service, the payoff can be computed as (6)From (1), (3), (4), and (6), regardless of the change of Ϛ1, Ϛ2, Ψ1, Ψ2, Ψ3, Ψ4, hc, lc, and α in the feasible domain, the relations always hold true. Therefore, it is obvious that the SP has a strict dominant strategy (Ω1, Ω1). For the attacker, the payoff for a weak access attack using strategy ν1 is as follows: (7)where UWeak,HIH(ν1) denotes a weak access attack on an HIH, whereas UWeak,LIH(ν1) denotes a weak access attack on an LIH. UWeak,HIH(ν1) and UWeak,LIH(ν1) are defined below. (8) The payoff for a weak access attack using strategy ν2 is (9)Similarly, the payoff for a strong access attack using strategy ν1 is (10) where UStrong,HIH(ν1) denotes a strong access attack on an HIH, whereas UStrong,LIH(ν1) denotes a strong access attack on an LIH. UStrong,HIH(ν1) and UStrong,LIH(ν1) are defined below. (11)Analogously, the payoff for a strong access attack using strategy ν2 is as follows: (12)By (7), (9), (10), and (12), the payoffs are dependent on the value of the parameters. Hence, the attacker does not have a strict dominant strategy. Theorem 1.A BNE strategy (ν1, ν1, Ω1, Ω1) exists in the LHHG model if Proof.To make (ν1, ν1, Ω1, Ω1) a BNE strategy for attacker, the payoff from an access attack is greater than the payoff from not attacking, that is, and . Then, (13) (14) When the SP is an LIH and the parameters satisfy (13), ν1 is the optimal strategy for the attacker; otherwise, ν2 is the optimal strategy, and the attacker will not launch an access attack to identify the LIH. Similarly, if the SP is an HIH and the parameters satisfy (14), ν1 is the optimal strategy for attacker. Therefore, we can obtain the optimal strategy (v1, v1) when the parameters satisfy (13) and (14).We now further check whether the strategy (Ω1, Ω1) is the strict dominant strategy from the perspective of the SP. Assuming that and , we consider the following: (15) (16)When the parameters satisfy (13) and (14), (15) and (16) hold true because . We verify (15) as an example: (1