# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
## 3 Game Model
### Observations  
In the \"Catch the Cyber Thief\" game, there are three observation elements that the attack agent can receive, namely, the privilege on compromised hosts, available accounts, and available vulnerabilities on the specified host. For the defense agent, it can observe the number of attacks for each host. It is worth noting that the number of observed attacks does  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Predicates** & **Return** & **Description** \\ \hline connected(X, Y) & True/False & Whether the host \(X\) and host \(Y\) are connected. \\ \hline isOpen(X) & True/False & Whether the host \(X\) is open. \\ \hline allow(F, X, Y) & True/False & Whether firewall \(F\) allows host \(X\) to communicate with host \(Y\). \\ \hline hasFoothold(X, P) & True/False & Whether the attack agent have the privilege \(P\) on host \(X\). \(P\) can take the value of \([0,1,2]\), respectively representing no privilege, normal user privilege and administrator privilege. \\ \hline hasAccount(X, A) & True/False & Whether the host \(X\) has account \(A\). \\ \hline hasVal(X, E) & True/False & Whether the host \(X\) has vulnerability \(A\). \\ \hline recordAttack(X, T) & Integer & Change the number of attacks on host \(X\) according to the value of \(T\). \(T\) usually takes values according to the duration of attack actions. \\ \hline \hline \end{tabular}
\end{table}
Table 1: The predicates of actions.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Action** & **Precondition** & **Result** \\ \hline lateral(X, Y, A) & connected(X, Y) AND isOpen(Y) AND allow(F, X, Y) AND & hasFoothold(X, A) AND recordAttack(X, Y, D) \\  & hasFoothold(X, 2) AND hasAccount(Y, A) & hasFoothold(X, Y, E) AND recordAttack(X, Y, D) \\ \hline exploit(X, Y, E) & connected(X, Y) AND isOpen(Y) AND allow(F,X) AND & hasFoothold(Y, E,P) AND recordAttack(X, Y, D) \\  & hasFoothold(X, 2) AND hasAccount(Y, E) & hasFoothold(Y, E, P) AND recordAttack(X, Y, D) \\ \hline escalate(X, E) & hasFoothold(X, 1) AND hasVal(X, E) AND P1 \(<\) P2 & hasFoothold(Y, E, P) AND recordAttack(X, Y, D) \\ \hline cleanup(X) & hasFoothold(X, 2) & recordAttack(X, \(-1\)) \\ \hline search(X) & - & checkSuccess(X) \\ \hline \hline \end{tabular}
\end{table}
Table 2: The actions of both agents, where A.P and E.P, respectively, represent the privileges that can be obtained by successfully controlling account A and exploiting vulnerability E.  
not equal the actual number of attacks because the defense agent cannot observe locally executed actions \(escalate(X,E)\) and \(cleanup(X)\), and remote actions \(lateral(X,Y,A)\) and \(exploit(X,Y,E)\) only have a certain probability of being observed. Observations are shown in Table 3.  
According to the above modeling, it is obvious that the observations are asymmetric. The observation space of the attack agent is \(3^{n}*2^{\sum_{i=1}^{n}v_{i}+c}\), where \(n\) is the number of hosts, \(v_{i}\) is the number of available vulnerabilities on host \(i\), \(c\) is the number of available credentials. However, the size of the observation space of the defense agent equals the number of hosts. Only experienced attack agents can fight against the defense agent during the task execution; otherwise, too many useless actions may cause the attack agent to be discovered quickly.