# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
## 3 Game Model
### The Observation Function  
The observation function is the core of the \"Catch the Cyber Thief\" game. The most important thing in designing an observation function is to reflect on how to fight with the invisible opponent in cyberspace. Therefore, it is necessary to incorporate the following basic design principles into the modeling process.  
1. When the attack agent launches an attack action from one host to another, the defense agent may receive the alarm information with a certain probability. However, when an attack agent executes local operations, no alarm message is generated.
2. The more times an attack agent attacks a host, the higher the probability that the defense agent will find the attack. Since the defense agent is uncertain whether the host has been attacked before, it may need to check multiple times to confirm.
3. The attack agent can reduce the possibility of being detected by executing actions to clean up traces. The longer the time (or the more times executing actions to clean up traces), the less likely it will be detected;
4. If a host is attacked, even if the attacker executes multiple cleaning actions, there is a small probability that the defense agent can find the attack.  
Based on the above principles, we modeled the observation function as the **detection success rate (detectRate)** by referring to the softmax function. The detectRate is positively correlated with the number of attacks on each host and is defined as  
\[\text{detectRate}=\begin{cases}\dfrac{1}{1+\exp^{-\text{count}_{i}+2}},&\text {IF}\quad\text{pri}_{t}(i)\geq 1;\\ 0,&\text{IF}\quad\text{pri}_{t}(i)=0.\end{cases} \tag{1}\]  
where \(\text{pri}_{t}(i)\) represents the privilege of the attack agent having the authority of the host \(i\) at time \(t\). When \(\text{pri}_{t}(i)=0\) means the attack agent has no privilege of host \(i\), \(\text{pri}_{t}(i)=1\) means the attack agent has normal user privilege of host \(i\), and \(\text{pri}_{t}(i)=2\) means the attack agent has administrator privilege of host \(i\).  
The detectRate is calculated based on the number of attacks on each host. The count\({}_{i}\) represents the number of attack actions executed on host \(i\). When count\({}_{i}\) is equal to 2, the detection rate is 0.5. After the number of attacks exceeds 2, the probability of being detected increases rapidly. Figure 3 further describes the interactions between both agents in the \"Catch the Cyber Thief\" game.  
Figure 2: The state transition process in the “Catch the Cyber Thief” game.  
It can be seen that when the attack agent executes an attack action, the network environment will leave attack \"footprints\". When the attack agent decides to clean up those \"footprints,\" it can reduce the probability of being detected. These attack actions will trigger network defense alarms; however, due to the existence of a false alarm rate and the possible actions executed by the attack agent locally, not all attack actions can be observed by the defense agent.  
The \"Catch the Cyber Thief\" game regards the attack and defense interactions as an asymmetric decision-making game model. The defense agent receives cumulative alarms and can establish a mapping relationship with real traffic. It is more in line with the characteristics of the defense using distorted observations to fight with the invisible opponent. For the attack agent, it cannot execute too many attack actions, which may lead to faster failure of its task.