# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
###### Abstract
If we assume that the detection by the defender does not change the environment and the attacker loses after the defense confirms the attack. So the attacker's observation will not contain any information about the defender, which will cause the attack to solely rely on its own experience to execute tasks. **Other spatio-temporal factors. ** Obviously, network attack-defense games do not limit the scale of the network and the time for both parties to participate in the game. Since the attacker and defender cannot see the opponent's status and actions, there is no guarantee that they will act in a certain order. Even if the defender keeps on line for 24 h, its decision-making time for executing its strategy will lag behind the attacker due to the advanced nature of the attack. The aforementioned factors jointly affect the modeling of a network attack-defense game. Game theory, as a mathematical framework for describing the cooperative and competitive relationship between two or more players, has the potential to describe the complex network attack and defense decision-making processes. We hope to leverage game theory to systematically model how the attacker and defender interact in cyberspace where their opponents are invisible, which has the following challenges. _The first challenge is how to design the core game mechanism._ We can assume the attacker's objective is to get the privilege of a key host. Once the attacker controls the host that stores the confidential information, it is difficult to prevent the attack even if the defender can obtain the evidence and trace the source afterward. Therefore, the key to the attack-defense game is how the defender discovers the existence of the attack before the attacker completes his task. How to abstract this indirect confrontation is the key issue that the model needs to solve. _The second challenge is how to design the modeling elements._ Typical game elements include tasks, observations, actions, rewards, and strategies that the agent can use. In the scenario of this paper, due to the different control capabilities of the network environment, the biggest difference is the movement mode of the attacker and defender. How to take this difference into consideration in the modeling of the above game elements is the basis. _The third challenge is how to integrate real spatio-temporal elements._ For the network attack-defense game in the real world, the attacker and defender are not at the same starting point. From the spatial dimension, the scale of network topology of both players may affect the game results, and the different movement methods may also affect the effectiveness of strategies. From the time dimension, the defender has a natural lag in the initial state, and the attacker can adjust its decision-making process by intermittently cleaning up traces. The integration of these spatio-temporal elements will make the game model closer to reality. To overcome the above challenges, we propose a novel two-player zero-sum partially observable stochastic game called \"Catch the Cyber Thief\". Specifically, the model has four typical characteristics: asymmetry in observation ability, asymmetry in time dimension, asymmetry in spatial dimension, and decision-making under uncertainty. The core of this game model is to highlight how the attacker and defender fight against the invisible opponent in cyberspace and connect the attack and defense agents with the traces left by the attack agent and the distorted alarms that the defense agent may receive. In the proposed game, the attack agent is a \"thief\" who wants to get the administrator privilege of a certain key host in an unfamiliar network environment. The defender is the \"police\" who wants to catch the attacker before completing its task by searching the environment. In the experiments, we evaluate the performance of the attack and defense strategies with various conditions.