# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
###### Abstract  
This paper presents a novel multi-dimensional asymmetric game model for network attack-defense decision-making, called \"Catch the Cyber Thief\". The model is built upon the concept of partially observable stochastic games (POSG) and is designed to systematically incorporate multi-dimensional asymmetry into network attack-defense problems. The attack agent is called a \"thief\" who wants to control a key host by exploring the unfamiliar network environment, and the defense agent is called a \"police\" who needs to catch the opponent before its goal is accomplished. The results indicate that the asymmetry of network attack and defense is not only influenced by attack and defense strategies but also by spatio-temporal factors such as the attacker's initial position, network topology, and defense lag time. In addition, we have found that there may exist the \"attack rhythm,\" which makes \"how to maintain a good attack rhythm\" and \"how to generate a robust defense strategy against different attackers\" worth exploring. Compared with existing attack-defense game models, our game model can better generate a direct mapping relationship with real elements, enabling us to understand network attack and defense interactions better, recognize security risks, and design defense strategies that can directly serve real-world decision-making. network attack-defense game; partially observable stochastic game; agent-based modeling; reinforcement learning +
Footnote †: journal: Applied  
0000  
connectable hosts and found that there were exploitable vulnerabilities on host 4 and host 10, and launched attacks on these hosts in sequence. During the process of the attack, some actions taken by the attacker trigger alerts from security devices. However, due to the fact that security devices are not completely reliable, security experts still need to manually investigate potentially compromised hosts, searching for logs and other information to confirm the presence of the attack. Based on the above figure, we can summarize the asymmetry between the attacker and defender into the following factors:  
**Task objectives. ** In terms of task objectives, network attack-defense tasks have certain similarities with the hide-and-seek game in the physical world, where the attacker needs to gain unauthorized access to a target host before being detected by the defender. However, in the physical world, the environment has the same impact on both parties, but in cyberspace, this has fundamentally changed. The cyberspace environment is an unknown, non-cooperative network for the attacker. Therefore, it requires continuous exploration to complete the attack and the high technical capabilities of attackers. On the other hand, the environment is a semi-cooperative network for the defender. Although the defender understands the network topology and configuration and has installed security devices to capture suspicious traffic, it does not know which hosts have been compromised by the attacker. Therefore, the defender also needs to further inspect more hosts to confirm attacks. **Movement. ** The movement refers to how to move (take actions) by using known information (observations). Unlike point-to-point movement in the physical world, the attacker's \"movement\" is to select one of the controlled hosts as the initiating host of an attack action and then select one of the connectable hosts as the target host to attack. Therefore, the attacker's movement is a \"diffusion\" movement. Since the internal network is semi-cooperative for the defender, it can often directly check the logs of hosts in the protected network through installed security devices, so it is a \"direct\" movement. In addition, the attacker's observations come from feedback from the environment, while the  
Figure 1: How the attacker and defender interact in a layered internal network environment. defender's observations come from alarms provided by security devices.