# A Game-Theoretic Approach for Network Security Using Honeypots
## 3 Materials and Methods
### Problem Formulation  
In order to reduce their costs for the network protection, the attacker's actions \(a\) and defender's actions \(d\) have opposite performance goals because the performance cost must increase for the attacker and decrease for the defender. The payoffs \(G\) for attacker and defender are \(G^{a}(a,d)\) and \(G^{d}(a,d)\), resulting in a zero-sum game:  
\[G^{a}(a,d)=-G^{d}(a,d) \tag{2}\]  
Being a leader in this game, the defender can be first in making decisions and setting up the costs. The Stackelberg equilibrium (\(SE\)) is obtained when the defender's action \(d\) is taken into consideration by the attacker's action \(a\) to give a response. We propose **course-of-action Stackelberg game (CoASG)** using the cost of each side and the game process. In order to model the attacker's decisions and actions, complementary to the gathered network information, the following can be taken into consideration:  
1. The attacker can terminate their attack at any moment by themselves;
2. When the attacker is interacting with a honeypot, the probability of success is \[p_{1}=1-\sum_{t\in T}\frac{a_{t}-h_{t}}{a_{t}}\] (3)
3. When there is no interaction with a honeypot nor success, the probability is \[p_{3}=0\] (4)  
Using the backward induction algorithm, we can find a Stackelberg equilibrium. There can be multiple SEs, but using the costs of each party, the SE with the lowest cost can be chosen. Phase 1. (a) The attacker takes into consideration the defender's \(d\) action and responds accordingly:  
\[resp(d)=argmax_{a}G^{a}(a,d) \tag{5}\]  
(b) The best course of action that is chosen by the attacker if there are multiple SEs is the one with the lowest cost:  
\[resp_{0}(d)=argmin_{resp(d)}\left(\sum_{i=1}^{n}c(a)_{i}resp(d)_{i}\right) \tag{6}\]  
Phase 2. (a) From the defender's perspective, the course of action is chosen after the attacker's response by maximizing its payoff:  
\[resp(a)=argmax_{d}G^{d}(resp_{0}(d),d) \tag{7}\]  
(b) Choosing the SE with the lowest cost gives the new course of action:  
\[resp_{0}(a)=argmin_{resp(a)}\left(\sum_{i=1}^{n}c(d)_{i}resp(a)_{i}\right) \tag{8}\]The defender's cost for adding honeypot \(h(t)\) inside the network is  
\[c_{d}(h)=\gamma l_{d}(h) \tag{9}\]  
where \(\gamma\in\mathbb{R}^{+}\) is a parameter that can be altered. Some authors addressed the problem of honeypot allocation over attack graphs in different ways. The term cyberdeception game is a growing topic as stated in [14], and the art of camouflaging is applicable in network security as well. In [15], the authors stated that securing a computing infrastructure was extremely costly and there was a clear demand for developing an automated decision support system that came to the help of a security administrator to configure the defense of the network and detect eventual attacks. They used the same technique for strengthening the network with honeypots and using them as decoys for intruders. In the paper [15], the authors proposed a model where the attacker knew the number of fake honeypots but did not know the services running on these honeypots. This assumption did not help the defender to fulfill their role but the attacker already knew what to attack and the graph was not very conclusive. Using probabilistic metrics that can be read from the Common Vulnerability Scoring System [16], some authors [15] developed an attack policy that characterized the attacker and the likelihood of a situation occurring inside the network, where the optimal state was reached when the attacker reached the maximal reward. Our method proposes that the cost of each node in the attack graph is defined as a ratio of the node cost and how many vulnerabilities coexist on that node. The cost of the first node is distributed to the following nodes based on some rules till it reaches the targeted node to be defended. Therefore, the initial hardening is focused on the first node with the greatest impact.