# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
## 3 Game Model  
This work proposes a novel two-player network attack-defense zero-sum game model based on the partially observable stochastic game (POSG), called \"Catch the Cyber Thief\". In the proposed game, both attacker and defender interact indirectly in an internet network. The attacker is the \"thief\" who hopes to gain a certain host's administrator privilege, while the defender is the \"police\" who hopes to catch the attacker by searching the environment. Due to the lack of knowledge of the thief's location, police in the real world need to track the footprints of the thief to design a route. On the other hand, the defender in cyberspace can move directly to any desired host based on the alarm information through remote desktop and check if the node is under attack until the task is accomplished or the game ends. The game is defined by a tuple \(\langle N,\mathbb{S},T,Z,AT=\{\mathbb{A}^{1},\mathbb{O}^{1},\mathbb{R}^{1},F\},DT=\{\mathbb{A}^{2},\mathbb{O}^{2},\mathbb{R}^{2}\},\gamma\rangle\), where the following is true:  
* N: The term \(N\) is the number of agents. In the \"Catch the Cyber Thief\" game, the attack agent is represented by a superscript 1, and the defense agent is represented by a superscript 2. * \(\mathbb{S}\): The term \(\mathbb{S}\) is the state space of the game, which includes states such as available vulnerabilities and credentials on each host, the attacker's privilege on each host, the number of executions of attack actions on each host, the number of attacks that the defense agent can observe, and so on. * \(AT=\{\mathbb{A}^{1},\mathbb{O}^{1},\mathbb{R}^{1},F\}\): The term \(AT\) is the attack agent's task, which is defined as the **Cyber Navigation Task (CNT)**. The \(\mathbb{A}^{1},\mathbb{O}^{1},\mathbb{R}^{1}\) represent actions, observations, and rewards of the attack agent, which will be described in detail in future sections. The \(F\) is the number of footholds (controlled hosts) during executing the CNT task; once a host \(i\) is controlled, it is added to the foothold \(F\). The attack agent will updatethe next available hosts and select one of them as the target host for the attack. When the size of the host \(i\) equals the maximum value, the attack agent will add a new controlled host to the foothold to replace the earliest controlled host. * \(DT=\{\mathbb{A}^{2},\mathbb{O}^{2},\mathbb{R}^{2}\}\): The term \(DT\) is the defense agent's task, which is defined as the **Cyber Search Task (CST)**. The \(\mathbb{A}^{2}\), \(\mathbb{O}^{2}\), and \(\mathbb{R}^{2}\) represent actions, observations, and rewards of the defense agent, which will be described in detail in future sections. * \(T:\mathbb{S}\times\mathbb{A}\rightarrow\Delta(S)\): The term \(T\) is the state transition function. For each time step \(t\), \(T(s,\vec{a},s^{\prime})\) represents the probability transition of the environment from the state \(s\) to the successor state \(s^{\prime}\) through the joint action \(\vec{a}\). * \(Z:\mathbb{S}\times\mathbb{A}\times\mathbb{O}\rightarrow[0,1]\): The term \(Z\) is the observation function. For each time step \(t\), the observation function \(Z(s^{\prime},a,o)=p(o|s^{\prime},a)\) represents the probability of observing \(o\in\mathbb{O}\) after executing action \(a\in\mathbb{A}\) and the new state \(s^{\prime}\in\mathbb{S}\) from the environment transition. * \(\gamma\in[0,1]\): The term \(\gamma\) is the discount factor. An important assumption of the game is that both the attack and defense agents move differently due to their different abilities to control the network environment, which directly affects the definition of their tasks and the applicability of policies. In the defined CST task, the attack agent selects a controlled host as the initiating host for the attack action, then selects a reachable host as the target host for the attack action to move.