# Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack-Defense Game
## 2 Background and Motivation  
In the previous research [4; 5; 6; 7; 8] on studying network attack-defense problems, researchers often focus on studying stealthy or partial observability, and provide us with valuable references for our work. However, in most studies, researchers assume that some elements of network attack-defense games are consistent, which cannot comprehensively capture the multi-dimensional asymmetry of network attack and defense games. Section 6 provides a more detailed introduction to the related work [9].  
To more fully reflect the asymmetry in network attack-defense problems, we select the partially observable stochastic game (POSG) approach to describe it. The reason is that the POSG does not limit the order of execution by both the attacker and defender and assumes that both sides cannot observe the true state of the system. In the end, the network attack-defense problem considered in this paper can be characterized by the following features:  
**The asymmetry in observation ability.** The biggest feature of the network intrusion defense problem is that both agents fight with an invisible opponent. The termination condition of the game is that the defense agent discovers the attack before the attack agent completes its task, and the attack agent needs to acquire the privilege of the key host before being discovered. Therefore, the attack agent only gets observations from the environment, while the defense agent receives observations triggered by the attacking actions, although these observations do not fully reflect the real actions of the attack agent.  
**The asymmetry in the time dimension.** Time is another important factor affecting the game. Although the attack agent cannot see the opponent's status, actions, and other information, it can reduce the risk of being detected by clearing attack traces rather than simply \"moving\" to the target host. Another important time factor is the defense lag time. Since the premise of defense detection is that the attack has already occurred, the defense agent is inherently lagging. The defense lag time directly affects the quality of the defense strategy.  
**The asymmetry in the spatial dimension.** The biggest difference between the attacker and the defender comes from the difference in \"movement mode,\" which is due to the different control capabilities of the network environment. Attackers can obtain initial strongholds in the target network utilizing phishing emails, exploiting website vulnerabilities, etc., and may \"jump\" from a non-fixed initial position to perform tasks, while the defender can directly detect hosts in the target network, which is fundamentally different from point-to-point movement in physical space. In addition, the scale of network topology can also affect the results of network attack-defense games.  
**Decision-making under uncertainty.** In the context of network intrusion defense, meeting the pre-conditions of an attack does not ensure successful execution due to the instability of attack tools and actions. For defenders, factors such as the false alarm rate (e.g., network security devices analyzing traffic at specific sampling rates, absence of a comprehensive fingerprint library, etc.) and false alarm rate (e.g., security detection equipment misidentifying normal behaviors as attack patterns, etc.) make it challenging to definitively ascertain the presence of an attack. Consequently, both the attacker's and defender's uncertainties must be considered in the defense strategy.  
Based on the above analysis, the attack and defense agents are not in the same space-time environment, and both agents do not have a predetermined order and can make decisions at the same time or one after the other. In addition, both agents need to make decisions based on observations and rewards, but neither can obtain the complete real state of the environment, so a partially observable stochastic game method can be used to model this problem.