# A Novel Attack-and-Defense Signaling Game for Optimal Deceptive Defense Strategy Choice

Authors: Yongjin Hu; Han Zhang; Yuanbo Guo; Tao Li; Jun Ma
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

Increasingly, more administrators (defenders) are using defense strategies with deception such as honeypots to improve the IoT network security in response to attacks. Using game theory, the signaling game is leveraged to describe the confrontation between attacks and defenses. However, the traditional approach focuses only on the defender; the analysis from the attacker side is ignored. Moreover, insufficient analysis has been conducted on the optimal defense strategy with deception when the model is established with the signaling game. In our work, the signaling game model is extended to a novel two-way signaling game model to describe the game from the perspectives of both the defender and the attacker. First, the improved model is formally defined, and an algorithm is proposed for identifying the refined Bayesian equilibrium. Then, according to the calculated benefits, optimal strategies choice for both the attacker and the defender in the game are analyzed. Last, a simulation is conducted to evaluate the performance of the proposed model and to demonstrate that the defense strategy with deception is optimal for the defender.


---

## Body

## 1. Introduction

IoT networks and devices are highly vulnerable to sophisticated cyber-attacks. Despite the widespread deployment of security monitoring tools, which include firewalls and intrusion detection systems (IDSs), attackers can infiltrate target IoT devices by leveraging multiple attack vectors [1].Recently, honeypot-enabled deceptive security mechanisms were introduced as an emerging proactive cyber defense strategy for confusing or misleading attackers and showed significant advantages over traditional security techniques [2]. For attackers, deceptive behaviors of defenders increase the uncertainty of the target to be compromised [3]. Attackers must spend additional resources (e.g., time and money) to deal with the uncertainty via reconnaissance and to develop situational awareness. In addition, deceptive behaviors prevent attackers from launching efficient custom attacks. For example, by collecting an attacker’s information when he is compromising a target device that is disguised by honeypots, the defender can use the learned knowledge to enhance the IoT network security [4]. As a result, deception by providing seemingly convincing yet misleading information to deceive attackers has become a major defense mechanism. With the wide utilization of deception, the security status of organizations has been substantially improved. When attackers are following the seven phases of the cyber kill chain [5] in launching an attack, deception approaches can be performed effectively in disrupting each stage of the cyber kill chain, as illustrated in Figure 1.Figure 1
Deception focus on each stage of the cyber kill chain.The contributions of the paper are the following.(1) A two-way signaling game model based on the signaling game is formally defined to describe the confrontation from the perspectives of both the defender and the attacker. (2) With the two-way signaling game model, an algorithm is defined to identify the refined Bayesian equilibrium in the game. (3) With the deception strategy introduced, the optimal strategies choice for both the attacker and the defender in the game is analyzed.


## 2. Related Works

In previous work [6], due to a lack of clarity regarding the concept of deception, deploying honeypots to detect an attacker and to obtain information on the attacker’s intentions is the primary deception mode for the defender to use. For instance, Rowe et al. [7] showed how to decrease the number of attacks to which a network is subjected by utilizing fake honeypots, namely, by disguising normal systems as honeypots. Garg and Grosu [8] used a honeynet system to characterize deception, where defenders may have the choice to conceal a regular host as a honeypot (or inversely) in response to the attackers’ probe. Seamus et al. [9] created a honeypot that simulates a ZigBee gateway to assess the presence of the ZigBee attack intelligence on a SSH attack vector in Wireless Sensor Networks (WSNs).Until recent years, as deception became a powerful tool for protecting IoT networks and devices against attackers [10], game theory was introduced into the field of cybersecurity to model the interaction between defender and attacker and to identify the optimal defense strategies for both players. Cohen [11] comprehensively discussed deception as a technique for protecting information systems and concluded that deception has a positive effect for the defenders and a negative effect for the attackers. Carroll and Grosu [12] modeled the way deception affects the attack-defense interactions based on a game in which the players (defenders and attackers) have incomplete knowledge of each other. Pawlick and Zhu [13] extended the signaling game by assuming that the adversary can obtain evidence of the true state of the system, and they concluded that the effectiveness of deceptive defenders sometimes increases if an adversary develops the ability to detect deception. Duan et al. [14] proposed an energy-aware trust derivation scheme using the game theoretic approach to manage overhead while maintaining adequate security of WSNs. Fugate and Ferguson [15] discussed techniques for combining artificial intelligence algorithms with game theory models to estimate hidden states of the attacker using feedback through payoffs to learn how to optimally defend the system using cyber deception. Additional works are listed in Table 1.Table 1
Research on modeling deception defense by game theory.
AuthorFocus of the studyÇeker et al. [16]Modeled with a similar approach that uses game theory and provides the option of disguising a real system as a honeypot (or vice versa) to mitigate denial of service (DoS) attacksHichem et al. [17]Proposed a game theoretic technique to activate anomaly detection technique only when a new attack’s signature is expected to occurAaron et al. [18]To increase the uncertainty of adversarial reconnaissance and introduced a novel game theoretic model of deceptive interactions between a defender and a cyber-attacker into responses to network scans or reconnaissanceSomdip [19]Proposed a methodology in which game theory can be used to model the activity of stakeholders in the networks to detect anomalies such as collusion by using a supervised machine learning algorithm and algorithmic game theoryPawlick and Zhu [20]Investigated a model of signaling games in which the receiver can detect deception with a specified probabilityKun et al. [21]Employed Nash equilibrium in the noncooperative game model and analyzes its efficiency in vehicular ad hoc networksAs discussed above, in contrast to the previous focus on the analysis of the defender, our work will describe the process from not only the perspective of the defender but also that of the attacker.


## 3. An Improved Signaling Game Model

### 3.1. Analysis of the Novel Attack–And–Defense Signaling Game

According to [22–24], the information that is released by the defender actively or the information that is leaked via defensive behavior passively is an important decision-making basis for the attacker. Such information is referred to as the signal that is sent by the defender, and the defense signal can affect the behavior of the attacker by changing the benefits to both the attacker and the defender. Furthermore, we believe that the information that is released by the attacker and observed by the defender will also affect the defense decision and change the final attack-and-defense benefits. We construct an attack-and-defense behavior interaction model with incomplete information. According to signaling game theory, we analyze the dynamic game process and the signal mechanism from the perspectives of both attack and defense, and we investigate the influence of defense signals on the game equilibrium and strategy choice for both the attacker and the defender. We describe this process as a novel attack-and-defense signaling game that is defined as a two-way signaling game model, as illustrated in Figure 2.Figure 2
In a two-way signaling game model, the forward direction is defined as the defender sending a signalmd to the attacker, who will infer the type of the defender θ and choose the action a; the reverse direction is defined as the attacker sending a signal ma to the defender, who will infer the type η of the attacker and choose the action d.The defender is defined as the leader of the signaling game, and the attacker is the follower when analyzing the forward signal transmission. The roles of the attacker and the defender will be exchanged when analyzing the reverse signal transmission. By constructing the attack–and–defense game process in both the forward and reverse directions, the influences of two examples on the defense strategy are analyzed: (1) in the forward phase, ① a defender mixes a defensive strategy with a (or no) deception strategy to deter, deceive, and induce the attacker and sends a defensive signal; ② the attacker forms an initial belief regarding the defender type by collecting reconnaissance information in advance and public information from the defender. The attack strategy is selected according to the calculation of the Bayesian posterior probability for the defender type; and ③ the defender selects the optimal defense strategy for implementing security defense. (2) In the reverse phase, ① the attacker sends an attack signal while attacking; ② the defender forms a belief regarding the attacker. Under the action of the attack signal, the defender calculates the Bayesian posterior probability of the attacker type and corrects the defense strategy accordingly; and ③ the attacker corrects the current optimal attack strategy.For convenience, we analyze the forward signaling game process and the reverse process separately; however, logically, these two processes are conducted simultaneously. Therefore, the strategy choice that is made by the defender is simultaneously affected by these two processes.


### 3.2. Formal Definition of the Two-Way Signaling Game Model

Definition 1.
The two-way signaling game model for defense strategy selection with deceptionGDS can be represented by a nine-tuple GDS=N,Θ,M,S,PA,PA′,PD,PD′,U, in which
①N=ND,NA denotes the player set for a two-play game, where ND denotes the set for the defender and NA the set for the attacker.
②Θ=ΘD,ΘA denotes the type set for the defender and the attacker. The type of defender ΘD=θii=1,2,⋯n is the private information, which determined by the defensive action that is taken; the type of attacker ΘA=ηjj=1,2,⋯n is the private information of the attacker, which is determined by the attack action that is taken.
③M=MD,MA denotes the signal set for the defender and the attacker. MD=mdd=1,2,⋯MD≠∅ denotes that the defender selects and releases the signal according to the set signal release mechanism. For ease of representation, the signal name is consistent with the defender type name. The defense signal and the defender type are not necessarily consistent due to the objective of deceiving and inducing the attacker. Similarly,MA=maa=1,2,⋯MA≠∅ denotes the attack signal that is sent by the attacker, and the signal name is the same as the attacker type name.
④S=D,A denotes the strategy set for the defender and the attacker, where D=dgg=1,2,⋯ and A=ahh=1,2,⋯ denote the defense strategy and the attack strategy, respectively.
⑤PA is the belief set of the attacker on the type of defender, wherePA=pAθ1,pAθ2,⋯,pAθn=γ1,⋯,γn.
⑥PA′ is the posterior probability set of the attacker on the type of defender, where, PA′=PA′θi∣md=μ1,⋯,μn denotes the posterior probability of the type of defender, which follows the Bayesian rule, after the attacker observes the defensive signal md.
⑦PD is the belief set of the defender on the type of attacker, where PD=pDη1,pDη2,⋯,pDηn=σ1,⋯,σn.
⑧PD′ is the posterior probability set of the defender on the type of attacker, where PD′=PD′ηi∣ma=δ1,⋯,δn denotes the posterior probability of the type of attacker, which follows the Bayesian rule, after the defender observes the defensive signal ma.
⑨U=UD,UA denotes the expected utility set of the defender and the attacker, whose value is determined by the strategies that are chosen by all players. The corresponding utility functions will be discussed in the next section.


### 3.3. Refined Bayesian Equilibrium Solution and the Optimal Defense Strategy Choice

According to Definition1, this section extends the refined Bayesian equilibrium to the two-way signaling game model based on the definition of the refined Bayesian equilibrium [25] and proposes a refined Bayesian equilibrium algorithm for the two-way signaling game. Instances in the forward direction and in the reverse direction for the two-way signaling game model were constructed to show the details.Definition 2.
The equilibrium in a two-way signaling game model for defense strategy choice with deception is a refined Bayesian equilibrium if the following requirements are satisfied:(I)
a∗m∈argmaxa∑θPA′θ∣mU2m,a,θ.(II)
m∗θ∈argmaxmU1m,a∗m,θ.(III)
P′θ∣m is the posterior probability that is calculated by the signal receiver according to the Bayesian rule based on the prior probability Pθ, signal m, and the signal sender’s optimal strategy m∗θ.In (I),a∗m denotes the optimal action that is adopted by the signal receiver after obtaining the posterior probability P′θ∣m of the type to which the signal sender belongs; U2m,a,θ denotes the utility function of the signal receiver, which is the expected utility function of attacker UDmj,dg,ah,θi in the forward direction and the expected utility function of the defender UDmj,dg,ah,θi in the reverse direction; and θ∈Θ=ΘD,ΘA denotes the type set for the defender and the attacker, where θ∈ΘD=θii=1,2,⋯n in the forward direction and θ∈ΘA=ηjj=1,2,⋯n in the reverse direction.In (II),m∗θ denotes the optimal strategy that is selected by the signal sender after predicting the optimal action a∗m of the signal receiver; U1m,a∗m,θ denotes the utility function of the signal sender, which is UDmj,dg,ah,θi in the forward direction, and UAmj,dg,ah,θi in the reverse direction.In (III),P′θ∣m indicates the posterior probability calculated by signal receiver according to the signal sent by the signal sender followed by the Bayesian rule, which is PA′ in the forward direction andPB′ in the reverse direction.


### 3.4. Method of Refined Bayesian Equilibrium in the Two-Way Signaling Game Model

The steps are as follows:(1)
Construct the posterior inferencePθ∣m of various information sets on the signaling game tree(2)
Calculate the optimal strategy for the signal receiver according to the posterior inferenceWhen observing the signalm∈M, the signal receiver will choose optimal strategy a∗m according toPθ∣m for the type θ of the sender to maximize the expected utility U2, namely, the signal receiver will identify his optimal strategy a∗m by calculatingmax∑pθ∣mU2mθ,a,θ.
(3)
Calculate the optimal strategy for the signal sender according to the posterior inferenceThe signal sender foresees that the signal receiver will select the optimal strategy based on observations of the signal that is released by him and chooses the strategy that maximizes the expected utilityU1, namely, the signal sender identifies his optimal strategy m∗θ based on the posterior inference by calculating maxU1m,a∗m,θ.
(4)
Calculate the refined Bayesian equilibriumCalculateP′θ via the Bayesian rule according to a∗m from (2), m∗θ from (3), and the belief P. If P′θ and Pθ∣m are not in conflict, then the refined Bayesian equilibrium solution is EQ=m∗θ,a∗m,P′θ∣m.The following two instances of the forward direction and the reverse direction of the signaling game demonstrate the process above. The defender type is denoted asΘD=θN,θH=Normalsys,Honeypotsys, and the signal corresponds to the defender type, namely, MD=mN,mH=NomlSysSig,HonSysSig. In addition, the defensive strategy set isD=dgg=1,2,⋯, and the utility function is UDmj,dg,ah,θi; the attacker type is denoted as ΘA=ηH,ηL=AdvAttacker,PrimAttacker, with the attack strategy A=ahh=1,2,⋯, and the utility function is UAmj,dg,ah,θi.


### 3.5. Refined Bayesian Equilibrium Solution Method for the Forward Signaling Game

A game of incomplete information can be transformed into a game of imperfect information by adding a hypothetical player, namely, nature (denoted by C here), and by conditioning the payoffs on Nature’s unknown moves. The nature player moves first by randomly choosing the defender type with the prior probability distribution over all defender types. In the forward direction, nature assigns typeθN with probability pDθN and type θH with pDθH. Once the defender has learned her type, she decides what signal or message to send to the attacker. The signal provides indirect information for the attacker about the defender type. In our example, the defender can send either signal mN (signaling that the defender type is θN) or mH (signaling that the defender type is θH). The defender can send signal mH, even in the case that her real type is θN, or send signal mN, even in the case that her real type is θH. The attacker revises his judgement on the defender type and takes action ONP,OHP if observing signal mNand action WNP,WHP if observing the signal mH, as the posterior probability for the defender type θN,θH. In the game tree, aij indicates eight outcomes, which results in a corresponding payoff. The forward signaling game tree GDSF is presented in Figure 3.Figure 3
In the signaling game treeGDSF for the forward direction, m∗=md∗d∗,θ=md∗θ indicates that defender θ is sending signal md∗ and chooses strategy d∗md∗ according to the signal, which is denoted as md∗θ; a∗=a∗ah,md=a∗md indicates that the attacker responds with action a∗ah,md, which is denoted as a∗md; P′=PA′θ∣md=PA′ indicates that the attacker calculated PA′θ∣md as the posterior probability for the type of the defender, which is denoted as PA′; and the existence of a refined Bayesian equilibrium is abbreviated as EQ=md∗θ,a∗md,PA′.


### 3.6. Refined Bayesian Equilibrium Solution Method for the Reverse Signaling Game

Nature moves first by randomly choosing the attacker type with the prior probability distribution over the attacker types. The reverse signaling game treeGDSR is presented in detail in Figure 4.Figure 4
In the signaling game treeGDSR for the reverse direction, nature assigns type ηH with probability pAηH and type ηL with pAηL. The attacker can send either signal mA (signaling that the attacker is of typeηH) or mP (signaling that the defender is of type ηL). The defender will revise her judgement on the type of the attacker by selecting SHN,SLN if observing signal mA and DHN,DLN if observing signal mP as the posterior probability for the type of the attacker ηH,ηL. uijdenotes eight outcomes, where each outcome results in the corresponding payoff.According to the definition,m∗=ma∗a∗,η=ma∗η indicates that attacker η sends signal ma∗ and chooses strategy a∗ma∗ according to the signal, which is denoted as ma∗η; a∗=a∗dg,ma=a∗ma indicates the defender’s responding action a∗dg,ma, which is denoted as a∗ma; P′=PD′η∣ma=PD′ indicates that the defender calculated PD′η∣ma as the posterior probability for the attacker type, which is denoted as PD′; and the existence of a refined Bayesian equilibrium is denoted as EQ=ma∗η,a∗ma,PD′. Based on the two examples above and the algorithm in [26], the optimal strategy selection algorithm for the two-way signaling game model is presented as Algorithm 1.Algorithm 1: Optimal strategy choice algorithm description based on a two-way signaling game model.
Input: ModelGDS, Signal direction parameter wOutput: Optimal strategy for the defenderBEGINif (w =1)//forward-direction signalling game{Initialize (θ∈ΘD=θii=1,2,⋯n);//Initialize the type of the defenderInitialize (MD=mdd=1,2,⋯,P=PA=pθ1,⋯,pθn);//Initialize the signal of the defender and the belief of the defender regarding the attacker}If (w =0)//reverse-direction signalling game{Initialize (θ∈ΘA=ηjj=1,2,⋯n);//Initialize the type of the attackerInitialize (MA=maa=1,2,⋯P=PD=pDη1,pDη2,⋯,pDηn);//Initialize the signal of the attacker and the belief of the attacker regarding the defender}Initialize (S=D,A,D=d1,⋯,dg,A=a1,⋯,ah);//Initialize the strategies for both playerswhile (ah∈A&&mj∈M&&dg∈D)//Calculate the utility{UAmj,dg,ah,θi=∑g,hCscdg,ah−Ca;UDmj,dg,ah,θi=∑g,hCscdg,ah−Cd−Cds;}//Obtain the refined Bayesian Equilibriuma∗m∈argmaxa∈A∑P′θ∣mUAm∗θ,a,θ;m∗θ∈argmaxm∈MUDm,a∗m,d∗m∗,θ;//Calculate the optimal strategy for attack and defenceBayesian (PA′θ);//Calculate the posterior probability and apply the Bayesian rulefor the defenderCreatem∗θ,a∗m,PA′θ; //Construct the refined Bayesian equilibriumSort (m∗θ);//descendingOutput (m∗θ);//output the optimal strategy for the defenderEnd


## 3.1. Analysis of the Novel Attack–And–Defense Signaling Game

According to [22–24], the information that is released by the defender actively or the information that is leaked via defensive behavior passively is an important decision-making basis for the attacker. Such information is referred to as the signal that is sent by the defender, and the defense signal can affect the behavior of the attacker by changing the benefits to both the attacker and the defender. Furthermore, we believe that the information that is released by the attacker and observed by the defender will also affect the defense decision and change the final attack-and-defense benefits. We construct an attack-and-defense behavior interaction model with incomplete information. According to signaling game theory, we analyze the dynamic game process and the signal mechanism from the perspectives of both attack and defense, and we investigate the influence of defense signals on the game equilibrium and strategy choice for both the attacker and the defender. We describe this process as a novel attack-and-defense signaling game that is defined as a two-way signaling game model, as illustrated in Figure 2.Figure 2
In a two-way signaling game model, the forward direction is defined as the defender sending a signalmd to the attacker, who will infer the type of the defender θ and choose the action a; the reverse direction is defined as the attacker sending a signal ma to the defender, who will infer the type η of the attacker and choose the action d.The defender is defined as the leader of the signaling game, and the attacker is the follower when analyzing the forward signal transmission. The roles of the attacker and the defender will be exchanged when analyzing the reverse signal transmission. By constructing the attack–and–defense game process in both the forward and reverse directions, the influences of two examples on the defense strategy are analyzed: (1) in the forward phase, ① a defender mixes a defensive strategy with a (or no) deception strategy to deter, deceive, and induce the attacker and sends a defensive signal; ② the attacker forms an initial belief regarding the defender type by collecting reconnaissance information in advance and public information from the defender. The attack strategy is selected according to the calculation of the Bayesian posterior probability for the defender type; and ③ the defender selects the optimal defense strategy for implementing security defense. (2) In the reverse phase, ① the attacker sends an attack signal while attacking; ② the defender forms a belief regarding the attacker. Under the action of the attack signal, the defender calculates the Bayesian posterior probability of the attacker type and corrects the defense strategy accordingly; and ③ the attacker corrects the current optimal attack strategy.For convenience, we analyze the forward signaling game process and the reverse process separately; however, logically, these two processes are conducted simultaneously. Therefore, the strategy choice that is made by the defender is simultaneously affected by these two processes.


## 3.2. Formal Definition of the Two-Way Signaling Game Model

Definition 1.
The two-way signaling game model for defense strategy selection with deceptionGDS can be represented by a nine-tuple GDS=N,Θ,M,S,PA,PA′,PD,PD′,U, in which
①N=ND,NA denotes the player set for a two-play game, where ND denotes the set for the defender and NA the set for the attacker.
②Θ=ΘD,ΘA denotes the type set for the defender and the attacker. The type of defender ΘD=θii=1,2,⋯n is the private information, which determined by the defensive action that is taken; the type of attacker ΘA=ηjj=1,2,⋯n is the private information of the attacker, which is determined by the attack action that is taken.
③M=MD,MA denotes the signal set for the defender and the attacker. MD=mdd=1,2,⋯MD≠∅ denotes that the defender selects and releases the signal according to the set signal release mechanism. For ease of representation, the signal name is consistent with the defender type name. The defense signal and the defender type are not necessarily consistent due to the objective of deceiving and inducing the attacker. Similarly,MA=maa=1,2,⋯MA≠∅ denotes the attack signal that is sent by the attacker, and the signal name is the same as the attacker type name.
④S=D,A denotes the strategy set for the defender and the attacker, where D=dgg=1,2,⋯ and A=ahh=1,2,⋯ denote the defense strategy and the attack strategy, respectively.
⑤PA is the belief set of the attacker on the type of defender, wherePA=pAθ1,pAθ2,⋯,pAθn=γ1,⋯,γn.
⑥PA′ is the posterior probability set of the attacker on the type of defender, where, PA′=PA′θi∣md=μ1,⋯,μn denotes the posterior probability of the type of defender, which follows the Bayesian rule, after the attacker observes the defensive signal md.
⑦PD is the belief set of the defender on the type of attacker, where PD=pDη1,pDη2,⋯,pDηn=σ1,⋯,σn.
⑧PD′ is the posterior probability set of the defender on the type of attacker, where PD′=PD′ηi∣ma=δ1,⋯,δn denotes the posterior probability of the type of attacker, which follows the Bayesian rule, after the defender observes the defensive signal ma.
⑨U=UD,UA denotes the expected utility set of the defender and the attacker, whose value is determined by the strategies that are chosen by all players. The corresponding utility functions will be discussed in the next section.


## 3.3. Refined Bayesian Equilibrium Solution and the Optimal Defense Strategy Choice

According to Definition1, this section extends the refined Bayesian equilibrium to the two-way signaling game model based on the definition of the refined Bayesian equilibrium [25] and proposes a refined Bayesian equilibrium algorithm for the two-way signaling game. Instances in the forward direction and in the reverse direction for the two-way signaling game model were constructed to show the details.Definition 2.
The equilibrium in a two-way signaling game model for defense strategy choice with deception is a refined Bayesian equilibrium if the following requirements are satisfied:(I)
a∗m∈argmaxa∑θPA′θ∣mU2m,a,θ.(II)
m∗θ∈argmaxmU1m,a∗m,θ.(III)
P′θ∣m is the posterior probability that is calculated by the signal receiver according to the Bayesian rule based on the prior probability Pθ, signal m, and the signal sender’s optimal strategy m∗θ.In (I),a∗m denotes the optimal action that is adopted by the signal receiver after obtaining the posterior probability P′θ∣m of the type to which the signal sender belongs; U2m,a,θ denotes the utility function of the signal receiver, which is the expected utility function of attacker UDmj,dg,ah,θi in the forward direction and the expected utility function of the defender UDmj,dg,ah,θi in the reverse direction; and θ∈Θ=ΘD,ΘA denotes the type set for the defender and the attacker, where θ∈ΘD=θii=1,2,⋯n in the forward direction and θ∈ΘA=ηjj=1,2,⋯n in the reverse direction.In (II),m∗θ denotes the optimal strategy that is selected by the signal sender after predicting the optimal action a∗m of the signal receiver; U1m,a∗m,θ denotes the utility function of the signal sender, which is UDmj,dg,ah,θi in the forward direction, and UAmj,dg,ah,θi in the reverse direction.In (III),P′θ∣m indicates the posterior probability calculated by signal receiver according to the signal sent by the signal sender followed by the Bayesian rule, which is PA′ in the forward direction andPB′ in the reverse direction.


## 3.4. Method of Refined Bayesian Equilibrium in the Two-Way Signaling Game Model

The steps are as follows:(1)
Construct the posterior inferencePθ∣m of various information sets on the signaling game tree(2)
Calculate the optimal strategy for the signal receiver according to the posterior inferenceWhen observing the signalm∈M, the signal receiver will choose optimal strategy a∗m according toPθ∣m for the type θ of the sender to maximize the expected utility U2, namely, the signal receiver will identify his optimal strategy a∗m by calculatingmax∑pθ∣mU2mθ,a,θ.
(3)
Calculate the optimal strategy for the signal sender according to the posterior inferenceThe signal sender foresees that the signal receiver will select the optimal strategy based on observations of the signal that is released by him and chooses the strategy that maximizes the expected utilityU1, namely, the signal sender identifies his optimal strategy m∗θ based on the posterior inference by calculating maxU1m,a∗m,θ.
(4)
Calculate the refined Bayesian equilibriumCalculateP′θ via the Bayesian rule according to a∗m from (2), m∗θ from (3), and the belief P. If P′θ and Pθ∣m are not in conflict, then the refined Bayesian equilibrium solution is EQ=m∗θ,a∗m,P′θ∣m.The following two instances of the forward direction and the reverse direction of the signaling game demonstrate the process above. The defender type is denoted asΘD=θN,θH=Normalsys,Honeypotsys, and the signal corresponds to the defender type, namely, MD=mN,mH=NomlSysSig,HonSysSig. In addition, the defensive strategy set isD=dgg=1,2,⋯, and the utility function is UDmj,dg,ah,θi; the attacker type is denoted as ΘA=ηH,ηL=AdvAttacker,PrimAttacker, with the attack strategy A=ahh=1,2,⋯, and the utility function is UAmj,dg,ah,θi.


## 3.5. Refined Bayesian Equilibrium Solution Method for the Forward Signaling Game

A game of incomplete information can be transformed into a game of imperfect information by adding a hypothetical player, namely, nature (denoted by C here), and by conditioning the payoffs on Nature’s unknown moves. The nature player moves first by randomly choosing the defender type with the prior probability distribution over all defender types. In the forward direction, nature assigns typeθN with probability pDθN and type θH with pDθH. Once the defender has learned her type, she decides what signal or message to send to the attacker. The signal provides indirect information for the attacker about the defender type. In our example, the defender can send either signal mN (signaling that the defender type is θN) or mH (signaling that the defender type is θH). The defender can send signal mH, even in the case that her real type is θN, or send signal mN, even in the case that her real type is θH. The attacker revises his judgement on the defender type and takes action ONP,OHP if observing signal mNand action WNP,WHP if observing the signal mH, as the posterior probability for the defender type θN,θH. In the game tree, aij indicates eight outcomes, which results in a corresponding payoff. The forward signaling game tree GDSF is presented in Figure 3.Figure 3
In the signaling game treeGDSF for the forward direction, m∗=md∗d∗,θ=md∗θ indicates that defender θ is sending signal md∗ and chooses strategy d∗md∗ according to the signal, which is denoted as md∗θ; a∗=a∗ah,md=a∗md indicates that the attacker responds with action a∗ah,md, which is denoted as a∗md; P′=PA′θ∣md=PA′ indicates that the attacker calculated PA′θ∣md as the posterior probability for the type of the defender, which is denoted as PA′; and the existence of a refined Bayesian equilibrium is abbreviated as EQ=md∗θ,a∗md,PA′.


## 3.6. Refined Bayesian Equilibrium Solution Method for the Reverse Signaling Game

Nature moves first by randomly choosing the attacker type with the prior probability distribution over the attacker types. The reverse signaling game treeGDSR is presented in detail in Figure 4.Figure 4
In the signaling game treeGDSR for the reverse direction, nature assigns type ηH with probability pAηH and type ηL with pAηL. The attacker can send either signal mA (signaling that the attacker is of typeηH) or mP (signaling that the defender is of type ηL). The defender will revise her judgement on the type of the attacker by selecting SHN,SLN if observing signal mA and DHN,DLN if observing signal mP as the posterior probability for the type of the attacker ηH,ηL. uijdenotes eight outcomes, where each outcome results in the corresponding payoff.According to the definition,m∗=ma∗a∗,η=ma∗η indicates that attacker η sends signal ma∗ and chooses strategy a∗ma∗ according to the signal, which is denoted as ma∗η; a∗=a∗dg,ma=a∗ma indicates the defender’s responding action a∗dg,ma, which is denoted as a∗ma; P′=PD′η∣ma=PD′ indicates that the defender calculated PD′η∣ma as the posterior probability for the attacker type, which is denoted as PD′; and the existence of a refined Bayesian equilibrium is denoted as EQ=ma∗η,a∗ma,PD′. Based on the two examples above and the algorithm in [26], the optimal strategy selection algorithm for the two-way signaling game model is presented as Algorithm 1.Algorithm 1: Optimal strategy choice algorithm description based on a two-way signaling game model.
Input: ModelGDS, Signal direction parameter wOutput: Optimal strategy for the defenderBEGINif (w =1)//forward-direction signalling game{Initialize (θ∈ΘD=θii=1,2,⋯n);//Initialize the type of the defenderInitialize (MD=mdd=1,2,⋯,P=PA=pθ1,⋯,pθn);//Initialize the signal of the defender and the belief of the defender regarding the attacker}If (w =0)//reverse-direction signalling game{Initialize (θ∈ΘA=ηjj=1,2,⋯n);//Initialize the type of the attackerInitialize (MA=maa=1,2,⋯P=PD=pDη1,pDη2,⋯,pDηn);//Initialize the signal of the attacker and the belief of the attacker regarding the defender}Initialize (S=D,A,D=d1,⋯,dg,A=a1,⋯,ah);//Initialize the strategies for both playerswhile (ah∈A&&mj∈M&&dg∈D)//Calculate the utility{UAmj,dg,ah,θi=∑g,hCscdg,ah−Ca;UDmj,dg,ah,θi=∑g,hCscdg,ah−Cd−Cds;}//Obtain the refined Bayesian Equilibriuma∗m∈argmaxa∈A∑P′θ∣mUAm∗θ,a,θ;m∗θ∈argmaxm∈MUDm,a∗m,d∗m∗,θ;//Calculate the optimal strategy for attack and defenceBayesian (PA′θ);//Calculate the posterior probability and apply the Bayesian rulefor the defenderCreatem∗θ,a∗m,PA′θ; //Construct the refined Bayesian equilibriumSort (m∗θ);//descendingOutput (m∗θ);//output the optimal strategy for the defenderEnd


## 4. Simulation Results and Analysis

### 4.1. Simulation Environment

To evaluate the proposed attack-and-defense signaling game model and the algorithm for optimal strategy selection, we construct the simulation environment illustrated in Figure5.Figure 5
Game scenario with deception, which considers two decision makers, namely, a defender and an attacker. The defender deploys a honeypot in the IoT network as either a system or a service host. In the specified scenario, the forward and reverse transmissions occur simultaneously. The sequences of moves, type sets, and action sets follow the modeling elements that were discussed in the previous section. The incomplete information comes from the attacker’s uncertainty regarding the type of the system.


### 4.2. Calculating the Utility

According to Richard [27], common vulnerability [28] and the database of attack-and-defense behaviors from MIT [29], attack strategies that are composed of basic options are listed in Table 2.Table 2
Attack strategy description.
No.Basic attack optionAttack strategyA1A2a1Remote buffer overflow√√a2homepage attack√a3LPC to LSASS process√√a4Apache chunk overflow√a5Steal account and crack it√a6Oracle TNS listener√Common defense strategies with deception that are composed of basic operations are described in Table3.Table 3
Defense strategy description.
No.Basic defense optionDefense strategyD1D2d1Honey file√√d2Honey account√√d3Using honeycomb√d4Uninstall delete Trojan√d5Limit access to MDSYS√d6Web app honeypot√For selecting the optimal strategy more scientifically and intuitively, the most basic approach is to quantify the utilities of the strategies that are selected by the defender and the attacker. In this paper, we utilize the scheme that was proposed by Zhang and Li [30] to calculate the expected utility functions of the defenders and the attackers as follows:
(1)UAmj,dg,ah,θ=∑g,hCscdg,ah−Ca,(2)UDmj,dg,ah,θi=∑g,hCscdg,ah−Cd−Cds.The notations that are used in equations (1) and (2) are described in Table 4.Table 4
Notation descriptions.
NotationDescriptionUAmj,dg,ah,θiExpected utility function of the attackerUDmj,dg,ah,θiExpected utility function of the defenderCa: cost of attackCost of the attacker using various attack measuresCd: cost of defenseCost of the defender using various defense measuresCscdg,ah: cost of system compromisedSystem loss cost function with the defensive strategydgand the attack strategy ahas parameters, which indicates the loss to the defender’s system when it is compromised, namely, the benefit to the attacker of successfully compromising the systemCds: cost of deception signalCost of a signal using deception, namely, the cost that is incurred by the defender in sending a spoofing signal that does not match its type to deceive the attackerFor the defender type {θN, θH}, the defense strategy is assumed to be D1d1,d2 or D2d5d6, and for the attacker type {ηH, ηL}, the attack strategy is A1=a1,a2 or A2=a4,a6. Based on historical data and experience,Ca=CA1,CA2=590,320, Cd=CD1,CD2=360,285, and Cds=CD1,CD2=20,10.To calculate the utility of the forward-direction signaling game, we set(3)pDθN=0.6,pDθH=0.4,ONP+OHP=1,WNP+WHP=1.All the utilities that are specified in Figures6 and 7 were calculated via equations (1) and (2).Figure 6
Forward signaling game tree with the calculated utilities.Figure 7
Reverse signaling game tree with the calculated utilities.The posterior inferences can be constructed on various sets of information. Via Algorithm1, we obtain possible equilibria in the forward direction, as presented in Table 5.Table 5
Possible equilibria in the forward direction.
ConditionEquilibriumType of equilibriumONP>PA′θN∣mN,WNP>PA′θH∣mHEQ=mH,mH→A1,A1,ONP=0.7,WNP=0.5Pooling equilibriumONP>PA′θN∣mN,WNP<PA′θH∣mHEQ=mH,mH→A1,A2,ONP=0.7,WNP=0.5Pooling equilibriumONP<PA′θN∣mN,WNP>PA′θH∣mHEQ=mH,mN→A2,A1,ONP=1,WNP=0Separating equilibriumONP<PA′θN∣mN,WNP>PA′θH∣mHEQ=mN,mN→A2,A2,ONP=0.7,WNP=0.5Separating equilibriumTo calculate the utility of the reverse-direction signaling game, we setpAηH=0.4, pAηL=0.6, SHN+SLN=1, and DHN+DLN=1.The posterior inferences that can be constructed on the two sets of information arePD′ηH∣mA=0.46 and PD′ηL∣mP=0.65. Via Algorithm 1, we obtain the possible equilibria in the reverse direction, which are presented in Table 6.Table 6
Possible equilibria in the reverse direction.
ConditionEquilibriumType of equilibriumSHN>PD′ηN∣mA,DHN>PD′ηL∣mPEQ=mA,mA→D1,D1,SHN=0.4,DHN=0.7Pooling equilibriumSHN>PD′ηN∣mA,DHN<PD′ηL∣mPEQ=mp,mA→D1,D2,SHN=0.4,DHN=0.7Pooling equilibriumSHN<PD′ηN∣mA,DHN>PD′ηL∣mPEQ=mA,mP→D2,D1,SHN=0,DHN=1Separating equilibriumSHN<PD′ηN∣mA,DHN<PD′ηL∣mPEQ=mP,mP→D2,D2,SHN=0.4,DHN=0.7Pooling equilibriumThe algorithm proposed, and the game simulated in the paper is compared with other approaches in Table7. We have analyzed both directions of signal transmission in a dynamic incomplete information game, which is more in line with the actual attack-and-defense scenario, and the results can guide the defense decision much more precisely.Table 7
Comparison of approaches in terms of static or dynamic type, complete information or incomplete information, and signal direction.
AuthorType of gameNumber of playersSignal directionWang et al. [31]Complete information staticNSingleLin et al. [32]Incomplete information static3SingleZhang et al. [33]Incomplete information dynamic3SingleZhu et al. [34]Incomplete information dynamicNSingleOur workIncomplete information dynamicNTwo-way


### 4.3. Result Analysis

By implementing the simulation above, we obtain the following results:(1)
In the forward-signaling game model, ifPA′θN∣md,PA′θH∣md and SHN,DHN do not conflict, the refined Bayesian equilibrium is a pooling equilibrium. Hence, the defender chooses a honey system and releases the honey system signal, which deceives the attacker, thereby influencing the attacker’s judgement on the defender type and on the choice of attack strategy. Thus, the defender uses the signal to demonstrate a capability that exceeds the actual capability, thereby reducing the likelihood of suffering a loss(2)
In the reverse-signaling game model, the attacker moves first. He can be of typeηH and send signal mA (presenting himself as an advanced attacker) or mP(pretending to be the primary attacker). He can also be of type ηL and send the signal mP (presenting himself as the primary attacker) or mA (pretending to be an advanced attacker). According to Table 6, the refined Bayesian equilibrium is realized when the advanced attacker pretends to be the primary attacker and the defender chooses strategy D1with the deception technique. The advanced attacker deliberately presents weak attack capabilities so that the defender will reduce the level of defense. However, the choice of the deception defense strategy by the defender can be used to increase the defense utility(3)
From the perspective of utility for both the defender and the attacker in a two-way signaling game, regardless of whether the attacker’s ability is low or high, the choice of the deception defense strategy would increase the payoff of the defender compared with the normal system without deception. The defense strategy with deception is the optimal strategy for the defender. Therefore, the defender would choose the deceptive strategy, namely, the normal system would be disguised as a honeypot


## 4.1. Simulation Environment

To evaluate the proposed attack-and-defense signaling game model and the algorithm for optimal strategy selection, we construct the simulation environment illustrated in Figure5.Figure 5
Game scenario with deception, which considers two decision makers, namely, a defender and an attacker. The defender deploys a honeypot in the IoT network as either a system or a service host. In the specified scenario, the forward and reverse transmissions occur simultaneously. The sequences of moves, type sets, and action sets follow the modeling elements that were discussed in the previous section. The incomplete information comes from the attacker’s uncertainty regarding the type of the system.


## 4.2. Calculating the Utility

According to Richard [27], common vulnerability [28] and the database of attack-and-defense behaviors from MIT [29], attack strategies that are composed of basic options are listed in Table 2.Table 2
Attack strategy description.
No.Basic attack optionAttack strategyA1A2a1Remote buffer overflow√√a2homepage attack√a3LPC to LSASS process√√a4Apache chunk overflow√a5Steal account and crack it√a6Oracle TNS listener√Common defense strategies with deception that are composed of basic operations are described in Table3.Table 3
Defense strategy description.
No.Basic defense optionDefense strategyD1D2d1Honey file√√d2Honey account√√d3Using honeycomb√d4Uninstall delete Trojan√d5Limit access to MDSYS√d6Web app honeypot√For selecting the optimal strategy more scientifically and intuitively, the most basic approach is to quantify the utilities of the strategies that are selected by the defender and the attacker. In this paper, we utilize the scheme that was proposed by Zhang and Li [30] to calculate the expected utility functions of the defenders and the attackers as follows:
(1)UAmj,dg,ah,θ=∑g,hCscdg,ah−Ca,(2)UDmj,dg,ah,θi=∑g,hCscdg,ah−Cd−Cds.The notations that are used in equations (1) and (2) are described in Table 4.Table 4
Notation descriptions.
NotationDescriptionUAmj,dg,ah,θiExpected utility function of the attackerUDmj,dg,ah,θiExpected utility function of the defenderCa: cost of attackCost of the attacker using various attack measuresCd: cost of defenseCost of the defender using various defense measuresCscdg,ah: cost of system compromisedSystem loss cost function with the defensive strategydgand the attack strategy ahas parameters, which indicates the loss to the defender’s system when it is compromised, namely, the benefit to the attacker of successfully compromising the systemCds: cost of deception signalCost of a signal using deception, namely, the cost that is incurred by the defender in sending a spoofing signal that does not match its type to deceive the attackerFor the defender type {θN, θH}, the defense strategy is assumed to be D1d1,d2 or D2d5d6, and for the attacker type {ηH, ηL}, the attack strategy is A1=a1,a2 or A2=a4,a6. Based on historical data and experience,Ca=CA1,CA2=590,320, Cd=CD1,CD2=360,285, and Cds=CD1,CD2=20,10.To calculate the utility of the forward-direction signaling game, we set(3)pDθN=0.6,pDθH=0.4,ONP+OHP=1,WNP+WHP=1.All the utilities that are specified in Figures6 and 7 were calculated via equations (1) and (2).Figure 6
Forward signaling game tree with the calculated utilities.Figure 7
Reverse signaling game tree with the calculated utilities.The posterior inferences can be constructed on various sets of information. Via Algorithm1, we obtain possible equilibria in the forward direction, as presented in Table 5.Table 5
Possible equilibria in the forward direction.
ConditionEquilibriumType of equilibriumONP>PA′θN∣mN,WNP>PA′θH∣mHEQ=mH,mH→A1,A1,ONP=0.7,WNP=0.5Pooling equilibriumONP>PA′θN∣mN,WNP<PA′θH∣mHEQ=mH,mH→A1,A2,ONP=0.7,WNP=0.5Pooling equilibriumONP<PA′θN∣mN,WNP>PA′θH∣mHEQ=mH,mN→A2,A1,ONP=1,WNP=0Separating equilibriumONP<PA′θN∣mN,WNP>PA′θH∣mHEQ=mN,mN→A2,A2,ONP=0.7,WNP=0.5Separating equilibriumTo calculate the utility of the reverse-direction signaling game, we setpAηH=0.4, pAηL=0.6, SHN+SLN=1, and DHN+DLN=1.The posterior inferences that can be constructed on the two sets of information arePD′ηH∣mA=0.46 and PD′ηL∣mP=0.65. Via Algorithm 1, we obtain the possible equilibria in the reverse direction, which are presented in Table 6.Table 6
Possible equilibria in the reverse direction.
ConditionEquilibriumType of equilibriumSHN>PD′ηN∣mA,DHN>PD′ηL∣mPEQ=mA,mA→D1,D1,SHN=0.4,DHN=0.7Pooling equilibriumSHN>PD′ηN∣mA,DHN<PD′ηL∣mPEQ=mp,mA→D1,D2,SHN=0.4,DHN=0.7Pooling equilibriumSHN<PD′ηN∣mA,DHN>PD′ηL∣mPEQ=mA,mP→D2,D1,SHN=0,DHN=1Separating equilibriumSHN<PD′ηN∣mA,DHN<PD′ηL∣mPEQ=mP,mP→D2,D2,SHN=0.4,DHN=0.7Pooling equilibriumThe algorithm proposed, and the game simulated in the paper is compared with other approaches in Table7. We have analyzed both directions of signal transmission in a dynamic incomplete information game, which is more in line with the actual attack-and-defense scenario, and the results can guide the defense decision much more precisely.Table 7
Comparison of approaches in terms of static or dynamic type, complete information or incomplete information, and signal direction.
AuthorType of gameNumber of playersSignal directionWang et al. [31]Complete information staticNSingleLin et al. [32]Incomplete information static3SingleZhang et al. [33]Incomplete information dynamic3SingleZhu et al. [34]Incomplete information dynamicNSingleOur workIncomplete information dynamicNTwo-way


## 4.3. Result Analysis

By implementing the simulation above, we obtain the following results:(1)
In the forward-signaling game model, ifPA′θN∣md,PA′θH∣md and SHN,DHN do not conflict, the refined Bayesian equilibrium is a pooling equilibrium. Hence, the defender chooses a honey system and releases the honey system signal, which deceives the attacker, thereby influencing the attacker’s judgement on the defender type and on the choice of attack strategy. Thus, the defender uses the signal to demonstrate a capability that exceeds the actual capability, thereby reducing the likelihood of suffering a loss(2)
In the reverse-signaling game model, the attacker moves first. He can be of typeηH and send signal mA (presenting himself as an advanced attacker) or mP(pretending to be the primary attacker). He can also be of type ηL and send the signal mP (presenting himself as the primary attacker) or mA (pretending to be an advanced attacker). According to Table 6, the refined Bayesian equilibrium is realized when the advanced attacker pretends to be the primary attacker and the defender chooses strategy D1with the deception technique. The advanced attacker deliberately presents weak attack capabilities so that the defender will reduce the level of defense. However, the choice of the deception defense strategy by the defender can be used to increase the defense utility(3)
From the perspective of utility for both the defender and the attacker in a two-way signaling game, regardless of whether the attacker’s ability is low or high, the choice of the deception defense strategy would increase the payoff of the defender compared with the normal system without deception. The defense strategy with deception is the optimal strategy for the defender. Therefore, the defender would choose the deceptive strategy, namely, the normal system would be disguised as a honeypot


## 5. Conclusions

We model the confrontation between a defender and an attacker by utilizing signaling game theory. Additionally, we propose the concept of a two-way signaling game and propose an algorithm for identifying optimal defense strategies. Finally, we conduct an extensive simulation analysis to evaluate the performance of the proposed approaches by fortifying the attack-and-defense confrontation in a two-way signal releasing mechanism and calculating the utilities for both sides.This paper mainly proposes a proactive defense mechanism that utilizes signal selection and release methods and does not consider other defense mechanisms. There are several limitations in our methods, one is that the expected utility functions used in equations (1) and (2) could not be extended to multistage games, and another is that the example shown in the simulation part did not consider the synchronous affect between the attacker and the defender during the game, both of which will be studied in the future work. However, the proposed two-way signaling game model is of substantial importance for subsequent research in the IoT network security. For example, with the method proposed, the defender of the IoT network could infer the optimal strategy of the attacker and take action such as improving the protection level in advance to defense attacks. In the future, we will integrate the analysis via mathematical description, implement the attack-and-defense model for multiple stage games, and explore the security defense decision-making method in IoT networks.



---

*Source: 8850356-2020-10-12.xml*