Abstract. Game theory has been researched extensively in network security demonstrating an advantage of modeling the interactions between attackers and defenders. Game theoretic defense solutions have continuously evolved in most recent years. One of the pressing issues in composing a game theoretic defense system is the development of consistent quantifiable metrics to select the best game theoretic defense model. We survey existing game theoretic defense, information assurance, and risk assessment frameworks that provide metrics for information and network security and performance assessment. Coupling these frameworks, we propose a game theoretic approach to attack-defense and performance metric taxonomy (ADAPT). ADAPT uses three classifications of metrics: (i) Attacker, (ii) Defender (iii) Performance. We proffer ADAPT with an attempt to aid game theoretic performance metrics. We further propose a game decision system (GDS) that uses ADAPT to compare competing game models. We demonstrate our approach using a distributed denial of service (DDoS) attack scenario. Keywords: Game Theory, Taxonomy, Security Management Game theory has received increased attention from network security researchers, investigating defense solutions. The game theory approach has the advantage of modeling the interactions between attackers and defenders, where players have the ability to analyze other player's behavior. This may enable an administrator to develop better strategic defenses for the system. For instance, when there are many actions available to the attacker and defender, it becomes difficult to develop solution strategies. Hamilton, et al. [1] outlined the areas of game theory which are relevant to information warfare using course of actions with predicted outcomes and what-if scenarios. Jiang, et al. [2] proposed an attack-defense stochastic game model to predict the next actions of an attacker using the interactions between an attacker and defender. Therefore, it is vital to provide a network administrator the capability to compare multiple strategies using the appropriate metrics to optimize the network. In this work we consider various metrics for game theoretic models. Bellovin [3] inferred that designing proper metrics for security measurement is a tough problem that should not be underestimated. Current research is lacking in terms of providing information a system administrator can use in determining metrics to quantify performance of diverse game theoretic defense models. One of the problems faced by research pertaining to security games is how to evaluate different network security game models, in terms of performance, accuracy, and effectiveness. The Institute for Information and Infrastructure Protection (I3P) has identified security metrics as priority for current research and development [4] . We extend this notion to provide a comprehensive taxonomy to aid in assessing the overall performance and quality of a game theoretic model. Prior game theoretic research mainly focused on classifying metrics based on a distribution of games across various game types and models. Further, the game theoretic defense mechanisms in literature are arbitrary and ad hoc in nature. This makes game theoretic defense models very complex and designed towards application specific scenarios [5] . We propose an alternative real world approach by classifying our metrics based on a real world distributed denial of service (DDoS) scenario. In this paper, we attempt to address limitations in research through the proposed game theoretic attack-defense and performance metric taxonomy (ADAPT), which is a taxonomy of game related metrics. We define a game as the interactions between two players with conflicting goals. In our case these players are the attacker (hacker) and system administrator (defender). Game metrics are a set of tools which are used to measure the various kinds of impact a game model has on each of its players. We classify these game metrics based on their impact on attacker, defender, and the performance of the game model on the system which is being run. Prior research has shown, with the use of game theory, how the interaction should take place based on the strategy and the strategy selected from the game model. In this traditional scenario one game model is assessed relative to a particular attack. He, et al. [6] proposed a Game Theoretical Attack-Defense Model (GTADM), similar to ADAPT, that quantifies the probability of threats in constructing a risk assessment framework. We extend these general game theory steps and concepts proposed in He, et al. [6] with the use of ADAPT being able to assess competing game models and select the game model which is suitable for defense. This provides a defender with a preliminary view of multiple game models associated to a particular attack.
Using attack components, a set of metrics are defined and used by an attack defense performance taxonomy (ADAPT system REF ).
ADAPT: A Game Inspired Attack-Defense and Performance Metric Taxonomy
SEC
Computer Science