A Game Theoretic Approach to Strategy Generation for Moving Target Defense in Web Applications

A Game Theoretic Approach to Strategy Generation for Moving Target Defense in Web Applications. Sengupta, S., Vadlamudi, S. G., Kambhampati, S., Doupé, A., Zhao, Z., Taguinod, M., & Ahn, G. In Proceedings of the 16th Conference on Autonomous Agents and MultiAgent Systems, of AAMAS '17, pages 178–186, Richland, SC, 2017. International Foundation for Autonomous Agents and Multiagent Systems.

Paper abstract bibtex

The present complexity in designing web applications makes software security a difficult goal to achieve. An attacker can explore a deployed service on the web and attack at his/her own leisure. Moving Target Defense (MTD) in web applications is an effective mechanism to nullify this advantage of their reconnaissance but the framework demands a good switching strategy when switching between multiple configurations for its web-stack. To address this issue, we propose the modeling of a real world MTD web application as a repeated Bayesian game. We formulate an optimization problem that generates an effective switching strategy while considering the cost of switching between different web-stack configurations. To use this model for a developed MTD system, we develop an automated system for generating attack sets of Common Vulnerabilities and Exposures (CVEs) for input attacker types with predefined capabilities. Our framework obtains realistic reward values for the players (defenders and attackers) in this game by using security domain expertise on CVEs obtained from the National Vulnerability Database (NVD). We also address the issue of prioritizing vulnerabilities that when fixed, improves the security of the MTD system. Lastly, we demonstrate the robustness of our proposed model by evaluating its performance when there is uncertainty about input attacker information.

@inproceedings{sengupta_game_2017,
	address = {Richland, SC},
	series = {{AAMAS} '17},
	title = {A {Game} {Theoretic} {Approach} to {Strategy} {Generation} for {Moving} {Target} {Defense} in {Web} {Applications}},
	url = {http://dl.acm.org/citation.cfm?id=3091125.3091155},
	abstract = {The present complexity in designing web applications makes software security a difficult goal to achieve. An attacker can explore a deployed service on the web and attack at his/her own leisure. Moving Target Defense (MTD) in web applications is an effective mechanism to nullify this advantage of their reconnaissance but the framework demands a good switching strategy when switching between multiple configurations for its web-stack. To address this issue, we propose the modeling of a real world MTD web application as a repeated Bayesian game. We formulate an optimization problem that generates an effective switching strategy while considering the cost of switching between different web-stack configurations. To use this model for a developed MTD system, we develop an automated system for generating attack sets of Common Vulnerabilities and Exposures (CVEs) for input attacker types with predefined capabilities. Our framework obtains realistic reward values for the players (defenders and attackers) in this game by using security domain expertise on CVEs obtained from the National Vulnerability Database (NVD). We also address the issue of prioritizing vulnerabilities that when fixed, improves the security of the MTD system. Lastly, we demonstrate the robustness of our proposed model by evaluating its performance when there is uncertainty about input attacker information.},
	urldate = {2019-01-21},
	booktitle = {Proceedings of the 16th {Conference} on {Autonomous} {Agents} and {MultiAgent} {Systems}},
	publisher = {International Foundation for Autonomous Agents and Multiagent Systems},
	author = {Sengupta, Sailik and Vadlamudi, Satya Gautam and Kambhampati, Subbarao and Doupé, Adam and Zhao, Ziming and Taguinod, Marthony and Ahn, Gail-Joon},
	year = {2017},
	keywords = {bayesian games, moving target defense, security games, stackelberg equilibrium},
	pages = {178--186},
}

Downloads: 0

{"_id":"hFuoBn3eCPRNDJoPu","bibbaseid":"sengupta-vadlamudi-kambhampati-doup-zhao-taguinod-ahn-agametheoreticapproachtostrategygenerationformovingtargetdefenseinwebapplications-2017","author_short":["Sengupta, S.","Vadlamudi, S. G.","Kambhampati, S.","Doupé, A.","Zhao, Z.","Taguinod, M.","Ahn, G."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","address":"Richland, SC","series":"AAMAS '17","title":"A Game Theoretic Approach to Strategy Generation for Moving Target Defense in Web Applications","url":"http://dl.acm.org/citation.cfm?id=3091125.3091155","abstract":"The present complexity in designing web applications makes software security a difficult goal to achieve. An attacker can explore a deployed service on the web and attack at his/her own leisure. Moving Target Defense (MTD) in web applications is an effective mechanism to nullify this advantage of their reconnaissance but the framework demands a good switching strategy when switching between multiple configurations for its web-stack. To address this issue, we propose the modeling of a real world MTD web application as a repeated Bayesian game. We formulate an optimization problem that generates an effective switching strategy while considering the cost of switching between different web-stack configurations. To use this model for a developed MTD system, we develop an automated system for generating attack sets of Common Vulnerabilities and Exposures (CVEs) for input attacker types with predefined capabilities. Our framework obtains realistic reward values for the players (defenders and attackers) in this game by using security domain expertise on CVEs obtained from the National Vulnerability Database (NVD). We also address the issue of prioritizing vulnerabilities that when fixed, improves the security of the MTD system. Lastly, we demonstrate the robustness of our proposed model by evaluating its performance when there is uncertainty about input attacker information.","urldate":"2019-01-21","booktitle":"Proceedings of the 16th Conference on Autonomous Agents and MultiAgent Systems","publisher":"International Foundation for Autonomous Agents and Multiagent Systems","author":[{"propositions":[],"lastnames":["Sengupta"],"firstnames":["Sailik"],"suffixes":[]},{"propositions":[],"lastnames":["Vadlamudi"],"firstnames":["Satya","Gautam"],"suffixes":[]},{"propositions":[],"lastnames":["Kambhampati"],"firstnames":["Subbarao"],"suffixes":[]},{"propositions":[],"lastnames":["Doupé"],"firstnames":["Adam"],"suffixes":[]},{"propositions":[],"lastnames":["Zhao"],"firstnames":["Ziming"],"suffixes":[]},{"propositions":[],"lastnames":["Taguinod"],"firstnames":["Marthony"],"suffixes":[]},{"propositions":[],"lastnames":["Ahn"],"firstnames":["Gail-Joon"],"suffixes":[]}],"year":"2017","keywords":"bayesian games, moving target defense, security games, stackelberg equilibrium","pages":"178–186","bibtex":"@inproceedings{sengupta_game_2017,\n\taddress = {Richland, SC},\n\tseries = {{AAMAS} '17},\n\ttitle = {A {Game} {Theoretic} {Approach} to {Strategy} {Generation} for {Moving} {Target} {Defense} in {Web} {Applications}},\n\turl = {http://dl.acm.org/citation.cfm?id=3091125.3091155},\n\tabstract = {The present complexity in designing web applications makes software security a difficult goal to achieve. An attacker can explore a deployed service on the web and attack at his/her own leisure. Moving Target Defense (MTD) in web applications is an effective mechanism to nullify this advantage of their reconnaissance but the framework demands a good switching strategy when switching between multiple configurations for its web-stack. To address this issue, we propose the modeling of a real world MTD web application as a repeated Bayesian game. We formulate an optimization problem that generates an effective switching strategy while considering the cost of switching between different web-stack configurations. To use this model for a developed MTD system, we develop an automated system for generating attack sets of Common Vulnerabilities and Exposures (CVEs) for input attacker types with predefined capabilities. Our framework obtains realistic reward values for the players (defenders and attackers) in this game by using security domain expertise on CVEs obtained from the National Vulnerability Database (NVD). We also address the issue of prioritizing vulnerabilities that when fixed, improves the security of the MTD system. Lastly, we demonstrate the robustness of our proposed model by evaluating its performance when there is uncertainty about input attacker information.},\n\turldate = {2019-01-21},\n\tbooktitle = {Proceedings of the 16th {Conference} on {Autonomous} {Agents} and {MultiAgent} {Systems}},\n\tpublisher = {International Foundation for Autonomous Agents and Multiagent Systems},\n\tauthor = {Sengupta, Sailik and Vadlamudi, Satya Gautam and Kambhampati, Subbarao and Doupé, Adam and Zhao, Ziming and Taguinod, Marthony and Ahn, Gail-Joon},\n\tyear = {2017},\n\tkeywords = {bayesian games, moving target defense, security games, stackelberg equilibrium},\n\tpages = {178--186},\n}\n\n","author_short":["Sengupta, S.","Vadlamudi, S. G.","Kambhampati, S.","Doupé, A.","Zhao, Z.","Taguinod, M.","Ahn, G."],"key":"sengupta_game_2017","id":"sengupta_game_2017","bibbaseid":"sengupta-vadlamudi-kambhampati-doup-zhao-taguinod-ahn-agametheoreticapproachtostrategygenerationformovingtargetdefenseinwebapplications-2017","role":"author","urls":{"Paper":"http://dl.acm.org/citation.cfm?id=3091125.3091155"},"keyword":["bayesian games","moving target defense","security games","stackelberg equilibrium"],"metadata":{"authorlinks":{}},"downloads":0,"html":""},"bibtype":"inproceedings","biburl":"https://bibbase.org/zotero/bxt101","dataSources":["Wsv2bQ4jPuc7qme8R"],"keywords":["bayesian games","moving target defense","security games","stackelberg equilibrium"],"search_terms":["game","theoretic","approach","strategy","generation","moving","target","defense","web","applications","sengupta","vadlamudi","kambhampati","doupé","zhao","taguinod","ahn"],"title":"A Game Theoretic Approach to Strategy Generation for Moving Target Defense in Web Applications","year":2017}