Optimal and Game-Theoretic Deployment of Security Investments in Interdependent Assets

Transcription

1 Optimal and Game-Theoretic Deployment of Security Investments in Interdependent Assets Ashish R. Hota, Abraham A. Clements, Shreyas Sundaram and Saurabh Bagchi School of Electrical and Computer Engineering Purdue University

2 Challenge Modern critical infrastructures have a large number of assets, managed by multiple stakeholders. The security of these complex systems depends critically on the interdependencies between these assets. 2 Image credits: sgip.org, USC.

3 Contribution We propose a systematic framework for optimal and strategic allocation of defense resources in interdependent large-scale networks. 3 Image credits: sgip.org, USC.

4 Related Work Interdependent Security Games: each node is a decision-maker. [Laszka et. al., ACM CSUR 2014, Hota and Sundaram, GameSec 2015, ] Two player attacker-defender games Stackelberg Security Games [Jain et. al., AAMAS 2013, ] Colonel Blotto Games [Gupta et. al., GameSec 2014, ] Network Interdiction Games [Israeli and Wood, Networks 2002, ] Our framework captures externalities between the above two extremes. Multiple defenders, each responsible for a set of assets. The assets that belong to multiple defenders are interdependent. Closely related work: Multidefender Security Game [Lou et. al., 2016] 4

5 Interdependency Graph A directed graph where each node represents an asset in a networked system. Multiple defenders, denoted by the set D, each responsible for a subset of assets. When an asset u # is compromised, it can be used to attack asset u $ if (u #, u $ ) is an edge. p ) #,$ (0,1] : the probability of the above attack being successful. Independent across edges. Attacker A Defender 2 Defender 1 L # V 2 u # p #,$ u $ Defender 3 L # 0: loss experienced by the defender if asset u # is attacked successfully. 5

6 Attack Probability Defense strategies reduce the attack probabilities of the edges. Defender 1 A Attacker Defender 2 V 2 Joint strategy profile x = (x 5, x 2,, x 7 ), where each x 8 drawn from a convex and compact subset of R : ;. u = L = Defender 3 Let P = : set of paths from A to u = The attack probability on a node u = due to a given path P P = is? p #,$ A B,A C D (x) 6

7 Cost of a Defender Defender 1 A Attacker Defender 2 V 2 The cost of a defender D E is given by u = L = Defender 3 C E (x) H L = max? p #,$ D P K A B,A C D A K L M (x) Captures the notion of weakest link. 7

8 Defense Strategies x E #,N : defense allocation by defender D E on edge (u #, u $ ). Multiple defenders can potentially assign defense resources on a single edge. u # u $ E x #,N 8

9 Defense Strategies x E #,N : defense allocation by defender D E on edge (u #, u $ ). Multiple defenders can potentially assign defense resources on a single edge. More Generally: u # u $ E x #,N Let T 8 : R Q ; R U be a linear map that transforms defense strategy of defender D E, denoted by x 8, to the edges of the graph. T 8 x 8 #,$ : defense allocation by defender D E on edge (u #, u $ ). 9

10 Defense Strategies x E #,N : defense allocation by defender D E on edge (u #, u $ ). Multiple defenders can potentially assign defense resources on a single edge. More Generally: u # u $ E x #,N Let T 8 : R Q ; R U be a linear map that transforms defense strategy of defender D E, denoted by x 8, to the edges of the graph. Example: Edge-based defense strategy Defender D 5 can only defend the edge (A, D 5 ). D 2 only defends (A, D 2 ). x 5 and x 2 are scalars. T 5 = 1 0 D 5 A T 2 = 0 1 D 2 10

11 Transformation of Probabilities Define the length of an edge i, j as l ) ) #,$ log p #,$ [0, ) Under a joint defense strategy, the modified length is given by l #,$ x l ) E #,$ + H x #,N E E = l #,$ x b8 + x #,N Initial length Length under joint defense strategy x u # u $ ) l #,$ u # u $ l ) E #,$ + H x #,N 11 E

12 Transformation of Probabilities Define the length of an edge i, j as l ) ) #,$ log p #,$ [0, ) Under a joint defense strategy, the modified length is given by l #,$ x l ) E #,$ + H x #,N E Equivalently p #,$ x p ) E #,$ exp H x #,N E Satisfies the assumptions in the Gordon-Loeb model. 12

13 Observation The attack probability on a node u = due to a given path P P = is? p #,$ A B,A C D x = exp H l E #,$ + H x #,N A B,A C D E Path with the highest attack probability has the smallest length. 13

14 Equilibria in the Multidefender Game The cost of Defender D E can be stated as C E x 8, x b8 H L = max? p #,$ D P K A B,A C D A K L M x Affine in x 8 for given x b8 = H L = exp min H l #,$ x b8 + x D P #,N K A K L M A B,A C D E Convex in x 8 for given x b8 14

15 Equilibria in the Multidefender Game The cost of Defender D E can be stated as C E x 8, x b8 H L = max? p #,$ D P K A B,A C D A K L M x Affine in x 8 for given x b8 = H L = exp min H l #,$ x b8 + x D P #,N K A K L M A B,A C D E Convex in x 8 for given x b8 Theorem The multidefender game is an instance of concave game [Rosen, Econometrica, 1965] and a pure Nash equilibrium exists. 15

16 Computing Best Response Theorem The best response of Defender D E can be computed by solving the following convex optimization problem. min g R h i,j Rh k M s.t. H L = e bg K A K L M y $ y n x E #,N l #,$ x b8, edge (u #, u $ ) y q = 0 y = : feasible potential of node u =, at most the length of the shortest path from node u q y q : potential of attacker node 1 r x E B E u # u $ Budget constraint E y $ y n + H x #,N E 16

17 Computing Best Response Theorem The best response of Defender D E can be computed by solving the following convex optimization problem. min g R h i,j Rh k M s.t. H L = e bg K A K L M y $ y n x E #,N l #,$ x b8, edge (u #, u $ ) y = : feasible potential of node u =, at most the length of the shortest path from node u q y q = 0 1 r x E B E When the graph does not have a cycle of negative length, a feasible potential exists and the potential at every node is equal to the length of the shortest path from the source [Cook et al, 1998]. 17

18 Observation Given the defense strategies of other players, a player can compute her best response efficiently. A social planner can efficiently compute optimal defense allocations over the entire network. 18

19 Computing Nash Equilibrium Expected loss of a player in the original formulation is nondifferentiable. In the modified convex formulation, the constraints of a player depend on the strategies of other players. Leads to a Generalized Nash Equilibrium Problem. When each player values a single asset in the network, equilibrium strategies can be computed by solving a Linear Complementarity Problem [Sreekumaran, Hota and others, arxiv: , 2015]. In this work, we compute Nash equilibrium strategies by iteratively computing the best responses of the players. 19

20 Case Studies 20

21 Example 1: SCADA Network Two interdependent control subsystems. Shared corporate network. DMZ1 0.9 L=7 0.9 CORP L= DMZ2 L= Common vendor for remote terminal units (RTUs) RTU1 L=16 RTU1 L= RTU1 L= S RTU2 L= RTU2 L= RTU2 L= CONTROL1 L= VENDOR CONTROL2 L=5 21

22 Expected Loss at Equilibrium 3 RTUs 30 RTUs Total budget: 20 and 40, respectively. Edge-based defense. Individual defense: Each player can assign resources within its subsystem. Joint defense: a player can defend anywhere in the network. When the budgets are asymmetric, it is in the selfish interest for the player with a higher budget to defend certain assets of the other player. 22

23 Example 2: Distributed Energy Resource EMS Firewall WAN Utility Firewall Utility Router Utility Switch Instance of NESCOR failure scenario: Attacker tries to gain access to the DER so that it does not trip during low voltage. FDEMS Server PV HMI PV Equipment Router / Firewall Switch EV HMI EV Supply Equipment SCADA HMI DER SCADA Server DER Management System Server ( DERMS Server ) Example network borrowed from [Jauhar et. Al., PRDC 2015.] S w18 w17 w16 w15 w14 w13 w12 w11 w10 G 1 G Each node corresponds to an attack step. w9 w7 w8 w6 w5 w4 w3 w2 w1 G 0 PV HMI PV Equipment 23 Network access to PV HMI

24 Inefficiency of Equilibrium Investments We plot tnunvwv xyz{ }y~z xyz{ }y~z {z { {~ U:wn n nwv against the total budget. Inefficiency increases when a. total budget increases, and b. difference in the budgets of the players increases. Similar trends for both edge-based and node-based defenses. Ratio of Expected Losses % 33% 40% 45% Total Budget Percentage denotes the fraction of total budget that belongs to the PV defender. 24

25 Summary and Conclusion Proposed a general framework to compute optimal and gametheoretic defense allocation under network interdependencies. Demonstrated its applications in industrial control systems and the smart grid. Future work: Analytical investigations on the equilibrium computation problem Theoretical bounds on Price of Anarchy Validation of this approach in large-scale practical problems 25

26 Thank you!