Prospect Theoretic Study of Cloud Storage Defense against Advanced Persistent Threats
Prospect Theoretic Study of Cloud Storage Defense against Advanced Persistent Threats
复制标题
DOI：
10.1109/glocom.2016.7842178
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Dongjin Xu;Yanda Li;Liang Xiao;N. Mandayam;H. Poor
中科院分区：
文献类型：
--
作者：
Dongjin Xu;Yanda Li;Liang Xiao;N. Mandayam;H. Poor
云存储很容易受到高级持续威胁 (APT) 的攻击，这些威胁是隐秘的、持续的、资金充足且有针对性的。本文应用前景理论来研究主观云存储防御者和主观APT攻击者之间的交互。制定了两个主观APT博弈，其中防御者选择扫描存储设备的时间间隔，攻击者分别在APT攻击持续时间和对手行动不确定的情况下决定发起两次攻击之间的持续时间。推导了静态主观APT博弈的纳什均衡。我们还研究了动态 APT 博弈，并提出了一种基于 Q-learning 的云存储 APT 防御策略。仿真结果表明，APT防御受益于攻击者的主观观点，所提出的防御策略可以提高检测性能，具有较高的效用。
Cloud storage is vulnerable to Advanced Persistent Threats (APTs), which are stealthy, continuous, well funded and targeted. In this paper, prospect theory is applied to study the interactions between a subjective cloud storage defender and a subjective APT attacker. Two subjective APT games are formulated, in which the defender chooses its interval to scan the storage device and the attacker decides its duration between launching two attacks under uncertain APT attack durations and action of the opponent, respectively. The Nash equilibria of the static subjective APT games are derived. We also study the dynamic APT game and propose a Q-learning based APT defense strategy for cloud storage. Simulation results show that the APT defense benefits from the subjective view of the attacker and the proposed defense strategy can improve detection performance with a higher utility.