SaTC: CORE: Small: Towards Robust Moving Target Defense: A Game Theoretic and Learning Approach

恶意攻击不断发展，对国家的基础设施系统、企业信息技术（IT）系统和我们的数字生活造成更大的破坏。实现有效防御的一个根本障碍是信息不对称，在当前的静态和被动防御方案下，攻击者基本上有无限的时间来观察和了解防御者，而防御者对攻击者知之甚少。移动目标防御（MTD）是一种很有前途的方法来扭转信息不对称，防御者动态更新系统配置，以阻止攻击者的学习过程。虽然MTD已成功应用于各个领域，但现有解决方案通常假设攻击者具有防御者已知的固定能力和行为模式。该项目的总体目标是为强大的MTD机制的设计和分析奠定基础，这些机制可以在面对未知和自适应攻击时提供有保证的保护级别。拟议的研究通过结合网络安全，博弈论和机器学习技术的跨学科方法为新兴的安全科学领域做出了贡献。调查人员将向工业界传播研究结果，以帮助影响真实的系统。这项研究的内容将被纳入杜兰大学的网络安全新课程。开发健壮MTD面临三个主要挑战：（1）系统动力学与激励的耦合;（2）隐形攻击的隐蔽行为;（3）在大型系统中协调多个防御者的必要性。为了应对这些挑战，调查员将侧重于三个相互关联的重点领域。在第一个推力，一个动态的两个时标MTD游戏，捕捉各种攻击模式和反馈结构的设计和处理游戏的技术与大的状态空间进行了研究。在第二个推力中，研究了基于强化学习的MTD策略，用于挫败未知攻击。重点是开发近似最优的解决方案，具有低复杂性，可以有效地利用延迟和噪声反馈在游戏中。在第三个推力，MTD游戏和学习框架扩展到包括多个攻击者和防御者，信息共享和调解计划，使协调MTD的调查。开发的游戏模型和防御策略通过测试平台实现和跟踪驱动的模拟进行验证。该研究成果有望提供新的见解和新的机制，这将大大推进我们对战略思维和学习如何帮助实现更适应性的网络防御来抵御高级攻击的理解。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Malicious attacks are constantly evolving to inflict even more damage on the nation's infrastructure systems, corporate information technology (IT) systems, and our digital lives. A fundamental obstacle to achieving effective defense is information asymmetry, through which, under current static and passive defense schemes, the attacker has essentially limitless time to observe and learn about the defender, while the defender knows very little about the attacker. A promising approach to reverse information asymmetry is Moving Target Defense (MTD), whereby the defender dynamically updates system configurations to impede the attacker's learning process. Although MTD has been successfully applied in various domains, existing solutions typically assume an attacker with fixed capabilities and behavioral patterns that are known to the defender. The overarching goal of this project is to develop the foundations for the design and analysis of robust MTD mechanisms that can provide a guaranteed level of protection in the face of unknown and adaptive attacks. The proposed research contributes to the emerging field of the science of security via a cross-disciplinary approach that combines techniques from cybersecurity, game theory, and machine learning. The investigator will disseminate the research findings to industry to help impact real systems. Elements from this research are to be incorporated into new courses on cybersecurity at Tulane University. The project engages underrepresented students and K-12 students and provides rich research experience to undergraduate students.Developing robust MTD faces three major challenges induced by (1) the coupling of system dynamics and incentives; (2) the hidden behavior of stealthy attacks; (3) the necessity of coordinating multiple defenders in large systems. To tackle these challenges, the investigator will focus on three interrelated thrust areas. In the first thrust, a dynamic two-timescale MTD game that captures a variety of attack patterns and feedback structures is designed and techniques for handling games with large state spaces are investigated. In the second thrust, reinforcement learning-based MTD policies for thwarting unknown attacks are studied. The focus is on developing approximately optimal solutions with low complexity that can effectively exploit the delayed and noisy feedback during the game. In the third thrust, the MTD game and learning framework are extended to incorporate multiple attackers and defenders, and information sharing and mediation schemes for enabling coordinated MTD are investigated. The developed game models and defense strategies are validated via testbed implementations and trace-driven simulations. The research outcomes are expected to provide new insights and novel mechanisms that will significantly advance our understanding of how strategic thinking and learning can help achieve more adaptive cyber defense against advanced attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.