SaTC: CORE: Small: Towards Robust Moving Target Defense: A Game Theoretic and Learning Approach

恶意攻击正在不断演变，对国家的基础设施系统、企业信息技术(IT)系统和我们的数字生活造成更大的破坏。实现有效防御的一个根本障碍是信息不对称，通过信息不对称，在当前的静态和被动防御方案下，攻击者基本上有无限的时间观察和了解防御者，而防御者对攻击者知之甚少。一种有前景的扭转信息不对称的方法是移动目标防御(MTD)，根据该方法，防御者动态更新系统配置以阻止攻击者的学习过程。尽管MTD已成功应用于各个领域，但现有解决方案通常假定攻击者具有防御者已知的固定能力和行为模式。该项目的总体目标是为设计和分析强大的MTD机制奠定基础，该机制能够在面对未知和自适应攻击时提供有保证的保护水平。这项拟议的研究通过结合网络安全、博弈论和机器学习的技术的跨学科方法，为新兴的安全科学领域做出了贡献。研究人员将把研究结果传播给业界，以帮助影响真实的系统。这项研究的内容将被纳入杜兰大学关于网络安全的新课程。该项目吸引了未被充分代表的学生和K-12学生，并为本科生提供了丰富的研究经验。开发健壮的MTD面临三大挑战：(1)系统动力学和激励的耦合；(2)隐形攻击的隐藏行为；(3)在大系统中协调多个防御者的必要性。为了应对这些挑战，调查员将把重点放在三个相互关联的主要领域。在第一个推力中，设计了一个捕捉各种攻击模式和反馈结构的动态双时间尺度MTD博弈，并研究了处理大状态空间博弈的技术。在第二个推力中，研究了基于强化学习的抗未知攻击MTD策略。重点是开发低复杂度的近似最优解，以便有效地利用游戏过程中延迟和噪声的反馈。在第三个推力中，将MTD博弈和学习框架扩展为包含多个攻击者和防御者，并研究了实现协调MTD的信息共享和调解方案。所开发的游戏模型和防御策略通过试验台实现和轨迹驱动的模拟来验证。预计研究成果将提供新的见解和新的机制，大大促进我们对战略思维和学习如何帮助实现针对高级攻击的更具适应性的网络防御的理解。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Malicious attacks are constantly evolving to inflict even more damage on the nation's infrastructure systems, corporate information technology (IT) systems, and our digital lives. A fundamental obstacle to achieving effective defense is information asymmetry, through which, under current static and passive defense schemes, the attacker has essentially limitless time to observe and learn about the defender, while the defender knows very little about the attacker. A promising approach to reverse information asymmetry is Moving Target Defense (MTD), whereby the defender dynamically updates system configurations to impede the attacker's learning process. Although MTD has been successfully applied in various domains, existing solutions typically assume an attacker with fixed capabilities and behavioral patterns that are known to the defender. The overarching goal of this project is to develop the foundations for the design and analysis of robust MTD mechanisms that can provide a guaranteed level of protection in the face of unknown and adaptive attacks. The proposed research contributes to the emerging field of the science of security via a cross-disciplinary approach that combines techniques from cybersecurity, game theory, and machine learning. The investigator will disseminate the research findings to industry to help impact real systems. Elements from this research are to be incorporated into new courses on cybersecurity at Tulane University. The project engages underrepresented students and K-12 students and provides rich research experience to undergraduate students.Developing robust MTD faces three major challenges induced by (1) the coupling of system dynamics and incentives; (2) the hidden behavior of stealthy attacks; (3) the necessity of coordinating multiple defenders in large systems. To tackle these challenges, the investigator will focus on three interrelated thrust areas. In the first thrust, a dynamic two-timescale MTD game that captures a variety of attack patterns and feedback structures is designed and techniques for handling games with large state spaces are investigated. In the second thrust, reinforcement learning-based MTD policies for thwarting unknown attacks are studied. The focus is on developing approximately optimal solutions with low complexity that can effectively exploit the delayed and noisy feedback during the game. In the third thrust, the MTD game and learning framework are extended to incorporate multiple attackers and defenders, and information sharing and mediation schemes for enabling coordinated MTD are investigated. The developed game models and defense strategies are validated via testbed implementations and trace-driven simulations. The research outcomes are expected to provide new insights and novel mechanisms that will significantly advance our understanding of how strategic thinking and learning can help achieve more adaptive cyber defense against advanced attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.