As the title implies the article substantiates the applicability of mathematical approaches for modeling cyber security processes. The article gives a detailed analysis of applicability of Markov processes and Game theory approach. In addition, the authors give requirements that can be applied for developing models . The authors come to the conclusion that it is necessary to use several mathematical approaches to describe a more complete model of information system cyber security processes.
In most cases during designing of complex systems resort to a modeling of main
processes, occurring within the system and at the junction of environment and system.
Furthermore, models can be used for monitoring and security auditing on the stages of
exploitation and maintenance of information system [
Today, the relevance of the problem of cyber security does not raise any doubts. Unfortunately, this problem is far from being absolutely solved. The main limitation of the current cyber security state is that the security approach is largely heuristic, increasingly burdensome, and it is struggling to contend with expeditiously evolving threats and risks.
In this paper, modeling refers a mathematical modeling allowing to obtain a formal description of the information system and further to make a quantitative and qualitative evaluation of its performance. Based on the analysis of existing scientific publications it is possible to identify such theories to model the processes of cyber security: The probability theory; The stochastic processes theory (Markov processes, semi-Markov processes, branching processes); The Petri nets theory; The theory of automata; The graph theory; The theory of fuzzy sets; The game theory; The theory of catastrophes, etc.
The differences of most models are which parameters they are using as input and which as output after the settlement. Typically as input data is used the collected statistics on existing information systems or data experts.
Furthermore, modeling methods based on informal systems theory: structuring techniques, estimation methods and methods for finding optimal decisions become widespread. The combination of methods of these three groups allows expanding the possibility of applying formal theories to conduct a full-fledged simulation of protection systems.
The aim of this work is substantiation of the correctness of using Markov processes and Game theory for modeling cyber security processes. 2
This section briefly discusses the existing body of other research related to the survey topic of this paper.
Authors of [
Abraham and Nair [
Authors of [
Chung et al. [
Above-mentioned and other existing works do not justify the choice of models, do not show cyber security requirements to models or just give theoretical frameworks for constructing of models. 3 3.1
According to the analysis of existing research papers and taking into account practical considerations, requirements for the model of cyber security processes are distinguished abilities to calculate: A probability of threat; An implementation time of threat; A vulnerability detection time; The damage (and loses) after successful attack; The cyber security risks, etc.
All the above-listed requirements should depend on used protection means, techniques, tools, vulnerabilities in them and the level of experience and equipment of the intruder.
As probabilities can be used expert assessments, statistical data from open sources. 3.2
A successful attack on an information system with significant reservations can be interpreted as a rejection of the reliability theory. In the reliability theory for modeling of systems with refusals and restoration of the objects is typically used Markov processes.
Highlighting the stochastic parameters of the threat vulnerability, namely, an intensity of appearance (detection) λ and an intensity of elimination μ, it is possible to describe an appropriate mathematical model which is able to determine necessary probabilities of information system cyber security processes P0=f(λ, μ).
In general, an enlarged graph of Markov model of cyber security process in information system as a whole, which is established by N threats of attacks, is shown in Fig. 1. The intensity of transition to the absorb state Sn can be determined as the intensity of a real threat of attacks λtn and an availability rate of an intruder to the attack Kan, n=1,…, N.
Kan λtn S 0
S n Practical use of the enlarged model will simplify the modeling, reducing it to simple tasks. Markov model allows calculating the probability of a successful attack, identifying the most dangerous threats. 3.3
Game theory is a mathematical theory of conflict situations. The primary elements of the Game theory are: Game (a simplified mathematical model of conflict); Players (a multiplicity of stakeholders); Action (choice of options envisaged by the game rules); Rules (conditions which determine the options of the players' actions); Strategy (possible actions of each of the parties); Payoff (gain or loss of each player, which may be expressed in money or material values).
According to [
Game Theory Non-Cooperative games
Cooperative games Static games
Dynamic games
Incomplete and Imperfect Information Complete and Perfect Information
Incomplete and Imperfect
Information Bayesian Formulation
Non-Bayesian Formulation To describe the model based on Game theory approach it is necessary to have such input parameters and actions: An availability of threats classification; Carrying out risk analysis, which shows an expected amount of losses in the case of successful attack; Formal description of protection means (the probability coefficient, which shows how decreases the probability of a successful attack on the system and the cost of the technical facilities and measures for bringing information systems in line with the requirements).
In general, the two sides of the game can be defined as a set:
G={x,y,W(x,y)}, (1) where W – payoff of the game; x – strategy of player 1; y – strategy of player 2.
The most optimal and interesting strategy for consideration is the mixed strategy with a finite number of states. These strategies consist of the use of several pure strategies, alternating randomly. In this case, the gain will be equal to the payoff of the game.
Constructed the payoff matrix and it’s analyzing can assess in advance the consequences of each decision, obviously, reject failed options to ensure security solution and recommend the most effective options for the entire range of attacks, given xi strategies. If the payoff matrix is constructed in which the game results wij are losses due to the successful attack, the best in terms of available information on the nature of will be the strategy, in which the average loss will be minimal, that is, the minimum amount: (2) n wij p(xi ) min .
i1
Game models are used to solve the problem of the choice of solutions providing optimal parity between the cost of protection and reduced risk of system exploitation.
Models constructed on the basis of Game theory does not take into account strategies of attacker’s behavior depending on its readiness and equipment, also not taken into account the possibility of threats and therefore damage in various ways. 4
The analysis of approaches to modeling information system cyber security processes has shown that none of the models meet the full the basic established criteria.
Markov process uses abstract states of processes, making it difficult to use the models to real systems. Models constructed on the basis of Game theory does not take into account strategies of attacker’s behavior depending on its readiness and equipment, also not taken into account the possibility of threats and therefore dam-age in various ways.
For a more detailed modeling of cyber security processes, we propose to use an approach, which uses some mathematical models (in this paper Markov processes and Game theory approach) as shown in Fig. 3.
Input Data
Output Data Environment
Control Actions According to this, input parameters for this model are parameters for each model (as considered above): The classification of threats (also possible of vulnerabilities); The classification of protection tools/ techniques; The expected amount of losses (damage); The probabilities of the implementation of different types of attacks; The probabilities of the detection of different types of attacks; The probabilities of the countering of different types of attacks, etc.
Initially, it is the collected statistics on existing information systems or data of experts, and then input parameters on the t+1 step will depend on output parameters on t step. Output parameters are applicable criteria to models as discussed above (e.g., the probabilities of threats, the implementation time of threat, the vulnerability detection time, the damage (losses) after the successful attack, cyber security risks, etc.). In addition, developed model should depend on environment and control actions.
Related works contain only general guidelines for building the binding model, but do not give any practical applications. In this paper, an attempt was made to combine models by providing a functional linkage in the form of a feedback scheme. The general model is proposed only without detail definition of assembly Markov processes and Game theory models (like “black box” represented as the input data and the first steps of construction). The proposed model is based on the assumption of the possibility of the taking of each model and a feedback mechanism is provided for the possibility of control and management. 5
To the main results of the work can be attributed substantiation of the correctness of using Markov processes and Game theory for modeling cyber security processes. It is shown that a single model cannot solve all requirements to the cyber security system. Therefore, it is necessary to use several mathematical approaches to describe a more complete model of information system cyber security processes.
Our future work includes investigation of other mathematical approaches, development of models, statistics gathering and simulation of models.