Securing computer networks is a critical ongoing challenge for both private enterprise and government agencies and defense. Computer networks provide an access to valuable systems that can be damaged (e.g., by disabling a physical defense mechanism), and have valuable information that can be exploited (e.g., in a real-world con ict) or used for pro t (e.g., selling a list of stolen credit card information). Attackers exploit the complex, living environment of automated systems and human users performing routine tasks to nd gaps in security and conceal their actions. Interactions between defenders and attackers play out in this rich and ever-changing environment, and improving security poses a fundamental question for defense: How should the defender choose security policies that improve security against sophisticated, adaptive attackers, without violating cost and usability constraints? We highlight three characteristics that make this decision problem particularly challenging. (1) Computer security is adversarial, with multiple decision-makers making decisions that interact and jointly a ect the overall outcome. (2) The interaction is highly dynamic (sequential) in nature, with attackers and defenders able to make observations and react to one another over time. (3) There are many unknown and changing elements of the environment as well as the capabilities and motivations of the other agents. The mathematical framework best suited to reasoning about adversarial decision problems is non-cooperative game theory. Game theory provides a variety of models for describing interactions, as well as solution concepts for nding good (ideally optimal) strategies, and computational sub elds that provide algorithms for computing these solutions. Game theoretic strategies are widely used not only in network security [13, 9] but also in securing critical infrastructures [12] and protecting wildlife [3]. However, many basic game models do not handle the dynamic and unknown elements typical of cybersecurity decisions. We argue the addressing cybersecurity using game theory will require developing and integrating novel techniques from both dynamic game theory and machine learning.
Cybersecurity domains often involve sequential decisions. Each side performs some action, expects a reaction from the system or from the opponent, and reacts accordingly. For example, the attacker may adapt her strategy if one type of the attack fails, or she tries to hide her trace if there is a suspicion of a detection. The attack can thus be much more strategic and can last for a longer period of time, which is often in contrast with the types of games used for modeling physical security. One reason is that gathering information is easier and less risky in a cyber scenario than in an attack on a physical system (e.g., observing the network tra c costs much less than conducting on-site reconnaissance, the chance of being detected by the defender is smaller).
Solving dynamic games (known as extensive-form games that model interactions with nite
steps or stochastic games that model interactions with in nite (or inde nite) number of steps)
is a computationally challenging task. Despite the computational challenges, there exists a
collection of algorithms that can be used to solve dynamic games [
Game theory can provide optimal reasoning, but only if a model is fully speci ed and has only so-called \known unknowns." For example, the defender may not have full information about the current situation in the network, but has useful beliefs about the possible states the network could be in, and is able to maintain accurate probabilistic beliefs over these possibilities as new information is observed. However, it is often the case that a complete model is very challenging to specify in network security. There may also be \unknown unknowns" that violate fundamental assumptions, such as an attacker who uses a zero-day exploit that is not known to the defender. In these situations classical game-theoretic models can be cumbersome and of limited value, while methods that focus on adaptation and learning are well-suited to these problems.
When little is known about the environment for a decision problem, the focus is generally
on exploring the environment and learning from the experience to improve future decisions. A
wide variety of machine learning methods have been developed for learning from data, but the
sub eld of reinforcement learning is particularly relevant since it focuses on learning from direct
experience of an environment. A class of learning problems known as multi-armed bandits [
We argue that new research is needed to combine the strengths of game theory and machine
learning to address the novel challenges that arise in cybersecurity decision-making. The
underlying interactions can be e ectively modeled as a dynamic game where there is a competition
between the defender and the attacker, and most of the possible actions and results for these
actions are known. However, there are often signi cant parts of the model that are initially
unknown, or which must react to a changing environment that cannot be fully anticipated.
Therefore, the defender must be able to explore for possibilities that the current game-theoretic
model of the system does not account for and adapt the model accordingly. We have done
preliminary work on combining equilibrium methods with machine learning in the context of border
security [