Currently, much attention is paid to the issues of information security. Telecommunication systems, which have been actively developing recently, are the arteries of modern global information systems. The information circulating in such systems is of significant value and is therefore vulnerable to various violations and abuses. The development of network technologies is accompanied by increased requirements for information security and the choice of the optimal level of protection systems. Many researchers propose to use the game theory framework as a mathematical basis for designing, building, and analyzing information security systems. Game theory is a formal approach designed to analyze the interaction between several participants in a process that have different interests and make decisions. The use of game theory in modeling decision-making processes has various approaches that are currently not systematic and sometimes contradict each other. Therefore, there is a need to develop methods of rapid (adaptive) information security management, depending on the availability of a priori information about the possibility of attacks by an attacker and the strategy implemented by him to create unauthorized access to an information resource. Game theory allows us to offer recommendations for creating a strategy for managing the operation of security and intrusion prevention systems.
In this paper, we will consider two approaches to the application of game theory: the use of game theory methods to optimize the choice of information security and security management. In many situations, while doing the design of information security systems there can be a need for the development and implementation of decisions in conditions of uncertainty. Uncertainty may have a different nature. So, uncertain is the planned actions of the hackers which aim to decrease the efficiency of protection systems; uncertainty can refer to situations of risk in which the information network management system, which makes decisions on the implementation of the protection system, can establish not only all possible outcomes of decisions but the probability of possible conditions of their appearance. Design conditions affect the decision-making subconsciously, regardless of the actions of the subject that makes a decision. When aware of all the consequences of possible solutions, but without knowing their accuracy, it is clear that decisions are made in conditions of uncertainty. The basic perspective of the analysis theory of the decisionmaking processes at the design stage of information protection systems is game theory. The application of game theory in modeling the decision-making processes has different approaches, which currently are not systematic and sometimes collide between themselves. Therefore, the study of this subject is an actual scientific issue.
Despite significant advances in information security, there
are still difficulties in preventing intrusions into the
information system. An analysis of network attacks shows
that protection actions are most often taken after the service
performance has already been affected. This is due to the
difficulty of assessing the future scale of the attack and
applying the appropriate defense measure [
To increase the accuracy of attack prediction and
detection, an intrusion detection system must collect
heterogeneous information about the protected system, as
well as store and process a large amount of data. Using a
filtering system in the absence of an attack results in a
decrease in server performance and possible false filter
triggering. Quite often, the creation of an effective
protection system is faced with insufficient computing
power. Thus, the task of optimizing the resources spent on
maintaining the performance of the system of protection
against network attacks at a high level arises [
One of the solutions to this problem is to minimize the resources spent on maintaining information security at times when the activity of the attacker is insignificant. To this end, an intrusion detection system should use dynamic methods that allow for prompt detection and prevention of security breaches, i.e., the information security system should use a mathematical model that allows for the selection of the necessary set of security tools at any given time, providing reliable protection and at the same time requiring a minimum amount of resources.
In recent years, domestic and foreign works have shown
a tendency to expand the existing mathematical approaches
to the selection of information security system parameters.
For example, various authors propose the following
mathematical methods for analyzing and optimizing an
information security system [
Statistical intrusion detection methods apply a
wellproven mathematical statistics apparatus to the behavior of
the subjects of the analyzed system. First, statistical profiles
are formed for all subjects. The components of such a profile
may include various parameters, such as total traffic per
unit of time, the number of denials of service, the ratio of
incoming traffic to outgoing traffic, the number of unique
requests to the system, etc. Any deviation from the
reference profile is considered a security breach. The main
disadvantages of this approach are the following. First,
intrusion detection systems based on statistical methods are
not sensitive to the order of events in the protected system:
in some situations, the same events, depending on the order
of their occurrence, may be characteristic of abnormal or
normal activity. Secondly, in some cases, it can be difficult
to set thresholds for the monitored characteristics to
identify anomalous activity. Underestimating the threshold
leads to false positives, and overestimating it leads to missed
intrusions. In addition, the attacker often uses individual
approaches for each defense system, which makes the use
of statistical methods less effective [
Various intelligent methods can be used in intrusion detection systems to generate a set of observed parameters.
Many researchers propose to use the game theory framework as a mathematical basis for designing, building, and analyzing information security systems. Game theory is a formal approach designed to analyze the interaction between several participants in a process that have different interests and make decisions.
Any information security system involves two parties:
the attacking party and the defending party (information
security system), which have opposing interests. In [
In [
Paper [
When analyzing the issues of protection against various
security threats, it is advisable to consider the actions of two
parties: the defense (information system) and the offender.
The entirety of security threats can be considered as an
intruder: the actions of individuals with different goals,
large-scale planned attacks, and accidental impacts on the
system. Such models, where there are two or more opposing
parties, are typical of game theory [
Consider the interaction between an intrusion detection system and an attacker as a non-coalition endgame. Suppose that the defense party A and the attacker B have a finite number of strategies and , which corresponds to reality, since the defense party always has a limitation on the number of possible response options, and the attacker has a limitation on the number of options for organizing an attack. player winnings are defined on a variety of security system does not incur the cost of additional , system. where and
are many possible situations of players A
and B, respectively,
is the function of the information
methods described in [
For example, in [
× .
The solution to a non-coalition game is an equilibrium
situation, but not necessarily in pure strategies. It is known
that every finite antagonistic game has at least one
equilibrium situation in mixed strategies. When analyzing
information security systems, it makes sense to consider
mixed strategies under the assumption that the system’s
operation lasts for a considerable time, i.e., attack and
defense iterations are repeated many times [
In a non-coalition game, each player uses his or her pure strategies independently of the other, so in a mixed situation = ( , } probability ( ) of the emergence of a situation = ( , ) is equal to the product of the probabilities of both players using their pure strategies, i.e. ( ) = ( , ).
Let’s find the average win (loss) of players. In the case of the mathematical expectation of player A win in a mixed situation = ( , } is defined as follows:
WA ( p) wA (PA , PB ) wA (s) p(s)
sS wA (s1, s2 ) pA (sA )( pB (sB ))
s1SA s2SB security system’s gain (or, in fact, loss or cost) if the information security system has chosen a strategy s1, and the offender—the strategy .
The player’s (information security system violator’s) winnings are generally determined in the same way.
How can you determine the winnings of players in this
case? The intrusion detection system provides a lot of
parameters at any given time using sensors [
= { , , … , }, and the cost of additional resources spent on monitoring them over time − ( ). Let’s assume that the cost of observation is directly proportional to the time of observation. If the monitoring of an extended set of parameters is carried out during the time , then the cost of additional observation costs will be where n is the number of additional monitoring parameters, ci is the cost of monitoring the ith parameter. When making a decision to ignore a possible attack, the information monitoring.
Let’s estimate the costs of the information security system violator. If the decision is made to terminate the attack, the attacker does not incur additional costs, and if the decision is made to continue the attack, the attacker’s costs depend on the number of generated requests to the protected system one request.
= , where is the cost of generating
In case of a successful attack, the information security system suffers losses ∗, and the offender wins ∗ . The costs of the protection system when implementing each of the possible strategies consist of the costs of organizing protection
CA (t) c t
i m n i1 and losses from possible security breaches ∗. Similarly, the gain of the infringer consists of the gain from the breach of the information security system ∗ and because of the cost of conducting attacks .
For the analyzed intrusion detection system, it is assumed that with the increase of additional monitoring parameters, the probability of detecting an attack increases. However, determining the exact dependence of successful attack detection on the number and set of monitoring parameters, as well as on the monitoring time, requires an experimental study for each type of information security
As noted, every finite non-coalition game has at least one equilibrium situation in mixed strategies.
The equilibrium situation can be found by standard game theory
It should also be borne in mind that. The peculiarity of
the information conflict of the information security
operational management system and the peculiarity of the
offender trying to carry out unauthorized access (UA) is that
the opposing parties, who have several ways of acting, can
apply them repeatedly, choosing the best way [
At each step of conflict resolution is not a final state but
some payment function. Traditional game approach to the
analysis of the violator’s actions fails to take into account
multiple steps of conflict and does not reflect the
dependence of the modes of action of the parties from the
opposite direction, and the known conflict approach based
on the calculation of the final probability of system stay in
a state of winning to a given point in time does not reflect
the multiplicity of actions of the parties and unqualified
finality of the conflict at each step [
(adaptive) management of information security depending on the availability of a priori information about the possibility of attacks from the intruder and the strategy of creating the UA implemented by him.
To describe the current status of the conflict let’s use the indicator of the security of the system аij = Рsec while implementing in it the ith, iІ={1,2,...,n}, strategy (way) of protection and the application of the jth, jJ={1,2,..., m} strategy (way) of creating a safety contour, m and n are the number of security strategies and creation of security measure implemented in the SS (security system) and the system of the intruder (SoI) accordingly.
Let’s name the subsystem of operational management of
the information protection as Party A and the system to
counteract this protection as Party B, and the aij—the win of
Party A (the loss of Party B) in a situation (i, j). The
traditional gaming approach to the analysis of security
systems assumes that the parties are aware of the matrix of
the game and the finite set of strategies of the violator, but
it is unknown which strategy is implemented in a particular
situation. In this case, a matrix game can be formalized in
the situation of a choice of protection strategies under
conditions of uncertainty. However, this approach does not
reflect the dynamics of conflict and the possibility of a
purposeful selection of protection strategies at each step
depending on information about the system action of the
offender [
We assume that parties are aware of: the matrix game А (аij ) nm , the set of active strategies І, J, and the assessment of the values of ТPS (ТSoI) and tPS (tSoI); the matrix of game A is average new and has the solution value of the game v and the optimal vectors of mixed strategies of the parties
A - P* (P1*, P2*, ..., P³*, ..., Pn*)
and
B - Q* (Q1*, Q2*, ...,Q*j , ...,Qm*) during the time of the game T there is no aftereffect, and the sets І, J are unchanged.
The method was designed for adaptive changes of
parameters and operating modes of the SS according to the
game algorithm, depending on the availability of a priori
information about the system settings of the offender and
strategies for the creation of its attacks on information
system (IS) [
The essence of the game control algorithm is to compare a large number of possible in these conditions qualitatively different solutions, determining the optimal or best with all the limitations solution and the formation of the corresponding team.
To improve the efficiency in solving the dynamic games the forecasting method is used.
One of the possible solutions for games in mixed strategies is, as noted above, the increase in the reaction rate (rate of adaptation) of one of the parties, which improves the efficiency of the strategies.
A common method of solving a matrix game in mixed
strategies, i.e., methods of linear programming becomes
much more complicated for matrixes of large dimension.
The usage of decomposition methods is not always possible,
and iterative solution methods, such as the method of
Brown-Robinson, often have a high enough rate of
convergence. As an alternative, one can use the method of
dynamic programming using the results of short-term and
long-term forecasting [
Let’s take a look at the algorithm for solving matrix games using dynamic programming. In respect of cases examined long-term forecasting allows with a fairly high degree of reliability to limit the number of possible strategies for the system of the offender and reduce the game matrix. The solution of matrix games in keeping with the principle of forecasting based on the Markov approach is to optimize the conditional strategy of SS for N cycles forward through the predictable strategy of the intruder’s system. It is obvious that with increasing N, the accuracy of the prediction decreases. In this regard, consider the case when N = 1. It is possible to allocate three stages of the algorithm for forming the optimal strategy of the SS.
The system diagram of the game management of the security system is shown in Fig. 1. The method of security system management based on the methods of game theory, a block diagram of the algorithm implementation consist of the following stages (Fig. 2).
The initial data input. You enter the parameters of security measures and channel decision-making = {i}, and the value of the permissible probability of incorrect decision Per per.
Obtaining information about the actions of the offender’s system. Using one of the methods of monitoring the status of the security system we can determine the strategy or recognize the fact of the system exposure by the intruder.
Determining the version number of the current strategy of the SS. Based on the parameters obtained in the design phase of SS, the initial strategy of the SS according to the characteristics of the remedies is determined.
Determination of the optimal strategy of SS. The problem of optimization of functioning algorithms of the SS is to determine an optimal strategy à* À*, which provides the maximum efficiency of functioning of SS within the required time functioning. To improve the efficiency in solving dynamic games the forecasting method is used. One of the possible solutions for games in mixed strategies is, as noted above, the increase in the reaction rate (rate of adaptation) of one of the parties, which improves the efficiency of the strategies.
The adoption rate of the SS depends on the ratio TSS / TSoI and the value TSS , TSoI —from the durations of time regulation and change operating modes of protection, which depend on their position at the previous cycle. The duration of the transition of SS from the state of Нn to the state of Нm on regulation stages (Нn and Нm are the vectors of state remedies) is known in advance by a square transit time matrix of any possible (taken from the definition field) state toanother possible one:
R(reg)nm N M , n 1, N , m 1, M .
The elements of a matrix will be TSrSegnm included in the TSНS at the stage of regulation parameters, changing modes of operation of the system. Then the process of transition from Нn to Нm, taking into account possible intermediate states can be described by a unit of homogeneous Markov chains with discrete states in discrete time. The transition from Нn(t) to Н m ( t + 1 ) is an appropriate strategy ai SSS. The same offender’s system status in the transition is defined as НPSn (t) and Н PSm (t 1) .
Therefore, the task of conditional optimization of time of adaptation on the phase of adjustment consists of choosing such a strategy a* at cycle (t+1), in which: TSS ((t 1), а*) minTSS (Нn (t), аiSSS Нm (t 1), аi ); TSS ((t 2), а*) maxTSS (НSSn (t 1), аiSSS НSSm (t 2), аi ) considering that TSS TPS this happens in the process of the game solving through the introduction of ka in the calculation of the matrix elements.
The numerical accuracy of the intended value of a win function is set to some ratio of the prediction error kpr (t 1t) Фˆ(t 1) ФRL (t 1) , where Ф RL (t 1) is calculated when reaching (t+1) as a result of monitoring. So, in the case of an unchanged SoI strategy with Ф(t) for several cycles, the correction is Ф(t+1) due to k pr (t 1 t ) that is a part of the coefficient βm(t+1). This eliminates a systematic error in the calculation of the values of Ф(t) and somehow influences the choice of a*(t+1) while solving matrix games.
Since the coefficient prediction error is inverse to the factor of awareness k iаnf , the function is f (kiаnf ) kpr(t 1t) 1 . In this case, we have the following problem of conditional optimization: kiànf max, where à S max kinf kinf with the limitation: k pr (t 1 t ) 1 er , 8
N = N + 1 3 4 5 6 9
data ( = {i}) 2 Testing of the security system Assessment of protective equipment
Determining the number of the initial strategy а(t) Changing the strategy of SS?
No Correction kпр(t 1t)
conditional strategy a*(t + N/t) Prediction b*(t + N/t)
strategy a*(t + N) 12 Рer Рer per
Yes 13 Management decision making END
Yes where er is some centered random variable with zero mathematical expectation and variance δ2, which defines some limit value of the error.
Consider the algorithm for solving matrix games using dynamic programming. In respect of cases examined longterm forecasting allows with a fairly high degree of reliability to limit the number of possible strategies for the system of the offender in the next management cycles up to 2...4 and to reduce the game matrix. The solution of the matrix game in keeping with the principle of forecasting based on the Markov approach is to optimize the conditional strategy of the SS for N cycles forward through the predictable strategy of the system of the intruder. It is obvious that with increasing N, the accuracy of the prediction decreases. In this regard, consider the case when N = 1. It is possible to allocate three stages of the algorithm for forming the SS optimal strategy. In the first phase based on information about the current state of protection, the assumed value of the transition probabilities of SS, which applies to the management cycle t of the strategy system of the intruder b(t), and taking into account previous SS policies an optimal conditional strategy à * (t 1 )t is provided: а * (t 1 )t arg аSSS
max P (а (t ), b(t ), Н (t )) .
The second stage solves the problem of prediction strategy that is used at the management cycle t+1 of the SoI and which will ensure the minimization of the functional b * (t 1)t arg min P(а * (t 1), b(t 1)).
bSREP
In the third stage, the optimal strategy of SS management taking into account the projected system strategy of the offender and the current status of protection measures: max P (а (t 1), аSSS b * (t 1 t ), а * (t 1 t ) arg Н (t 1), .
m (t 1), k а ( Н (t 1) Н (t )))
To improve the reliability of the result the algorithm may be repeated a limited number of times if there is a certain dispersion of the probability distribution of the use of strategies and their à1* ( t 1 t ) ... à n* ( t 1 t ) subsequent evaluation based on the criteria of the benefits that are introduced. In case of impossibility of definition of such a strategy а * (t 1) , in which the losses do not exceed the allowable values, the problem of expanding the set of the admissible SS strategies is solved, then again, а*(t+1) is defined. Similarly, the SS strategy through conditional optimization of the management strategy of the SS for N steps predicted strategy of SoI is formed. The third stage of the algorithm in this case will look like this:
Simultaneously, the prediction algorithm is implemented. Table 1 shows a simplified example of the predicted transition of the system from the state at cycle t to the state (t+1) based on inhomogeneous Markov chains. According to the principle of optimality, when finding the optimal solution in a multistage problem optimizing the choice of management strategy a(t) at each step regardless of the initial state should be aimed at optimizing not only this but also all subsequent steps. Considering the prediction for (t+N) steps forward (in this case, no more than three steps) the mechanism of choosing the optimal strategy a*(t) at cycle t will also be defined by calculating the inverse function of Bellman of the last predicted Nt+1 management cycles. So, for t = N:
BN (Н(N 1)) а(N)mIN(aНx(N1)) PN (Н(N 1),а(N)), where Н(N1) is SS condition at (N1)-th management cycle; a(N) is management strategy at a cycle of N; N ( Í ( N 1)) is a finite set of admissible strategies at cycle (N 1).
The method of Bellman is used to improve forecast accuracy, the validity of the choice of current strategies, and decision-making support by the management device of the security system.
The process of prediction min (1 P3 j (t 1)) bj 3-rd stage Probability of transition Pi 4 k N i 4 max Pi2 (t 1) a1 b1 b2 b3 b4 … аj
P14 P24 P34 P44 … Pi4 а1 а2 а3 а4 … аi4
t+1 а12
Thus, it is worth noting some peculiarities of using this methodology, which is based on game theory about information security systems.
First of all, the winnings of the players in the mixed situation were determined to be equal to the mathematical expectation of their winnings. This assumes that the players are risk-neutral when the game situation is repeated many times. However, this is not entirely justified when considering defense systems. If an attacker can be considered a risk-neutral player, then the side of the defense is likely irrelevant. Even a one-time breach of the security of a protected system can be critical for it, putting it out of commission for a long time.
Second, the model can use certain data as input parameters. In this case, the possibilities of obtaining different data may be tasks of varying degrees of complexity. For example, if the model uses characteristics of threats, defenses, vulnerabilities, barriers, etc. as input parameters, it is quite difficult to evaluate all these characteristics and determine the relationships between them, which will complicate the practical application of the model in an intrusion detection system.
Furthermore, it is known that a large number of evaluation parameters play a very important role in detecting network intrusions. Therefore, in anomaly detection, one of the main tasks is to select the optimal set of evaluation parameters, which cannot be done using game theory methods. Therefore, it is advisable to use various mathematical methods when building security systems, in particular, intrusion detection systems.
In general, the mathematical apparatus of game theory allows for the analysis of tasks with an antagonistic, repetitive nature, which is typical for information security tasks. The proposed methods make it possible to choose at the initial stage the strategy of actions in the process of operation of the intrusion detection system and reduce the computational costs of data processing in the information security system.
Thus, in the process of constrained optimization with the current game matrix, the conventionally optimal strategy will be formed, defining the phase trajectory of the SS, starting from the final cycle of forecasting t = N to the current value of t.
The main problems with the use of game theory arise in the definition of the function of gain for a particular situation. For tasks that are solved by the security system, the feature of win, first and foremost, needs to reflect the change in the security system.
If this situation is not satisfied with the SS, we should implement measures to increase winnings with certain combinations of modes.
If the attacker deviates from its optimal strategy, the SS has the opportunity to increase its winnings by deviating from the optimal strategy as well.
The results of simulation modeling of the SS functioning process on the proposed game algorithm showed that the additional use of forecasting strategies at N cycles ahead allows to improve the efficiency by 5–8%.
Thus, the theory of games allows us to offer recommendations for creating the management strategy for the operation of the protection systems. And, at least for certain types of conflicts and matrixes of winnings, these recommendations allow SS to win and improve their technical characteristics.
Analysis of winning, which gets SS in different situations showed that game theory not only allows us to generate an optimal strategy that can guarantee a certain win but also allows you to issue recommendations for its switching to increase the winnings if the system of the violator deviates from his optimal strategy. When the system of the offender follows his optimal strategy, game theory allows to evaluation of the situation. If evaluation results are not satisfied, it is necessary to implement measures to change the situation.