Defender Policy Evaluation and Resource Allocation Using MITRE ATT CK Evaluations Data

07/08/2021
by   Alexander V. Outkin, et al.
0

Protecting against multi-step attacks of uncertain duration and timing forces defenders into an indefinite, always ongoing, resource-intensive response. To effectively allocate resources, a defender must be able to analyze multi-step attacks under assumption of constantly allocating resources against an uncertain stream of potentially undetected attacks. To achieve this goal, we present a novel methodology that applies a game-theoretic approach to the attack, attacker, and defender data derived from MITRE's ATT CK Framework. Time to complete attack steps is drawn from a probability distribution determined by attacker and defender strategies and capabilities. This constraints attack success parameters and enables comparing different defender resource allocation strategies. By approximating attacker-defender games as Markov processes, we represent the attacker-defender interaction, estimate the attack success parameters, determine the effects of attacker and defender strategies, and maximize opportunities for defender strategy improvements against an uncertain stream of attacks. This novel representation and analysis of multi-step attacks enables defender policy optimization and resource allocation, which we illustrate using the data from MITRE's APT3 ATT CK Evaluations.

READ FULL TEXT

page 1

page 2

page 3

page 4

research
02/23/2019

Allocating Limited Resources to Protect a Massive Number of Targets using a Game Theoretic Model

Resource allocation is the process of optimizing the rare resources. In ...
research
03/22/2023

Optimal Resource Allocation between Two Nonfully Cooperative Wireless Networks under Malicious Attacks: A Gestalt Game Perspective

In this paper, the problem of seeking optimal distributed resource alloc...
research
07/04/2023

Symmetric Case of Locks, Bombs and Testing Model

We present a Defense/Attack resource allocation model, where Defender ha...
research
07/17/2023

TorMult: Introducing a Novel Tor Bandwidth Inflation Attack

The Tor network is the most prominent system for providing anonymous com...
research
12/18/2021

Dynamic Defender-Attacker Blotto Game

This work studies a dynamic, adversarial resource allocation problem in ...
research
04/05/2023

Dynamic Adversarial Resource Allocation: the dDAB Game

This work proposes a dynamic and adversarial resource allocation problem...
research
08/29/2020

Off-Path TCP Exploits of the Mixed IPID Assignment

In this paper, we uncover a new off-path TCP hijacking attack that can b...

Please sign up or login with your details

Forgot password? Click here to reset