论文标题
使用分解的交互式POMDP识别网络攻击者的意图的主动欺骗
Active Deception using Factored Interactive POMDPs to Recognize Cyber Attacker's Intent
论文作者
论文摘要
本文提出了一种智能和自适应的代理，该代理人采用欺骗来认识到网络对手的意图。与以前的网络欺骗方法不同，主要是延迟或混淆攻击者，我们专注于与他们互动以了解他们的意图。我们将网络欺骗模拟为在两个代理背景下的顺序决策问题。我们介绍了有限嵌套的交互式POMDP（I-POMDPX），并使用此框架用多种攻击者类型对问题进行建模。我们的方法模型网络攻击对单个蜜罐主机的网络攻击从攻击者的初始输入到达到其对抗性目标。捍卫I-POMDPX的代理使用诱饵在多个阶段与攻击者互动，以越来越准确地预测攻击者的行为和意图。使用i-pomdps还使我们能够对对手的精神状态进行建模，并研究欺骗如何影响他们的信念。我们在模拟和真实宿主中的实验表明，基于I-POMDPX的代理在意图识别方面的表现要比蜜罐上常用的欺骗策略要好得多。
This paper presents an intelligent and adaptive agent that employs deception to recognize a cyber adversary's intent. Unlike previous approaches to cyber deception, which mainly focus on delaying or confusing the attackers, we focus on engaging with them to learn their intent. We model cyber deception as a sequential decision-making problem in a two-agent context. We introduce factored finitely nested interactive POMDPs (I-POMDPx) and use this framework to model the problem with multiple attacker types. Our approach models cyber attacks on a single honeypot host across multiple phases from the attacker's initial entry to reaching its adversarial objective. The defending I-POMDPx-based agent uses decoys to engage with the attacker at multiple phases to form increasingly accurate predictions of the attacker's behavior and intent. The use of I-POMDPs also enables us to model the adversary's mental state and investigate how deception affects their beliefs. Our experiments in both simulation and on a real host show that the I-POMDPx-based agent performs significantly better at intent recognition than commonly used deception strategies on honeypots.
