Interdiction Games for Advanced Persistent Threats using Dynamic Information Flow Tracking

Dynamic Information Flow Tracking (DIFT) has been proposed to detect and prevent various cyber attacks in computer systems. DIFT tracks information flows in the computer system and initiates security analysis, when anomalous behavior is detected, at the cost of additional memory and performance overhead. We consider an attacker that is trying to steal critical information in the system and a DIFT-based defense mechanism with limited resources. The objective of the DIFT is to optimally allocate the resources at the different processes of the computer system in order to maximize the probability of detecting the attacker while satisfying the resource constraint. We formulate the strategic interaction between the attacker and the DIFT as a nonzero-sum network interdiction game. We show that solution to the game can be obtained as a solution to a min-max problem on a flow network constructed from the problem instance. We recast the min-max problem as a Linear Program (LP) and prove that solution to the LP returns an optimal set of strategies for both players. We implement our algorithm on real-world data sets for two attacks: (i) ScreenGrab and (ii) Nation state, obtained using the Refinable Attack INvestigation (RAIN).