Search

This paper presents a scalable solution for zero-sum, one-sided, partially observable stochastic games (Z-POSGs) in the realm of cybersecurity. Existing heuristic search value iteration (HSVI) methods often face significant challenges with scalability in large and complex networks. To overcome this limitation, we introduce an innovative approach that leverages core attack graphs summarized abstractions that streamline incremental strategy generation. This technique reduces the belief and action spaces, making it possible to manage large-scale networks more efficiently. By focusing the analysis on the core attack graph, our approach minimizes the necessity to process the entire network, leading to substantial reductions in time and memory requirements while maintaining solution accuracy. Our method achieves an average solution accuracy within an epsilon value of 0.68%. Additionally, experimental results show that the execution time on the core attack graph is reduced by around 45% compared to that on the original graph, showcasing its significant performance advantage. Furthermore, we successfully solved the largest instances, comprising up to 300 nodes, underscoring the scalability and efficiency of our approach in handling complex, large-scale networks. Comparative evaluations demonstrate that integrating core attack graphs with existing HSVI techniques not only enhances scalability but also preserves solution quality. These findings highlight the proposed method’s potential for effective and efficient application in large-scale cybersecurity networks, outperforming state-of-the-art solutions.

Network resilience is the capacity of a network to maintain and restore its fundamental operations during or after a failure. This paper investigates the resilience of communication networks with heterogeneous nodes, with host nodes that generate and receive packets and routers that only forward packets. We focus on how traffic generation patterns, defined as the distribution of data packet creation across hosts, affect network resilience. While previous studies identified optimal host placements that balance traffic loads and enhance network performance, this research explores how traffic generation patterns influence network resilience, particularly during cascading failures, where the failure of one node triggers subsequent failures across the network. To address this issue, we model our networks as unweighted, undirected graphs consisting of non-mobile nodes and use the host survival rate—the percentage of functional hosts after a failure—as the network’s critical function. Assuming the network includes a host-based restoration process as an inherent recovery mechanism that initiates after an incident, we compare the resilience of different network topologies (scale-free, regular lattice, and Erdőos-Rényi), by conducting computational experiments to assess the effect of various traffic generation patterns by placing hosts on high-degree, low-degree, or randomly selected nodes. This is done by developing a discrete mathematical framework for measuring cyber resilience as an integral of the critical function in discrete time steps. Our findings indicate that when the hosts have multiple connections to other nodes, it significantly enhances network resilience. Notably, scale-free networks demonstrate more than twice the resilience compared to other topologies, showing a host survival rate improvement from 0.2093 to 0.4498 when hosts are positioned on high-degree nodes as opposed to being placed randomly.

Identifying optimal features is critical for increasing the overall performance of data classification. This paper introduces a supervised feature selection technique for analyzing mixed attribute data. It measures data classification performances of features with a user-defined performance criterion and determines optimal features to boost the overall data analysis performance. A performance evaluation is managed to highlight the usefulness of the technique with existing feature selection techniques such as analysis of variance test, chi-square test, principal component analysis, and mutual information. Visualization is also utilized to understand the differences in classifying instances with different features. From a comparative performance testing and evaluation, we found 5 ∼ 10% performance improvements with the proposed technique. Overall, evaluation results showed the usefulness of our proposed feature selection technique in mixed attribute data analysis.

Advanced persistent threats (APTs) have emerged as multi-stage attacks that have targeted nation-states and their associated entities, including private and corporate sectors. Cyber deception has emerged as a defense approach to secure our cyber infrastructure from APTs. Practical deployment of cyber deception relies on defenders’ ability to place decoy nodes along the APT path optimally. This paper presents a cyber deception approach focused on predicting the most likely sequence of attack paths and deploying decoy nodes along the predicted path. Our proposed approach combines reactive (graph analysis) and proactive (cyber deception technology) defense to thwart the adversaries’ lateral movement. The proposed approach is realized through two phases. The first phase predicts the most likely attack path based on Intrusion Detection System (IDS) alerts and network trace, and the second phase is determining optimal deployment of decoy nodes along the predicted path. We employ transition probabilities in a Hidden Markov Model to predict the path. In the second phase, we utilize the predicted attack path to deploy decoy nodes. However, it is likely that the attacker will not follow that predicted path to move laterally. To address this challenge, we employ a Partially Observable Monte-Carlo Planning (POMCP) framework. POMCP helps the defender assess several defense actions to block the attacker when it deviates from the predicted path. The evaluation results show that our approach can predict the most likely attack paths and thwarts the adversarial lateral movement.

Abstract Network attacks are serious concerns in today’s increasingly interconnected society. Recent studies have applied conventional machine learning to network attack detection by learning the patterns of the network behaviors and training a classification model. These models usually require large labeled datasets; however, the rapid pace and unpredictability of cyber attacks make this labeling impossible in real time. To address these problems, we proposed utilizing transfer learning for detecting new and unseen attacks by transferring the knowledge of the known attacks. In our previous work, we have proposed a transfer learning-enabled framework and approach, called HeTL, which can find the common latent subspace of two different attacks and learn an optimized representation, which was invariant to attack behaviors’ changes. However, HeTL relied on manual pre-settings of hyper-parameters such as relativeness between the source and target attacks. In this paper, we extended this study by proposing a clustering-enhanced transfer learning approach, called CeHTL, which can automatically find the relation between the new attack and known attack. We evaluated these approaches by stimulating scenarios where the testing dataset contains different attack types or subtypes from the training set. We chose several conventional classification models such as decision trees, random forests, KNN, and other novel transfer learning approaches as strong baselines. Results showed that proposed HeTL and CeHTL improved the performance remarkably. CeHTL performed best, demonstrating the effectiveness of transfer learning in detecting new network attacks.

Enabled by mobile and wearable technology, personal health data delivers immense and increasing value for healthcare, benefiting both care providers and medical research. The secure and convenient sharing of personal health data is crucial to the improvement of the interaction and collaboration of the healthcare industry. Faced with the potential privacy issues and vulnerabilities existing in current personal health data storage and sharing systems, as well as the blockchain integration concerns summarized in this paper, an innovative user-centric health data sharing solution by utilizing a decentralized but permissioned blockchain is proposed to protect privacy and enhance access management, with the help of channel formation scheme supported by the blockchain. By developing a web application for Personal Health Data Management (PHDM) systems, the individuals are capable of synchronizing sensor data from wearable devices with online account and controlling data access from any third parties. A mobile application is deployed to collect health data from personal wearable devices, manual input, and medical devices, and synchronize data to the cloud for data sharing with healthcare providers and health insurance companies. To preserve the integrity of health data, a proof of integrity and validation, is made available to each record, which is permanently retrievable from cloud database and is anchored to the blockchain network. Moreover, for scalable and performance considerations, a tree-based data processing and batching method is adopted to deal with large data sets of personal health data collected and uploaded by the mobile platform. To enable a trusted data access record, the Intel Software Extensions technology is utilized to ensure the accountability for data access and token based access control scheme is enhanced with the trusted hardware. Analysis shows that the proposed approach provides user privacy and accountability with acceptable overhead and scalability.