How Shall We Play a Game? A  Game-­‐theore,cal  Model  for  Cyber-­‐warfare  Games  

 1Carnegie  Mellon  University,  2University  of  California,  Santa  Babara  

Tiffany  Bao1,  Yan  Shoshitaishvili2,  Ruoyu  Wang2,  David  Brumley1  

Goals  •  Fully  Autonomous  Systems  becomes  possible:  Mayhem  in  the  Cyber  Grand  Challenge.  

•  The  Strategy  Generator  is  a  key  component  to  instruct  the  system.  

•  The  goal  is  to  automa,cally  find  the  best  strategy  of  the  system.  

AGacking  Tool  

Patching  Tool  

Exploit  GeneraKon  

Tool  

DetecKon  Tool  

Other  Players’  

Computers  

The  Player’s  Computers  

Detect  an  aGack  

Discover  an  exploit  

Patch  

Exploit  

Other  players  disclose  a  vulnerability  

ui(t)

Game  Parameters  

Parameter   Defini,on  The  probability  distribuKon  over  Kme  that  player  i  discovers  a  vulnerability  at  round  t.  The  probability  to  launch  a  ricochet  aGack  with  exploits  that  player  i  received  in  the  

previous  round.  The  raKo  of  the  amount  of  patched  vulnerable  resources  over  the  total  

amount  of  vulnerable  resources  at  round  t.  The  number  of  rounds  required  by  player  i  to  generate  a  patch-­‐based  exploit  aRer  a  vulnerability  and  the  corresponding  patch  

are  disclosed.  The  dynamic  uKlity  that  player  i  gains  by  

aGacking  his  opponents  at  round  t.  

The  Cyber-­‐warfare  Game  in  MulKple  Rounds   EvaluaKon  •  Performance:  for  a  game  with  50  Kme  slots,  we  found  the  best  strategy  in  10  seconds.  

•  ParKal  Observable  StochasKc  Game  (POSG)  •  Players  do  not  know  if  the  other  players  have  

discovered  a  vulnerability  or  the  other  players’  acKons.  

•  Finding  the  best  strategy  of  POSG:  PPAD-­‐hard  problem  (which  cannot  be  scalable).  

•  We  divide  the  game  into  two  sub-­‐games  in  order  to  find  the  best  strategy  by  dynamic  programing.  •  Sub-­‐game  1:  before  vulnerability  disclosure  •  Sub-­‐game  2:  aRer  vulnerability  disclosure  

•  ObservaKon:  When  a  player  discloses  a  vulnerability,  the  other  players  should  aGack  right  aRer  they  generate  the  aGack.  

Vulnerability  introduced  

Vulnerability-­‐based  Exploit  

Patch  released   Patching  completed  

AGack-­‐based  Exploit  

Patch-­‐based  Exploit  

…  One  Round  

Timeline  

AGack  launched  

Strategy  Generator  

qi(t) hi(t)

pi(t) ui(t)

�iui(t)

hi(t)

�i

qi(t)

pi(t)