Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment

2025-05-06 0 0 1.24MB 20 页 10玖币

侵权投诉

Using Deception in Markov Game to

Understand Adversarial Behaviors through a

Capture-The-Flag Environment

Siddhant Bhambri1†, Purv Chauhan1†, Frederico Araujo2, Adam Doupé1, and

Subbarao Kambhampati1

1Arizona State University, Tempe, AZ, USA

{sbhambr1, prchauha, doupe, rao}@asu.edu

2IBM Research, Yorktown Heights, NY, USA

frederico.araujo@ibm.com

Abstract.

Identifying the actual adversarial threat against a system

vulnerability has been a long-standing challenge for cybersecurity re-

search. To determine an optimal strategy for the defender, game-theoretic

based decision models have been widely used to simulate the real-world

attacker-defender scenarios while taking the defender’s constraints into

consideration. In this work, we focus on understanding human attacker

behaviors in order to optimize the defender’s strategy. To achieve this goal,

we model attacker-defender engagements as Markov Games and search

for their Bayesian Stackelberg Equilibrium. We validate our modeling

approach and report our empirical ﬁndings using a Capture-The-Flag

(CTF) setup, and we conduct user studies on adversaries with varying

skill-levels. Our studies show that application-level deceptions are an op-

timal mitigation strategy against targeted attacks—outperforming classic

cyber-defensive maneuvers, such as patching or blocking network requests.

We use this result to further hypothesize over the attacker’s behaviors

when trapped in an embedded honeypot environment and present a

detailed analysis of the same.

Keywords:

Adversarial Behavior

Markov Games

Capture-The-Flag.

1 Introduction

Cybersecurity research, particularly that focused on ﬁnding optimal decision

strategies for a system defender, when faced by an adversarial threat, has almost

always involved a strong dependence on the assumptions made over the adver-

sary’s capabilities and the associated threat posed on the system vulnerabilities.

Assuming a rational adversary, who will always choose the action or strategy

that rewards highest returns, does not typically map to real-world situations [

However, this assumption has been a part of a common staple of approaches

that model attacker-defender interactions to compute an optimal strategy for

the defender, motivated by its practical performance [2].

†These authors contributed equally to this work.

Accepted at GameSec 2022 - Conference on Decision and Game Theory for Security.

arXiv:2210.15011v2 [cs.GT] 9 Nov 2022

2 S. Bhambri & P. Chauhan et al.

Such adversarial interactions become more interesting and complex when

defenders use cyber-deceptive techniques to respond to and thwart attacks.

Deception strategies in cybersecurity frameworks, such as installing honeypot

conﬁgurations to misdirect attackers, have been shown to be eﬀective tools to

disrupt attack kill chains and perform attacker reconnaissance [

]. Under-

standing an adversary’s behavior can aid cybersecurity defenders to optimally use

the available resources to deploy deceptions and mitigate potential threats, while

optimizing over the system constraints. Such knowledge can substantially aid a

decision-making model, reducing the magnitude of the assumptions a defender

must provide about the adversary to make the model operational.

In this paper, we build on the insight that an embedded honeypot [

]—a

decoy environment that is inlined with genuine service functionality—can be

conﬁgured in a way that is invisible to attackers while providing the defender with

essential knowledge about the attacker’s techniques in real operational settings.

Moreover, we show that the expected payoﬀs for the defender may vary when

compared to the real-world scenario where the attacker’s behaviors may not meet

the defender’s expectations or prior beliefs.

Our contributions are summarized as follows:

–

To ground this problem, we created a real-world Capture-The-Flag (CTF)

environment hosting three system vulnerabilities, and we conduct studies

using human subjects with varying system and attack skill levels who try

to capture the corresponding (real) ﬂags. Each of these vulnerabilities are

protected by diﬀerent real and practical mitigation strategies, one of which

is a deception-based honey-patch [

], which misdirects an adversary to an

embedded honeypot conﬁguration that yields the attacker a fake, or as we

refer to it in this work, a honeypot ﬂag.

–

In parallel to these studies, we model this attacker-defender system interaction

as a Markov Game and ﬁnd its Bayesian Stackelberg Equilibrium. We start

with the assumption of inputs to this Markov Game being set by a system

expert.

–

Later, by varying these inputs, especially for cases when the attacker may be

trapped in a honeypot conﬁguration, we leverage the statistical results received

from the conducted user studies, which further allows us to understand the

diﬀerences between the obtained equilibria and the empirical setting.

The paper is structured as follows: we begin in Section 2 by providing a

background on the CTF environment, Markov Games, and the system vulner-

abilities with the corresponding mitigations used in this work. We present our

hypotheses over the adversary behaviors and explain our user study setup along

with the Markov Game modeling in Section 3. Experimental details and results,

particularly involving a case-by-case evaluation and discussion on the observations

is presented in Section 4. We then talk about related work in Section 5, with the

conclusion discussing future directions for this work in Section 6.

Using Deception to Understand Adversarial Behaviors 3

2 Background

In this section, we ﬁrst present a brief overview of the Capture-The-Flag style

setup that we employed to host our user studies. Then, we introduce the real-world

vulnerabilities that we used to design the user study test-bed and game-theoretic

model evaluations, followed by the defense mechanisms deployed as mitigation

strategies. We also describe the Markov Game formalism used for ﬁnding an

optimal strategy for the defender.

2.1 Capture-The-Flag Setup

The primary goal of conducting the user studies is to gather realistic data on

attacker behaviors using CTF environments, rather than artiﬁcially generating

the data based on commonly accepted assumption over adversaries [

]. One

way to achieve this is through creating prototype components to run CTF style

experiments. We further integrate them into an existing open-source framework

known as the iCTF framework [

]

†

. This infrastructure allowed experiments

to be run with a sizable number of human subjects to gather enough data for

our desired analysis.

The iCTF framework is the core framework used for conducting user studies.

It is primarily used to host attack-and-defense style CTF competitions every year

†

For the purpose of collecting data for this study, we made several modiﬁcations

to the existing implementation of the framework. Most of these modiﬁcations

include deploying defense mechanisms and data collection tools. Since our goal

is to simulate real-life scenarios, we choose three vulnerabilities (which are still

prominent in current software applications) and develop three corresponding

vulnerable applications for this purpose. The vulnerabilities are selected and

deployed in a manner that it is possible to exploit them in a reasonable amount

of time (which we veriﬁed through pilot studies), therefore faithfully representing

typical large-scale cyber-attacks. The vulnerabilities selected include command

injection and buﬀer overﬂow. The vulnerable applications are written in Cand

dockerized to isolate them from the host machine. Also, all modern security

mitigations, including Position Independent Executable (PIE), Data Execution

Prevention (DEP), and Address Space Layer Randomization (ASLR) are disabled.

2.2 Vulnerabilities and Exploits

We developed three diﬀerent vulnerable applications. backup is the ﬁrst application

which allows users to store and retrieve data that is stored as ﬁles on the host

system. One of the functions in this application concatenates a string with the

user input and passes that string to the C function

system()

, and the user’s

input is not sanitized, thus resulting in a command injection vulnerability.

†https://github.com/shellphish/ictf-framework

†https://shellphish.net/ictf/

4 S. Bhambri & P. Chauhan et al.

The second application, sampleak, allows users to store and retrieve notes

which are also stored as ﬁles, but unlike the backup application, a password is

stored in the ﬁles, so that the user is required to provide a password when creating

a note and needs to enter the correct password when retrieving them. The user

input is stored in the application’s memory using buﬀers, but the function

read()

unintentionally reads in more bytes than the buﬀer can hold, thus resulting in a

buﬀer overﬂow vulnerability.

The third vulnerable application is exploit-market, which allows users to store,

retrieve, and list payloads, which are stored in the memory of the program. The

vulnerability in this application is due to buﬀers being initialized with diﬀerent

sizes in separate functions, so when the function

strcpy()

is called to copy the

contents of the buﬀer, a carefully crafted payload can result into a buﬀer overﬂow

vulnerability. Another intentional bug is also placed in the form of a memory

disclosure which leaks heap addresses of the string buﬀers.

2.3 Defense Strategies and Analysis Tools

The defense mitigations are selected for protecting the vulnerable applications.

The mitigations include deploying Snort, an intrusion detection system on a router

machine acting as a gateway between the attacker machine and the defender

machine. Snort uses a rule-based conﬁguration ﬁle for setup, and this rule ﬁlter

has a list of commonly used shellcodes for exploiting various applications running

on multiple architectures. We also extended a live-patching framework [

] to

enable cyber-deceptive attack countermeasures.

To collect valuable attacker and defender information, we further deploy tools

on our host machines that include: tcpdump, which is a network packet analyzer to

capture network traﬃc for further analysis, and SysFlow [

], an open-source

system-call monitoring framework that encodes the representation of system

activities into a compact entity-relational format that captures the interactions of

processes with system resources, including ﬁle and network activity. This provides

a richer context for post-exploitation analysis [15].

2.4 Attack Graph

Attack graphs (AGs) have been established as useful structures to represent

exploit possibilities and derive attack behaviors for an adversary [

]. An

attack graph is represented as

(

V,E

), where

v∈ V

denotes vertices or nodes

representing the diﬀerent states the adversary can be in, and

e∈ E

denotes the

edges between these nodes that represent the actions the adversary can take to

move one from one state of the exploit to another.

Figure 1 is an example of an attack graph for an attacker trying to exploit

the vulnerabilities present in the environment with the possibility of one or more

of them being honey-patched, i.e., deceiving and misdirecting the attacker into

a honeypot conﬁguration where the system defender can extract useful insights

about attacker behavior.

文档加载中……请稍候！
如果长时间未打开，您也可以点击刷新试试。

下载文档到电脑，查找使用更方便

10 玖币 0人已下载

立即下载

摘要：

UsingDeceptioninMarkovGametoUnderstandAdversarialBehaviorsthroughaCapture-The-FlagEnvironmentSiddhantBhambri1y,PurvChauhan1y,FredericoAraujo2,AdamDoupé1,andSubbaraoKambhampati11ArizonaStateUniversity,Tempe,AZ,USA{sbhambr1,prchauha,doupe,rao}@asu.edu2IBMResearch,YorktownHeights,NY,USAfrederico.araujo...

展开>> 收起<<

Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment.pdf

共20页,预览4页

还剩页未读，继续阅读

声明：本站为文档C2C交易模式，即用户上传的文档直接被用户下载，本站只是中间服务平台，本站所有文档下载所得的收益归上传人(含作者)所有。玖贝云文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。若文档所含内容侵犯了您的版权或隐私，请立即通知玖贝云文库，我们立即给予删除！

Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment

相关推荐

开通VIP享超值会员特权

作者详情

相关内容

热门标签

举报选择: