The use of partially observable Markov decision processes to optimally implement moving target defense
Loading...
Authors
McAbee, Ashley S.M.
Tummala, Murali
McEachen, John
Subjects
Cybersecurity and Software Assurance
cybersecurity
markov models
moving target
cybersecurity
markov models
moving target
Advisors
Date of Issue
2021-01-05
Date
2021
Publisher
HICSS
Language
Abstract
For moving target defense (MTD) to shift advantage away from cyber attackers, we need techniques which render systems unpredictable but still manageable. We formulate a partially observable Markov decision process (POMDP) which facilitates optimized MTD capable of thwarting cyber attacks without excess overhead. This paper describes POMDP formulation including the use of an absorbing final state and attack penalty scaling factor to abstract defender-defined priorities into the model. An autonomous agent leverages the POMDP to select the optimal defense based on assessed cyber-attack phase. We offer an example formulation wherein attack suppression of greater than 99% and system availability of greater than 94% were maintained even as probability of detection of attack phase dropped to 74%.
Type
Conference Paper
Description
17 USC 105 interim-entered record; under temporary embargo.
Series/Report No
Department
Organization
Identifiers
NPS Report Number
Sponsors
Funding
U.S. Government affiliation is unstated in article text.
Format
10 p.
Citation
McAbee, Ashley, Murali Tummala, and John McEachen. "The use of partially observable Markov decision processes to optimally implement moving target defense." Proceedings of the 54th Hawaii International Conference on System Sciences. 2021.