Abstract
A software system’s attack surface is the set of ways in which the system can be attacked. In our prior work, we introduced an attack surface measurement and reduction method to mitigate a software system’s security risk (Manadhata, An attack surface metric, Ph.D. thesis, Carnegie Mellon University, 2008; Manadhata and Wing, IEEE Trans. Softw. Eng. 37:371–386, 2011). In this paper, we explore the use of attack surface shifting in the moving target defense approach. We formalize the notion of shifting the attack surface and introduce a method to quantify the shift. We cast the moving target defense approach as a security-usability trade-off and introduce a two-player stochastic game model to determine an optimal moving target defense strategy. A system’s defender can use our game theoretic approach to optimally shift and reduce the system’s attack surface.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
National cyber leap year summit 2009 co-chairs report. http://www.cyber.st.dhs.gov/docs/National_Cyber_Leap_Year_Summit_2009_Co-Chairs_Report.pdf (2009)
Filar, J., Vrieze, K.: Competitive Markov decision processes. Springer (1997)
Lye, K., Wing, J.M.: Game strategies in network security. International Journal of Information Security pp. 71–86 (2005)
Lynch, N., Tuttle, M.: An introduction to input/output automata. CWI-Quarterly 2(3) (1989)
Manadhata, P.K.: An attack surface metric. Ph.D. thesis, Carnegie Mellon University (2008)
Manadhata, P.K., Wing, J.M.: An attack surface metric. IEEE Trans. Softw. Eng. 37, 371–386 (2011). DOI http://dx.doi.org/10.1109/TSE.2010.60. http://dx.doi.org/10.1109/TSE.2010.60
Murray, C., Gordon, G.: Finding correlated equilibria in general sum stochastic games. Tech. Rep. CMU-ML-07-113, Carnegie Mellon University (2007)
Osborne, M., Rubinstein, A.: A course in game theory. MIT Press (1994)
Roy, S., Ellis, C., Shiva, S., Dasgupta, D., Shandilya, V., Wu, Q.: A survey of game theory as applied to network security. Hawaii International Conference on System Sciences 0, 1–10 (2010). DOI http://doi.ieeecomputersociety.org/10.1109/HICSS.2010.35
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer Science+Business Media New York
About this paper
Cite this paper
Manadhata, P.K. (2013). Game Theoretic Approaches to Attack Surface Shifting. In: Jajodia, S., Ghosh, A., Subrahmanian, V., Swarup, V., Wang, C., Wang, X. (eds) Moving Target Defense II. Advances in Information Security, vol 100. Springer, New York, NY. https://doi.org/10.1007/978-1-4614-5416-8_1
Download citation
DOI: https://doi.org/10.1007/978-1-4614-5416-8_1
Published:
Publisher Name: Springer, New York, NY
Print ISBN: 978-1-4614-5415-1
Online ISBN: 978-1-4614-5416-8
eBook Packages: Computer ScienceComputer Science (R0)