Dynamic Information Flow Tracking for Detection of Advanced Persistent Threats: A Stochastic Game Approach

Advanced Persistent Threats (APTs) are stealthy attacks by intelligent adversaries. This paper studies the detection of APTs that infiltrate cyber systems and compromise specifically targeted data and/or infrastructures. Dynamic information flow tracking is an information trace-based detection mechanism against APTs that tags suspicious information flows in the system and performs security analysis for unauthorized use of tagged data. In this paper, we develop an analytical model for resourceefficient detection of APTs using an information flow tracking game. The game is a nonzero-sum, turn-based, stochastic game with asymmetric information as the defender cannot distinguish whether an incoming flow is malicious or benign. The payoff functions of the game capture the cost for performing security analysis and the rewards and penalties received by the players. We analyze equilibrium of the game and prove that a Nash equilibrium is given by a solution to the minimum capacity cut set problem on a flow-network derived from the system. The edge capacities of the flow-network are obtained from the cost of performing security analysis. Finally, we implement our algorithm on a real-world dataset for a data exfiltration attack augmented with false-negative and false-positive rates and compute an optimal defender strategy.