Dynamic Defense against Stealth Malware Propagation in Cyber-Physical Systems: A Game-Theoretical Framework

Area of Science:

• Cybersecurity
• Network Security
• Game Theory

Background:

• Stealth malware, a tool of advanced persistent threat (APT) attacks, poses significant risks to cyber-physical systems (CPS).
• Conventional countermeasures are often ineffective against stealthy malware, while light-weight defenses may compromise CPS safety requirements.
• Balancing the benefits and drawbacks of light-weight countermeasures is a critical challenge for CPS security.

Purpose of the Study:

• To model the anti-malware defense process in CPS as a Stackelberg game, incorporating safety constraints.
• To address both static and dynamic versions of the problem, aiming to find an optimal balance between defense effectiveness and system safety.
• To develop efficient algorithms for finding defense strategies against stealth malware propagation in CPS.

Main Methods:

• The problem is formulated as a shortest-path tree interdiction (SPTI) Stackelberg game, including static (SSPTI) and dynamic (DSPTI) versions.
• Both games are modeled as NP-hard bi-level integer programs.
• A Benders decomposition algorithm is developed for SSPTI, and a Model Predictive Control strategy is designed for DSPTI, using an approximation approach.

Main Results:

• The proposed algorithms and strategies were evaluated against existing methods on simulated and real-case CPS networks.
• Experimental results demonstrate the efficiency of the developed algorithms and strategies in both static and dynamic scenarios.
• The dynamic defense framework effectively balances fail-secure and fail-safe capabilities while mitigating stealth malware spread.

Conclusions:

• The developed game theory models and algorithms provide an effective approach to defending CPS against stealth malware.
• The proposed methods offer a way to achieve a necessary balance between security gains and safety requirements in CPS.
• The dynamic defense strategy is particularly advantageous for real-time adaptation and robust protection of CPS environments.