Resisting Memorization-Based APT Attacks Under Incomplete Information in DDHR Architecture: An...

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Information Systems

Background:

• Advancements in artificial technology introduce sophisticated cyber threats, including memorization-based Advanced Persistent Threat (APT) attacks.
• Critical infrastructure, such as the Railway Passenger Service System (RPSS), faces significant risks due to these evolving threats and conventional security limitations.
• The RPSS Cloud Center's Double-Layer Dynamic Heterogeneous Redundancy (DDHR) architecture presents specific vulnerabilities, including challenges in estimating redundant executor scheduling time and the lack of intelligent defense mechanisms against such attacks.

Purpose of the Study:

• To address the challenges of accurately estimating scheduling time and developing intelligent defense strategies against memorization-based APT attacks within the RPSS DDHR architecture.
• To formulate the problem of optimizing defender's payoff under incomplete information by utilizing the information entropy of DDHR redundant executors.
• To propose a novel defense scheduling method that enhances the RPSS's resilience against sophisticated cyber threats.

Main Methods:

• Developed a problem formulation for optimizing defender's payoff under incomplete information, incorporating information entropy of DDHR redundant executors to model attacker and defender behaviors.
• Proposed a method for estimating attack time to overcome the challenge of determining scheduling time with incomplete information.
• Introduced the Proximal Policy Optimization with Information Entropy and Heterogeneity (PPO_HE) algorithm, enhancing a PPO algorithm with quantifiable information entropy and heterogeneity metrics of DDHR redundant executors.

Main Results:

• The PPO_HE approach demonstrated superior efficiency per scheduling operation in countering cyber attacks compared to existing methods.
• Extensive experiments evaluated the approach using information entropy decay amount and rate, confirming its effectiveness.
• The PPO_HE approach provided the longest resistance time against memorization-based attacks under identical initial information entropy conditions.

Conclusions:

• The proposed PPO_HE approach offers an effective and intelligent defense scheduling method for the RPSS DDHR architecture against advanced cyber threats.
• The integration of information entropy and heterogeneity provides a quantifiable framework for enhancing cybersecurity defenses in critical information systems.
• This research contributes to developing more robust and adaptive security solutions for critical infrastructure in the face of evolving artificial intelligence-driven cyber risks.