• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Autonomous Agents and Multiagent Systems >A Game Theoretic Approach to Strategy Generation for Moving Target Defense in Web Applications
【24h】

A Game Theoretic Approach to Strategy Generation for Moving Target Defense in Web Applications

机译：Web应用中移动目标防御的战略生成的游戏理论方法

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The present complexity in designing web applications makes software security a difficult goal to achieve. An attacker can explore a deployed service on the web and attack at his/her own leisure. Moving Target Defense (MTD) in web applications is an effective mechanism to nullify this advantage of their reconnaissance but the framework demands a good switching strategy when switching between multiple configurations for its web-stack. To address this issue, we propose the modeling of a real world MTD web application as a repeated Bayesian game. We formulate an optimization problem that generates an effective switching strategy while considering the cost of switching between different web-stack configurations. To use this model for a developed MTD system, we develop an automated system for generating attack sets of Common Vulnerabilities and Exposures (CVEs) for input attacker types with predefined capabilities Our framework obtains realistic reward values for the players (defenders and attackers) in this game by using security domain expertise on CVEs obtained from the National Vulnerability Database (NVD). We also address the issue of prioritizing vulnerabilities that when fixed, improves the security of the MTD system. Lastly, we demonstrate the robustness of our proposed model by evaluating its performance when there is uncertainty about input attacker information.
机译：设计Web应用程序的目前复杂性使软件安全成为实现的难度目标。攻击者可以探索网络上的部署服务并攻击他/她自己的休闲。在Web应用程序中移动目标防御（MTD）是一种有效的机制，可以实现其侦察的这种优势，但框架在其Web堆栈之间切换多个配置之间需要良好的切换策略。为了解决这个问题，我们建议将真实世界MTD Web应用程序的建模为重复的贝叶斯游戏。我们制定了一个优化问题，它在考虑在不同的Web堆叠配置之间切换的成本，产生有效的交换策略。要将此模型用于开发的MTD系统，我们开发了一种自动化系统，用于生成常见漏洞和曝光（CVES）的攻击组，用于输入攻击者类型，具有预定义的功能我们的框架在此获得播放器（防御者和攻击者）的现实奖励价值游戏通过在国家漏洞数据库（NVD）中获得的CVES上使用安全域专业知识。我们还解决了优先顺序漏洞的问题，即修复时，提高了MTD系统的安全性。最后，我们通过评估输入攻击者信息的不确定性时，通过评估其性能来展示我们提出的模型的鲁棒性。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号