网络安全：智能防御中的人为因素分析

需积分: 12 169 浏览量更新于2024-07-21 收藏 6.51MB PDF 举报

"网络安全与智能防御中的人为因素" 网络安全是一个多维度的领域，其中"人为因素"在保障网络安全性方面起着至关重要的作用。在《The Human Factor in Cybersecurity Robust and Intelligent Defense》中，作者们深入探讨了人类行为如何影响网络安全策略的实施和智能防御系统的效能。人为因素主要涉及以下几个关键点： 1. 用户意识：大部分网络安全事件的发生往往源于用户的疏忽或缺乏网络安全意识。例如，用户可能轻易点击钓鱼邮件、使用弱密码或者在不安全的网络环境下共享敏感信息。提高用户的网络安全意识是降低风险的关键，通过教育和培训可以帮助用户识别威胁并采取正确的防护措施。 2. 社会工程学攻击：攻击者经常利用社会工程学技巧来欺骗用户，获取敏感信息。这包括伪装成可信来源的电子邮件、电话诈骗以及在社交媒体上的欺诈行为。了解这些策略有助于建立抵御社会工程学的防线。 3. 内部威胁：内部员工可能无意或有意地成为威胁源。他们可能因为疏忽导致数据泄露，或者出于恶意目的滥用权限。因此，组织需要实施严格的访问控制和监控机制，同时进行背景调查和定期的安全审核。 4. 智能防御系统的人性化设计：智能防御系统在自动化检测和响应威胁时，必须考虑人的因素。系统需要易于理解和操作，以确保用户能够及时有效地响应警报。此外，过于复杂的系统可能会导致用户忽视警报，从而削弱整体防御能力。 5. 政策与合规：制定和执行强效的网络安全政策对于管理人为风险至关重要。政策应明确规定员工的责任和期望行为，并定期更新以适应不断变化的威胁环境。 6. 心理因素：理解人类的心理状态对预测和预防网络安全事件也十分关键。例如，疲劳、压力或好奇心可能导致用户做出不利于安全的决策。研究这些心理因素可以帮助设计更有效的安全培训和防御策略。 7. 持续监测和反馈：持续的用户行为分析（UEBA）能够帮助识别异常行为，从而及时发现潜在的内部威胁或社会工程学攻击。这种监测应当结合机器学习和人工智能技术，以便更准确地识别威胁模式。网络安全不仅关乎技术解决方案，更需要重视人的角色。通过理解并解决人为因素带来的挑战，组织可以构建更为坚固且智能的防御体系，有效应对日益复杂和多变的网络威胁。

1 Cyber War Games: Strategic Jostling Among Traditional Adversaries 3

fundamental game theoretic concepts and some recent work on cyber warfare that

includes game theoretic models. Sect. 1.4 discusses the models in details followed

by a succinct conclusion.

1.2 Cyber Warfare

Deﬁnition of cyber attacks is contextual: depending on the actors, motivation, tar-

gets, and actions, they can be called cyber terrorism, cyber crime, cyber activism, etc.

There are several distinct modes of conﬂicts related to cyber warfare. Understanding

the relationships between actors, their behavior, and their motivations is essential

in order to understand cyber warfare better and to reduce chances of a serious cy-

ber conﬂict. We use game theoretic models to look at positions of the key players

on each of these conﬂicts to understand the dynamics among the players in these

conﬂicts. We select four modes of cyber conﬂict that are dominating international

cyber politics for further analysis including: (1) social media wars that inﬂuences a

country’s internal politics often with a goal of fomenting social uprisings that can

result in political change; (2) strategic war aimed at causing damage for the adver-

sary as well as pillaging resources (e.g., industrial espionage); for this, countries are

acquiring resources to conduct both espionage and develop tools that can be used to

disable the adversarial activities occurring in critical infrastructure including power,

communication, media, Internet, etc.; (3) ideological battle where fundamentalist

organizations use the Internet to spew their ideology and to recruit members in other

countries for their cause; (4) citizen-initiated war where a country’s civilians di-

rectly attack another country’s citizens and institutions as a part of larger conﬂict

(ideological or kinetic).

Foreign intervention through social media has become a signiﬁcant fear for coun-

tries leading to aggressive monitoring if not outright controlling of social media

content. Some countries have already invested in censorship and control of the In-

ternet mainly driven by intention to decrease political unrest or ideological and

religion polluting. Social media-facilitated revolutions have driven some countries

to the point of paranoia regarding control of online activity. If this type of distrust

keeps growing, there is only one logical conclusion: separation of the Internet across

country borders. A separated Internet could have severe consequences with negative

impacts from the individual to national level from social relationships, educational

pursuits, commerce, and tourism. In a lot of the authoritarian and corrupt regimes

the conditions on the ground are ripe for popular revolutions. In the past, they have

been kept in check through censorship and coercion. Social media has provided a

forum for organizing large scale protests—which countries are prone to such attacks

and which countries have incentives to sponsor such attacks.

The strategic war of targeting the resources has each country building up their

cyber arsenals quietly while publicly denouncing similar activities by others. Each

country considers cyberspace a natural place for gaining strategic military advantage.

This is causing serious misgivings between different countries. For instance, the

4 S. Goel and Y. Hong

United States is very concerned about Chinese reconnaissance into the power grid and

at the same time attempting to gather intelligence from foreign networks. Similarly,

businesses are constantly claiming intrusion by the Chinese for corporate espionage

or stealing data. These illicit activities have been widely publicized by the media

resulting in civilian unease and condemnation from the U.S. government. However,

at the same time, it has been revealed that the U.S. ran one of the largest spying

operations around the world sparing neither friend nor foe.

Terrorism ﬁts naturally with game theory since when it is reduced to its simplest

level, many terrorist events can be summed up to simple or complex strategic in-

teractions. It can be examined both at a micro-level dealing with individual attack

decisions and at a macro-level that involves overall strategy of the attacker (terrorist

group) and defender (nation states). Each country seems to have their own terrorist

problem; inciting such anti-national activities in other countries can backﬁre. Each

country has their own terrorist foes that they are concerned with, e.g., Russia about

Chechnya-based jihadi elements, the U.S. about Al Qaeda, India about Pakistan-

based terrorist organizations, E.U. about jihadi elements from the Middle East, and

China about Tibetan activities. While countries are being victims of terrorism, they

are supporting terrorism in other countries. The link between sponsors and the vic-

tims can be established in order to formulate a strategy to counter cyber terrorism.

Consider for instance a country has a chance to sponsor terrorism against a rival

country. The choices are two fold i.e. sponsor or not to sponsor. The country against

which it is targeted can either negotiate or retaliate. This creates a game theoretic

problem.

There have been many incidents of citizen-initiated attacks against other coun-

tries either through tacit government support or through support of non-state actors.

Examples of these types of incidents include hacker group activities in India and Pak-

istan. Similarly, there have been attacks by Russian citizens on Estonia and Georgia

during conﬂicts. Citizen-initiated war typically starts with a strong rhetoric in the

media and then takes a life of its own often outside of governmental control. Citizen-

initiated attacks provide leverage to governments since they can absolve themselves

at least partly in participating in an act of war but they may get out of control and

lead to unanticipated disproportionate retaliation.

A key concerns for strategists is to prevent unexpected and unwarranted escala-

tion of the war. The escalation can come from political reasons when the attacked

nation is forced to have a forceful response to cater to public perception. Countries

can deliberately force a response from other countries looking for an excuse for con-

ﬂict. Non-state actors who launch attacks masquerading as a nation state can cause

dangerous escalation in tension by launching cyber attacks purportedly from one

nation state to another. This becomes especially potent since attribution is hard and

distinguishing between an attack by a proxy representing the state and a non-state

actor can be difﬁcult. Given the shared security doctrines that exist among countries

this conﬂict to escalate into a multi-county conﬂict. At some point a cyber attack

will lead to a kinetic attack if tensions escalate sufﬁciently or phony cyber attacks

will be used as a ruse to launch a kinetic attack. Attacks on the critical infrastructure

1 Cyber War Games: Strategic Jostling Among Traditional Adversaries 5

have already escalated cyber warfare to the next level there have been mutual in-

criminations about surveillance and penetration into critical infrastructure networks

among countries. Stuxnet worm that was used to launch attack on the centrifuges in

the Iranian nuclear program has demonstrated the potency of critical infrastructure

attacks leading each country to build their defensive capability and at the same time

invest in offensive capabilities for deterrence.

Escalation of the social media war and information censorship may also escalate

compelling countries to isolate them on the Internet leading to the fragmentation of

the Internet that is also undesirable. Countries that consider the freedom of Internet

a threat to the political structure and social fabric of society will start separating

from the Internet. China has already insulated their citizens from the “objection-

able content” of global Internet through stringent laws on admissible content on the

Internet and aggressive censorship where they ﬁlter Internet trafﬁc, block speciﬁc

IP-addresses, and aggressively monitor the content on the Internet. Several other

countries such as Russia, Iran, and Germany are making attempts to insulate their

networks or data from other countries albeit for different reasons.

We formulate game theoretic problems related to some of these dynamic scenarios

to better understand the dynamics and to determine optimum strategy. The overall

goal of the endeavor is to support the creation of international treaties based on

optimum strategies for each of the key player.

1.3 Game Theory

Game theory involves the formulation of a decision-making problem as a game in

which two or more players make decisions such that the decisions of one player

has an impact on the decision of the other player. The game is deﬁned as a set of

strategies and payoffs for each player. The players are assumed to be rational and

their goal is to maximize their payoffs (utility) from participating in the game. All

players also expect other players to be rational. Generally, rationality assumes perfect

and complete information among players about the strategies and payoffs of each

other. Complete information refers to the recognition of the identity of other players

involved and the payoff for their particular strategies, whereas perfect information

refers tothe ability to observe the actions of other players. In the contextof incomplete

information, where players do not know their opponent’s strategies, a Bayesian game

based on a probability distribution of actions in the strategy set may be modelled

(Harsanyi 1967).

There are three types of payoff functions: zero-sum; constant-sum; and non-zero

sum. In zero-sum games the gains of one player are directly opposite to the losses

of another. What one player wins, the other must lose. This assumes that opponent’s

evaluation functions are opposite. In constant-sum games, only one player will

have a non-zero payoff at any one time, and in non-zero sum games no restrictions

are applied to the payoff structure (Aumann and Maschler 1995). Hamilton et al.

(2002) suggests that zero-sum assumptions are not reasonable in cyber warfare as

state actors have different goals and priorities. Burke (1999) suggests a non-zero

sum model is most realistic in the context of this type of information warfare.

6 S. Goel and Y. Hong

The goal of the game is to ﬁnd an equilibrium solution, i.e. the best outcome

or payoff for the players considering the decisions of all other players. In classical

optimization terms this is a local optima solution to the problem for a player. One of

the most basic solution for a game is the minimax solution that minimizes a players’

maximum expected loss. Nash Equilibrium, is achieved when a unique, optimal

strategy for each player corresponding to every move of the opponent is available

(Gibbons 1992). A strategy is said to be pure if the probability that the strategy will

be chosen is 1 for a given scenario. In many cases, however, opponents do not have

complete information or are uncertain about the structure of the game and a pure

strategy is not evident. In this case, a stochastic model called the mixed strategy is

used in which a probability associated with speciﬁc strategies are deﬁned.

Games can be cooperative and non-cooperative. Cooperative games are usually

modeled when mechanisms are available to enforce particular sets of behavior

(source). Although we may assume cooperative strategies in cyber warfare (for

example, cooperation among NSA and GCHQ), in this chapter we model non-

cooperative games. We make policy recommendations to reduce problems of cyber

warfare based on the conclusions derived from our non-cooperative models. Perfect

information also involves the concept of perfect recall, or knowledge of the history

of strategies chosen by each player. We expect the cyber warfare conﬁdence building

and treaty process to have perfect recall while cyber war strategy games to deploy

offensive and defensive capabilities to have incomplete information. In the cases

we model, however we make a simpliﬁcation assumption of perfect information.

In general, games are either static or dynamic. In static games, decisions by

all players are made simultaneously without knowledge of the decisions that other

players have actually carried out. Dynamic games involve a series of games where

the strategies can be re-evaluated based on previously made choices by the players

involved. In the context of cyber warfare dynamic games may be present when intru-

sion tactics involve multiple steps and trials. At the same time, defense mechanisms

may allow the recognition of previous attacks and inﬂuence future behavior in order

to protect the systems. Sequence in time is thus an important component of cyber

warfare (e.g. see Libicki 1997). It is also reasonable to assume static games, however,

as many cyber attacks happen unbeknownst to those being attack. We create static

models for several games.

1.3.1 Game Theory in International Relations

One of the key assumptions in game theory is that actors are non-altruistic and are

purely driven by their own goals. The ﬁeld of international relations is a quintessen-

tial representation of this assumption where nation-states are motivated only by their

interests and are not guided by ethical or humanitarian concerns but are only con-

cerned about maximizing their utility function (Evans and Newnham 1998; Hollis

and Smith 1990). There are two areas of International Relations that can greatly

improve the understanding of cyber warfare deterrence and arms race as well as in-

ternational diplomacy. International relations scholars (Gleditsch 1990; Intriligator

1 Cyber War Games: Strategic Jostling Among Traditional Adversaries 7

and Brito 1990; Bolks and Stoll 2000; Reuveny and Maxwell 1998) have extensively

studied deterrence and arms races using game theoretic models. In its simplest form

deterrence between two nation states can be studied where each threatens to retaliate

to a potential attack by the other to prevent the other from launching the attack in the

ﬁrst place. The objective of the nation-states is to prevent destruction or domination

by the other and each would feel more secure if it acquires weapons for protection.

The acquisition of the weapons, albeit for defensive purposes, trigger the adversary

into acquiring more weapons especially if the weapons are dual use leading to an

arms race. This phenomenon where actions by a state to heighten its security can lead

other states to respond with similar measures thereby escalating dangers of conﬂict

rather than reducing them even though no one desires it is called the security dilemma

and can be studied using game theoretic concepts. This phenomenon is studied ex-

tensively using the Prisoner’s Dilemma game (Brams 1975; Clemens 1998; Dixit

and Skeath 1999; Hamburger 1979; Powell 1999; Taylor 1995), which often results

in a less than desirable outcome for each player. There has been very little research

on the use of Game Theory for cyber warfare and cyber terrorism.

Matusitz (2009) suggests that game theory is particularly important and useful to

apply to cyberterrorism. Jormakka and Mölsä (2005) present 4 distinct scenarios in

which game theory may be applied in the context of information warfare. The ﬁrst

example includes a terrorist group (T) with certain requirements, holding hostages

and threatening to cause destructive damage; and a government (G) wanting the

terrorists to surrender. This game is modelled as a two-player static game of complete

information, where each player has two strategies (e.g., accepting or rejecting the

other’s). Initially, this game ends with two Nash equilibriums with no unique solution

as is typical in asymmetric warfare. If the game is repeated, and each player adopts a

“bold” or single strategy, a dominated outcome can be obtained (i.e. outcome other

than equilibrium). They also show that using a mixed strategy can prove effective

against a dominative attack strategy. Finally they demonstrate an n-person game

where an attacker is perpetrating a DoS attack on a network and each player has two

strategies i.e. using the network or being idle. There is one attacker who wants to

overload the network, and a number of other users who want to maintain the network

functioning. This situation results in a payoff that is 0 for all players. After initial

shutdownof the network, users will ﬁnd another network in which to operate. Making

this assumption the attacker (“vandal”) cannot win. However, if the game is modeled

as a dynamic game, and the vandal only overloads the network 50 % of the time, he

can have some gain. Ma et al. (2011) develop a game theoretic model for interaction

between government agencies and ﬁrms that are faced with cyber threats. They use

the Crawford and Sobel (1982) “cheap talk” model. A similar model can be used to

understand the interactions between the hacker groups and the Chinese government.

1.4 Problem Formulation

The basic game theory problem is that each country wants to deescalate cyber tension

however they cannot trust the other adversaries and thus need to invest in cyber

arsenals to catch up with the adversaries leading to the arms race where each party

剩余325页未读，继续阅读

woshibutian

粉丝: 2
资源: 13

网络安全：智能防御中的人为因素分析

Developing Cybersecurity Programs and Policies, 3rd Edition

Enterprise.Cybersecurity.1430260823

Cybersecurity Attack and Defense Strategies

The_Human_Factor_in_Cyber_security_Kevin_O’Leary.pdf

Cybersecurity Testing and Validation

UN Regulation No.155 - Cyber security and cyber security managem

Cybersecurity and Cyberwar

「数据泄露」law-f01_cybersecurity_and_international_trade-the_new_l

Cybersecurity and Secure Information Systems

Smart Cities Cybersecurity and Privacy

最新资源