标题： 基于不确定传感器信号的预防性和响应性防御资源分配优化 显示英文标题

标题： Optimizing Preventive and Reactive Defense Resource Allocation with Uncertain Sensor Signals

摘要： 网络攻击持续引起关注，尽管网络防御技术有所进步。 尽管无法完全防止网络攻击，标准的决策框架通常侧重于如何防止攻击成功，而没有考虑成功攻击造成的损害清理成本。 这促使我们研究本文中提出的新的资源分配问题：防御者必须决定如何在预防性防御和反应性防御之间分配其投资；预防性防御旨在使节点免受攻击，而反应性防御旨在快速清理被入侵的节点。 这面临着与观察或传感器信号相关的不确定性挑战，即是否一个节点真正被入侵；这种不确定性是真实的，因为攻击检测器并不完美。 我们研究了传感器信号的质量如何影响防御者在两种防御类型上的战略投资，以及最终能够实现的安全水平。 特别是，我们表明，随着传感器质量的提高，预防性资源的最佳投资增加，因此反应性资源投资减少。 我们还表明，相对于不使用传感器的基准情况，防御者的性能提升在攻击者只能实现低攻击成功率时达到最大。 显示英文摘要

摘要： Cyber attacks continue to be a cause of concern despite advances in cyber defense techniques. Although cyber attacks cannot be fully prevented, standard decision-making frameworks typically focus on how to prevent them from succeeding, without considering the cost of cleaning up the damages incurred by successful attacks. This motivates us to investigate a new resource allocation problem formulated in this paper: The defender must decide how to split its investment between preventive defenses, which aim to harden nodes from attacks, and reactive defenses, which aim to quickly clean up the compromised nodes. This encounters a challenge imposed by the uncertainty associated with the observation, or sensor signal, whether a node is truly compromised or not; this uncertainty is real because attack detectors are not perfect. We investigate how the quality of sensor signals impacts the defender's strategic investment in the two types of defense, and ultimately the level of security that can be achieved. In particular, we show that the optimal investment in preventive resources increases, and thus reactive resource investment decreases, with higher sensor quality. We also show that the defender's performance improvement, relative to a baseline of no sensors employed, is maximal when the attacker can only achieve low attack success probabilities.