Tractable Defense against Advanced Persistent Threats in Networked Settings

2026-09-14

AI Summary

该研究使用基于平均场分析的启发式价值函数解决网络环境下针对高级持续性威胁的防御问题，以克服现有方法计算上的不可行性。

Abstract

Recently, the theory of Boolean Dynamical Systems was proposed to study the decision theory surrounding the defense of computer networks against Advanced Persistent Threats (APTs). Boolean Dynamical Systems naturally capture four first principle primitives of APTs: the stealthy nature of attacks, limited and noisy information from automated systems like intrusion detection systems, lateral movement after the attacker penetrates into the network, and the defender's ability to secure a subset of computers at any time at the loss of resources such as system uptime. Currently, doing optimal/heuristic control in a computationally tractable manner is not possible because the emergent value function is computationally intractable (with respect to the network size). To resolve this, we propose a mean-field analysis inspired heuristic value function. We prove that our proposed heuristic is based on an exact computation of the value function under the assumption that the underlying state estimate distribution maximizes entropy. We numerically evaluate the quality of our heuristic as parameterized by the degree to which the entropy assumptions are violated.

Problem

• Advanced Persistent Threats
• Boolean Dynamical Systems
• network defense

Innovation

• Mean-field analysis
• Heuristic value function
• Entropy maximization
• Advanced Persistent Threats (APTs)