Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data
This addresses resource allocation challenges for cybersecurity defenders, though it is incremental by applying existing game theory to a specific domain.
The paper tackles the problem of allocating defender resources against uncertain multi-step attacks by developing a game-theoretic methodology using MITRE ATT&CK data, resulting in optimized defender policies and resource allocation strategies as demonstrated with APT3 evaluation data.
Protecting against multi-step attacks of uncertain duration and timing forces defenders into an indefinite, always ongoing, resource-intensive response. To effectively allocate resources, a defender must be able to analyze multi-step attacks under assumption of constantly allocating resources against an uncertain stream of potentially undetected attacks. To achieve this goal, we present a novel methodology that applies a game-theoretic approach to the attack, attacker, and defender data derived from MITRE's ATT&CK Framework. Time to complete attack steps is drawn from a probability distribution determined by attacker and defender strategies and capabilities. This constraints attack success parameters and enables comparing different defender resource allocation strategies. By approximating attacker-defender games as Markov processes, we represent the attacker-defender interaction, estimate the attack success parameters, determine the effects of attacker and defender strategies, and maximize opportunities for defender strategy improvements against an uncertain stream of attacks. This novel representation and analysis of multi-step attacks enables defender policy optimization and resource allocation, which we illustrate using the data from MITRE's APT3 ATT&CK Evaluations.