What this work contributes
Models ransomware defense as a multistage game with honeytokens, honeypots, honeyfiles, and network honeypots. The paper uses backward induction to analyze subgame-perfect Nash equilibria and evaluates the defender's choices through a numerical healthcare case study informed by real-world data and statistics.
When to read this work
Read this when analyzing how deception resources can change an attacker's incentives across ransomware stages, or when building game-theoretic models of cyber defense.
Topics: Cybersecurity · Ransomware · Strategic deception · Game theory
Abstract
Ransomware attacks continue to be a major concern for critical systems that are vital for society e.g., healthcare, finance, and transportation. Traditional cyber defense mechanisms fail to pose dynamic measures to stop ransomware attacks from progressing through various stages in the attack process. To this end, intelligent cyber deception strategies can be effective when they leverage information about attacker strategies and deploy deceptive assets to increase the cost or complexity of a successful exploit or discourage continued attacker efforts. In this paper, we present a novel game theoretic approach that uses deception-based defense strategies at each of the ransomware attack stages for optimization of the decision-making to outsmart attacker advances. Specifically, we propose a multistage ransomware game model that deploys a combination of deception assets i.e., honeytokens, honeypots, honeyfiles, and network honeypots in subgames. Using closed-form backward induction, we evaluated Subgame-Perfect Nash Equilibrium (SPNE). We perform a numerical analysis using real-world data and statistics pertaining to the impact of ransomware attacks in the healthcare sector. Our healthcare case study evaluation results show that the use of deception technologies is favorable to the defender. This work elucidates the profound implications of strategic deception in cybersecurity, demonstrating its capacity to complicate successful exploits and consequently bolster the defense of key societal infrastructures.
Cite this work
Download BibTeX · Download RIS
@inproceedings{neupane2024gamesec,
title = {On Countering Ransomware Attacks Using Strategic Deception},
author = {Neupane, Roshan Lal and Bhusal, Bishnu and Neupane, Kiran and Regmi, Preyea and Dinh, Tam and Marrero, Lilliana and Saghaian N. E., Sayed M. and Nadendla, Venkata Sriram Siddhardh and Calyam, Prasad},
editor = {Sinha, Arunesh and Fu, Jie and Zhu, Quanyan and Zhang, Tao},
booktitle = {Decision and Game Theory for Security (GameSec 2024)},
series = {Lecture Notes in Computer Science},
publisher = {Springer Nature Switzerland},
address = {Cham},
pages = {149--176},
year = {2024},
month = oct,
isbn = {978-3-031-74835-6},
doi = {10.1007/978-3-031-74835-6_8},
url = {https://doi.org/10.1007/978-3-031-74835-6_8}
}