Work

Shapley value to rank vulnerabilities on attack graphs: Applications to cyberdeception

Year: 2025

Type: article

Abstract: Attack graphs play a vital role in cyber defense by identifying vulnerabilities and potential attack paths that can be exploited by attackers to compromise systems or networks. The ranking of these vulnerabilities (edges) and hosts (nodes) is essential for effective cybersecurity and cyberdeception. It facilitates optimal resource allocation, including the deployment of honeypots, proactive defense measures, efficient incident response, and effective cyberdeception strategies. Additionally, it supports risk management, value-effective defense, timely decision making, compliance requirements, and incident recovery. An understanding of the relative importance of vulnerabilities and hosts can empower organizations to prioritize efforts, allocate resources efficiently, and mitigate risks effectively, thereby enhancing overall cybersecurity posture and protecting critical assets. However, current game-theoretical approaches and those based on centrality measures have limitations. They overlook the interactions between vulnerabilities and the scenario where attack graphs involve multiple targets with varying values or importance. To address these limitations, we propose a cooperative game formulation for attack graphs. By leveraging the Shapley value, we measure the contribution of each vulnerability and utilize this measure for ranking. This approach considers vulnerability interactions and accounts for different target values, resulting in a fair and realistic allocation of importance. We demonstrate the effectiveness of the Shapley value through simulations, showcasing its utility in allocating honeypots and prioritizing vulnerability fixes. Our work contributes to the field by introducing a new centrality measure based on cooperative game theory and highlighting its applications in network security and cyberdeception.Attack graphs, Shapley value, honeypots, cyberdeception, network security, vulnerability.

Source: Journal of Dynamics and Games

DOI: 10.3934/jdg.2025016

Authors: Martin Waffo Kemgne, Olivier Tsemogne, Charles Kamhoua

Institutions: African Institute for Mathematical Sciences, La Rochelle Université, IMT Atlantique, DEVCOM Army Research Laboratory, United States Army Combat Capabilities Development Command

Language: English

Topic: Information and Cyber Security

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: diamond

Funder: Agence Nationale de la Recherche

Award: Formal Concept Analysis: A Smart Tool for Analyzing Complex Data