A stochastic model of cyber attacks with imperfect detection

Abstract

This paper introduces a cyber security model with imperfect detection, in which one attacker launches multiple attacks against the target with adjusted strength based on the previous attacking outcome. Several sufficient conditions leading to the usual stochastic order on the first time to observe a truly compromised target, to observe a successful attack and to compromise the target are developed, respectively. The probability for the target to be truly compromised before observing some number of successful attacks is proved to increase (decrease) in the attacking (defense) strength. Monte Carlo simulations are also conducted to empirically illustrate the theoretical results.

Keywords:

• First hitting time
• hidden Markov chain
• stochastic order
• strong dominance
• sub-probability transition matrix

Additional information

Funding

This work was supported by the National Natural Science Foundation of China under Grant 11601303; Guangdong Natural Science Foundation under Grant 2016A030310076.