Moving Target Defense for Web Applications using Bayesian Stackelberg Games: (Extended Abstract)
Satya Gautam Vadlamudia b, Sailik Senguptaa b, Marthony Taguinoda c, Ziming Zhaoa b, Adam Doupéa d, Gail‐Joon Ahna e, Subbarao Kambhampati Ba e
- aArizona State University, Tempe, AZ, USA
- bArizona State University**
- cComputing, Informatics and Decision Systems Engineering, School of (CIDSE)
- dIAFSE-CIDSE: Computer Science and Engineering
- eIAFSE-CIDSE: Information Assurance Center (IA)
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
Vulnerabilities in web applications allow hackers to access and/or modify restricted data. Here the hackers have the opportunity to perform reconnaissance so as to gain knowledge about the web application layout before launching an attack, whereas the defender (administrator of the web application) must secure the application even with its potential vulnerabilities. In order to mask such vulnerabilities which are primarily associated with different individual configurations, Moving Target Defense systems were proposed wherein the defender switches between various configurations thereby making it difficult to attack with success, while maintaining a seamless experience for the genuine users. In this paper, we present a way to find effective switching strategies by modeling this ecosystem as a Bayesian Stackelberg game with the administrator as the leader and the hackers as the followers, which as we show succinctly captures various aspects of the Moving Target Defense systems. Furthermore, we propose ways to find the most critical vulnerabilities and the most sensitive attacker types, which are key issues in such scenarios.
TL;DRThis paper presents a way to find effective switching strategies by modeling this ecosystem as a Bayesian Stackelberg game with the administrator as the leader and the hackers as the followers, which succinctly captures various aspects of the Moving Target Defense systems. (Semantic Scholar)