Tractable Defense against Advanced Persistent Threats in Networked Settings
Mean-field heuristic makes Boolean Dynamical Systems defense against APTs tractable, exactly computing the value function under max-entropy assumptions.
The paper models APT network defense via Boolean Dynamical Systems, capturing attack stealth, noisy IDS observations, lateral movement, and defender hardening trade-offs. Because the emergent value function is computationally intractable with respect to network size, the authors propose a mean-field-inspired heuristic value function. They prove the heuristic is an exact computation under a maximum-entropy state-estimate assumption and numerically evaluate its quality as entropy assumptions are violated.
- Models APT defense with stealth, lateral movement, noisy IDS, and hardening costs
- Optimal value function intractable with network size; heuristic restores tractability
- Heuristic exact when state-estimate distribution maximizes entropy
From the original article
1 min read at arxiv.orgRecently, the theory of Boolean Dynamical Systems was proposed to study the decision theory surrounding the defense of computer networks against Advanced Persistent Threats (APTs).
By Brandon Collins · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.