Tractable Defense against Advanced Persistent Threats in Networked Settings
Mean-field heuristic makes Boolean Dynamical Systems defense against APTs tractable, exactly computing the value function under max-entropy assumptions.
The paper models APT network defense via Boolean Dynamical Systems, capturing attack stealth, noisy IDS observations, lateral movement, and defender hardening trade-offs. Because the emergent value function is computationally intractable with respect to network size, the authors propose a mean-field-inspired heuristic value function. They prove the heuristic is an exact computation under a maximum-entropy state-estimate assumption and numerically evaluate its quality as entropy assumptions are violated.
22