Proactive Defense Against Physical Denial of Service Attacks Using Poisson Signaling Games

Abstract

While the Internet of things (IoT) promises to improve areas such as energy efficiency, health care, and transportation, it is highly vulnerable to cyberattacks. In particular, distributed denial-of-service (DDoS) attacks overload the bandwidth of a server. But many IoT devices form part of cyber-physical systems (CPS). Therefore, they can be used to launch “physical” denial-of-service attacks (PDoS) in which IoT devices overflow the “physical bandwidth” of a CPS. In this paper, we quantify the population-based risk to a group of IoT devices targeted by malware for a PDoS attack. In order to model the recruitment of bots, we develop a “Poisson signaling game,” a signaling game with an unknown number of receivers, which have varying abilities to detect deception. Then we use a version of this game to analyze two mechanisms (legal and economic) to deter botnet recruitment. Equilibrium results indicate that (1) defenders can bound botnet activity, and (2) legislating a minimum level of security has only a limited effect, while incentivizing active defense can decrease botnet activity arbitrarily. This work provides a quantitative foundation for proactive PDoS defense.

Q. Zhu—This work is partially supported by an NSF IGERT grant through the Center for Interdisciplinary Studies in Security and Privacy (CRISSP) at New York University, by the grant CNS-1544782, EFRI-1441140, and SES-1541164 from National Science Foundation (NSF) and DE-NE0008571 from the Department of Energy.

Appendices

A    Simplification of Sender Expected Utility

Each each component of c is distributed according to a Poisson r.v. The components are independent, so Recall that S receives zero utility when he plays $m=w.$ So we can choose $m=p$:

Some of the probability terms can be summed over their support. We are left with

(15)

The last summation is the expected value of $c_{a},$ which is $\lambda _{a}.$ This yields Eq. (7).

B    Proof of Theorem 1

The proofs for the status quo and resistant attacker equilibria are similar to the proof for Lemma 1. The vulnerable attacker equilibrium is a partially-separating PBNE. Strategies $\sigma _{o}^{R*}(g\,|\,p,b)$ and $\sigma _{v}^{R*}(g\,|\,p,b)$ which satisfy Eq. (13) make malicious senders exactly indifferent between $m=p$ and $m=w.$ Thus, they can play the mixed-strategy in Eq. (14), which makes strong and active receivers exactly indifferent between $a=g$ and $a=t.$ The proof of the vulnerable attacker equilibrium follows a similar logic.