arXiv subjects

Shana Moothedath

Publications and source records attributed to Shana Moothedath.

32 records · Page 2Linked to original sources

arXiv2021

A Reinforcement Learning Approach for Dynamic Information Flow Tracking Games for Detecting Advanced Persistent Threats

Advanced Persistent Threats (APTs) are stealthy attacks that threaten the security and privacy of sensitive information. Interactions of APTs with victim system introduce information flows that are recorded in the system logs. Dynamic Information Flow Tracking (DIFT) is a promising detection mechanism for detecting APTs. DIFT taints information flows originating at system entities that are susceptible to an attack, tracks the propagation of the tainted flows, and authenticates the tainted flows at certain system components according to a pre-defined security policy. Deployment of DIFT to defend against APTs in cyber systems is limited by the heavy resource and performance overhead associated with DIFT. In this paper, we propose a resource-efficient model for DIFT by incorporating the security costs, false-positives, and false-negatives associated with DIFT. Specifically, we develop a game-theoretic framework and provide an analytical model of DIFT that enables the study of trade-off between resource efficiency and the effectiveness of detection. Our game model is a nonzero-sum, infinite-horizon, average reward stochastic game. Our model incorporates the information asymmetry between players that arises from DIFT's inability to distinguish malicious flows from benign flows and APT's inability to know the locations where DIFT performs a security analysis. Additionally, the game has incomplete information as the transition probabilities (false-positive and false-negative rates) are unknown. We propose a multiple-time scale stochastic approximation algorithm to learn an equilibrium solution of the game. We prove that our algorithm converges to an average reward Nash equilibrium. We evaluate our proposed model and algorithm on a real-world ransomware dataset and validate the effectiveness of the proposed approach.

math.OC↗

arXiv2021

Stochastic Dynamic Information Flow Tracking Game using Supervised Learning for Detecting Advanced Persistent Threats

Advanced persistent threats (APTs) are organized prolonged cyberattacks by sophisticated attackers. Although APT activities are stealthy, they interact with the system components and these interactions lead to information flows. Dynamic Information Flow Tracking (DIFT) has been proposed as one of the effective ways to detect APTs using the information flows. However, wide range security analysis using DIFT results in a significant increase in performance overhead and high rates of false-positives and false-negatives generated by DIFT. In this paper, we model the strategic interaction between APT and DIFT as a non-cooperative stochastic game. The game unfolds on a state space constructed from an information flow graph (IFG) that is extracted from the system log. The objective of the APT in the game is to choose transitions in the IFG to find an optimal path in the IFG from an entry point of the attack to an attack target. On the other hand, the objective of DIFT is to dynamically select nodes in the IFG to perform security analysis for detecting APT. Our game model has imperfect information as the players do not have information about the actions of the opponent. We consider two scenarios of the game (i) when the false-positive and false-negative rates are known to both players and (ii) when the false-positive and false-negative rates are unknown to both players. Case (i) translates to a game model with complete information and we propose a value iteration-based algorithm and prove the convergence. Case (ii) translates to a game with unknown transition probabilities. In this case, we propose Hierarchical Supervised Learning (HSL) algorithm that integrates a neural network, to predict the value vector of the game, with a policy iteration algorithm to compute an approximate equilibrium. We implemented our algorithms on real attack datasets and validated the performance of our approach.

cs.GT↗

arXiv2021

Dynamic Information Flow Tracking for Detection of Advanced Persistent Threats: A Stochastic Game Approach

Advanced Persistent Threats (APTs) are stealthy customized attacks by intelligent adversaries. This paper deals with the detection of APTs that infiltrate cyber systems and compromise specifically targeted data and/or infrastructures. Dynamic information flow tracking is an information trace-based detection mechanism against APTs that taints suspicious information flows in the system and generates security analysis for unauthorized use of tainted data. In this paper, we develop an analytical model for resource-efficient detection of APTs using an information flow tracking game. The game is a nonzero-sum, turn-based, stochastic game with asymmetric information as the defender cannot distinguish whether an incoming flow is malicious or benign and hence has only partial state observation. We analyze equilibrium of the game and prove that a Nash equilibrium is given by a solution to the minimum capacity cut set problem on a flow-network derived from the system, where the edge capacities are obtained from the cost of performing security analysis. Finally, we implement our algorithm on the real-world dataset for a data exfiltration attack augmented with false-negative and false-positive rates and compute an optimal defender strategy.

cs.GT↗

arXiv2019

Minimum Cost Feedback Selection in Structured Systems: Hardness and Approximation Algorithm

In this paper, we study output feedback selection in linear time-invariant structured systems. We assume that the inputs and the outputs are dedicated, i.e., each input directly actuates a single state and each output directly senses a single state. Given a structured system with dedicated inputs and outputs and a cost matrix that denotes the cost of each feedback connection, our aim is to select an optimal set of feedback connections such that the closed-loop system satisfies arbitrary pole-placement. This problem is referred to as the optimal feedback selection problem for dedicated i/o. We first prove the NP-hardness of the problem using a reduction from a well known NP-hard problem, the weighted set cover problem. In addition, we also prove that the optimal feedback selection problem for dedicated i/o is inapproximable to a constant factor of log n, where n denotes the system dimension. To this end, we propose an algorithm to find an approximate solution to the optimal feedback selection problem for dedicated i/o. The proposed algorithm consists of a potential function incorporated with a greedy scheme and attains a solution with a guaranteed approximation ratio. Then we consider two special network topologies of practical importance, referred to as back-edge feedback structure and hierarchical networks. For the first case, which is NP-hard and inapproximable to a multiplicative factor of log n, we provide a (log n)-approximate solution, where n denotes the system dimension. For hierarchical networks, we give a dynamic programming based algorithm to obtain an optimal solution in polynomial time.

math.OC↗

arXiv2019

Verification and Design of Resilient Closed-Loop Structured System

This paper addresses the resilience of large-scale closed-loop structured systems in the sense of arbitrary pole placement when subject to failure of feedback links. Given a structured system with input, output, and feedback matrices, we first aim to verify whether the closed-loop structured system is resilient to simultaneous failure of any subset of feedback links of a specified cardinality. Subsequently, we address the associated design problem in which given a structured system with input and output matrices, we need to design a sparsest feedback matrix that ensures the resilience of the resulting closed-loop structured system to simultaneous failure of any subset of feedback links of a specified cardinality. We first prove that the verification problem is NP-complete even for irreducible systems and the design problem is NP-hard even for so-called structurally cyclic systems. We also show that the design problem is inapproximable to factor (1-o(1))log n, where n denotes the system dimension. Then we propose algorithms to solve both the problems: a pseudo-polynomial algorithm to address the verification problem of irreducible systems and a polynomial-time O(log n)-optimal approximation algorithm to solve the design problem for a special feedback structure, so-called back-edge feedback structure.

math.OC↗

arXiv2019

Minimizing Inputs for Strong Structural Controllability

The notion of strong structural controllability (s-controllability) allows for determining controllability properties of large linear time-invariant systems even when numerical values of the system parameters are not known a priori. The s-controllability guarantees controllability for all numerical realizations of the system parameters. We address the optimization problem of minimal cardinality input selection for s-controllability. Previous work shows that not only the optimization problem is NP-hard, but finding an approximate solution is also hard. We propose a randomized algorithm using the notion of zero forcing sets to obtain an optimal solution with high probability. We compare the performance of the proposed algorithm with a known heuristic [1] for synthetic random systems and five real-world networks, viz. IEEE 39-bus system, re-tweet network, protein-protein interaction network, US airport network, and a network of physicians. It is found that our algorithm performs much better than the heuristic in each of these cases.

math.OC↗

arXiv2018

A Game Theoretic Approach for Dynamic Information Flow Tracking to Detect Multi-Stage Advanced Persistent Threats

Advanced Persistent Threats (APTs) infiltrate cyber systems and compromise specifically targeted data and/or resources through a sequence of stealthy attacks consisting of multiple stages. Dynamic information flow tracking has been proposed to detect APTs. In this paper, we develop a dynamic information flow tracking game for resource-efficient detection of APTs via multi-stage dynamic games. The game evolves on an information flow graph, whose nodes are processes and objects (e.g. file, network endpoints) in the system and the edges capture the interaction between different processes and objects. Each stage of the game has pre-specified targets which are characterized by a set of nodes of the graph and the goal of the APT is to evade detection and reach a target node of that stage. The goal of the defender is to maximize the detection probability while minimizing performance overhead on the system. The resource costs of the players are different and the information structure is asymmetric resulting in a nonzero-sum imperfect information game. We first calculate the best responses of the players and characterize the set of Nash equilibria for single stage attacks. Subsequently, we provide a polynomial-time algorithm to compute a correlated equilibrium for the multi-stage attack case. Finally, we experiment our model and algorithms on real-world nation state attack data obtained from Refinable Attack Investigation system.

cs.GT↗

arXiv2018

Optimal Network Topology Design in Composite Systems with Constrained Neighbors for Structural Controllability

Composite systems are large complex systems con- sisting of interconnected agents (subsystems). Agents in a com- posite system interact with each other towards performing an in- tended goal. Controllability is essential to achieve desired system performance in linear time-invariant composite systems. Agents in a composite system are often uncontrollable individually, further, only a few agents receive input. In such a case, the agents share/communicate their private state information with pre-specified neighboring agents so as to achieve controllability. Our objective in this paper is to identify an optimal network topology, optimal in the sense of minimum cardinality information transfer between agents to guarantee the controllability of the composite system when the possible neighbor set of each agent is pre-specified. We focus on graph-theoretic analysis referred to as structural controllability as numerical entries of system matrices in complex systems are mostly unknown. We first prove that given a set of agents and the possible set of neighbors, finding a minimum cardinality set of information (interconnections) that must be shared to accomplish structural controllability of the composite system is NP-hard. Subsequently, we present a polynomial-time algorithm that finds a 2-optimal solution to this NP-hard problem. Our algorithm combines a minimum weight bipartite matching algorithm and a minimum spanning tree algorithm and gives a subset of interconnections which when established guarantees structural controllability, such that the worst-case performance is 2-optimal. Finally, we show that our approach directly extends to weighted constrained optimal net- work topology design problem and constrained optimal network topology design problem in switched linear systems.

math.OC↗

arXiv2018

Approximating Constrained Minimum Cost Input-Output Selection for Generic Arbitrary Pole Placement in Structured Systems

This paper is about minimum cost constrained selection of inputs and outputs for generic arbitrary pole placement. The input-output set is constrained in the sense that the set of states that each input can influence and the set of states that each output can sense is pre-specified. Our goal is to optimally select an input-output set that the system has no structurally fixed modes. Polynomial algorithms do not exist for solving this problem unless P=NP. To this end, we propose an approximation algorithm by splitting the problem in to three sub-problems: a) minimum cost accessibility problem, b) minimum cost sensability problem and c) minimum cost disjoint cycle problem. We prove that problems a) and b) are equivalent to a suitably defined weighted set cover problems. We also show that problem c) is equivalent to a minimum cost perfect matching problem. Using these we give an approximation algorithm which solves the minimum cost generic arbitrary pole placement problem. The proposed algorithm incorporates an approximation algorithm to solve the weighted set cover problem for solving a) and b) and a minimum cost perfect matching algorithm to solve c). Further, we show that the algorithm is polynomial time an gives an order optimal solution to the minimum cost input-output selection for generic arbitrary pole placement problem.

math.OC↗

arXiv2017

Optimal Selection of Interconnections in Composite Systems for Structural Controllability

In this paper, we study structural controllability of a linear time invariant (LTI) composite system consisting of several subsystems. We assume that the neighbourhood of each subsystem is unconstrained, i.e., any subsystem can interact with any other subsystem. The interaction links between subsystems are referred as interconnections. We assume the composite system to be structurally controllable if all possible interconnections are present, and our objective is to identify the minimum set of interconnections required to keep the system structurally controllable. We consider structurally identical subsystems, i.e., the zero/non-zero pattern of the state matrices of the subsystems are the same, but dynamics can be different. We present a polynomial time optimal algorithm to identify the minimum cardinality set of interconnections that subsystems must establish to make the composite system structurally controllable.

math.OC↗

arXiv2017

Rapidly Mixing Markov Chain Monte Carlo Technique for Matching Problems with Global Utility Function

This paper deals with a complete bipartite matching problem with the objective of finding an optimal matching that maximizes a certain generic predefined utility function on the set of all matchings. After proving the NP-hardness of the problem using reduction from the 3-SAT problem, we propose a randomized algorithm based on Markov Chain Monte Carlo (MCMC) technique for solving this. We sample from Gibb's distribution and construct a reversible positive recurrent discrete time Markov chain (DTMC) that has the steady state distribution same as the Gibb's distribution. In one of our key contributions, we show that the constructed chain is `rapid mixing', i.e., the convergence time to reach within a specified distance to the desired distribution is polynomial in the problem size. The rapid mixing property is established by obtaining a lower bound on the conductance of the DTMC graph and this result is of independent interest.

cs.DM↗

arXiv2017

Optimal Feedback Selection for Structurally Cyclic Systems with Dedicated Actuators and Sensors

This paper solves the sparsest feedback selection problem for linear time invariant structured systems, a long-standing open problem in structured systems. We consider structurally cyclic systems with dedicated inputs and outputs. We prove that finding a sparsest feedback selection is of linear complexity for the case of structurally cyclic systems with dedicated inputs and outputs. This problem has received attention recently but key errors in the hardness-proofs have resulted in an erroneous conclusion there. This is also elaborated in this brief paper together with a counter-example.

math.OC↗

arXiv2017

Minimum Cost Feedback Selection for Arbitrary Pole Placement in Structured Systems

This paper addresses optimal feedback selection for generic arbitrary pole placement of structured systems when each feedback edge is associated with a cost. Given a structured system and a feedback cost matrix, our aim is to find a feasible feedback matrix of minimum cost that guarantees arbitrary pole placement of the closed-loop structured system. We first give a polynomial time reduction of the weighted set cover problem to an instance of the feedback selection problem and thereby show that the problem is NP-hard. Then we prove the inapproximability of the problem by showing that constant factor approximation for the problem does not exist unless the set cover problem can be approximated within a constant factor. Since the problem is hard, we study a subclass of systems whose directed acyclic graph constructed using the strongly connected components of the state digraph is a line graph and the state bipartite graph has a perfect matching. We propose a polynomial time optimal algorithm based on dynamic programming for solving the problem on this class of systems. Further, over the same class of systems we relax the perfect matching assumption, and provide a polynomial time 2-optimal solution based on dynamic programming and a minimum cost perfect matching algorithm.

math.OC↗

arXiv2017

Approximating Constrained Minimum Input Selection for State Space Structural Controllability

This paper looks at two problems, minimum constrained input selection and minimum cost constrained input selection for state space structured systems. The input matrix is constrained in the sense that the set of states that each input can influence is pre-specified and each input has a cost associated with it. Our goal is to optimally select an input set from the set of inputs given that the system is controllable. These problems are known to be NP-hard. Firstly, we give a new necessary and sufficient graph theoretic condition for checking structural controllability using flow networks. Using this condition we give a polynomial reduction of both these problems to a known NP-hard problem, the minimum cost fixed flow problem (MCFF). Subsequently, we prove that an optimal solution to the MCFF problem corresponds to an optimal solution to the original controllability problem. We also show that approximation schemes of MCFF directly applies to minimum cost constrained input selection problems. Using the special structure of the flow network constructed for the structured system, we give a polynomial approximation algorithm based on minimum weight bipartite matching and a greedy selection scheme for solving MCFF on system flow network. The proposed algorithm gives a $Δ$-approximate solution to MCFF, where $Δ$ denotes the maximum in-degree of input vertices in the flow network of the structured system.

math.OC↗