Advanced persistent threat intelligent lateral movement behavior game method

Abstract

The invention provides an advanced persistent threat intelligent lateral movement behavior game method, and relates to the technical field of network security, and the method comprises the steps: constructing an undirected graph corresponding to an organization, the undirected graph comprising a plurality of organization nodes; classifying the institution nodes into a target node, a common node, a high-level employee node and an administrator node; constructing an attack and defense interaction model of the attacker and the defender based on the discrete time step set, and obtaining states and action spaces of the attacker and the defender and strategy spaces of the defender and the attacker based on the attack and defense interaction model; and obtaining rewards of the attacker and the defender based on a game ending condition, calculating a value function of the attacker and the defender, and obtaining a Nash equilibrium strategy of the attacker and the defender. According to the method, the game theory is applied to APT lateral movement behavior modeling, the worst situation is considered from the perspective of defenders, the defenders determine the nodes for security examination according to the current state, detection is more efficient, and the defense strategy is more robust.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an advanced persistent threat intelligent lateral movement behavior game method. Background Art

[0002] Advanced persistent threats (APTs) are a type of covert and highly complex cyberattacks. The attackers are usually well-funded and technologically advanced. Their common purpose is to steal confidential data from large organizations (large enterprises, government departments, military bases, etc.), destroy critical infrastructure, etc. Compared with traditional cyberattacks, APT attacks have the characteristics of a high penetration success rate. Once an APT attacker has established a foothold in the intranet of an organization, such as installing a backdoor, he will try to approach the target nodes through lateral movement - the most valuable nodes in the organization, such as various servers - in order to steal key data and information from these nodes. Due to its extremely strong concealment, it is usually difficult for organizations to detect APT attacks, so APT attackers can lurk inside the organization for a long time, which poses a serious threat to modern organizations.

[0003] Most existing APT defense solutions usually assume that the attacker's lateral movement behavior conforms to certain assumptions, for example, an undamaged node will become damaged at a certain rate due to the influence of adjacent damaged nodes. Although existing work also considers that the rate of APT lateral movement is controllable, in practice, the capabilities of APT attackers may still be underestimated, because they can effectively evade the defender's detection by designing more intelligent lateral movement strategies, thereby successfully approaching and invading the target nodes in the organization.

[0004] Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide an advanced persistent threat intelligent lateral movement behavior game method to improve the problem of low defense effectiveness of the prior art in solving APT problems.

[0006] The present invention provides an advanced persistent threat intelligent lateral movement behavior game method, which adopts the following technical solutions:

[0007] Constructing an undirected graph corresponding to the organizational structure, wherein the undirected graph includes a plurality of organizational nodes;

[0008] Classifying the organization nodes into target nodes, common nodes, senior staff nodes and administrator nodes;

[0009] Constructing an attack-defense interaction model of the attacker and the defender based on a discrete time step set, and obtaining the state and action space of the attacker and the defender, the strategy space of the defender, and the strategy space of the attacker based on the attack-defense interaction model;

[0010] Based on the game end conditions, the rewards of the attacker and the defender are obtained, and the value functions of the attacker and the defender are calculated to obtain the Nash equilibrium strategies of the attacker and the defender.

[0011] The beneficial effect of the advanced persistent threat intelligent lateral movement behavior game method provided by the present invention is that the present invention applies game theory to APT lateral movement behavior modeling, considers the worst case from the perspective of the defender: the APT attacker may adopt the most efficient attack strategy, establishes a game theory mathematical model, and characterizes the strategic interaction process between the APT attacker and the defender. When building a defense strategy, it may be inefficient to always select the most important target nodes for security review, because it may cost a lot to carefully review these nodes. In the present invention, the defender determines the nodes for security review based on the current state, and the detection is more efficient. In addition, because the worst case is taken into account, the defender's defense strategy can be made more robust.

[0012] Optionally, the organization structure includes 13 nodes, including nodes 1 to 13, which are represented as an undirected graph G=(V, E), wherein the mathematical expressions of the node set and the edge set are:

[0013] V={v 1 ,…,v 13};

[0014]

[0015] Where V = {v 1 ,…,v N} is the node set, E is the edge set, {v i ,v j}∈E means that node i can communicate with node j through the intranet.

[0016] Optionally, among the 13 nodes, No. 1-6 are ordinary nodes, corresponding to ordinary employees of the organization, No. 7-9 are senior employee nodes, corresponding to senior employees of the organization, No. 10-11 are administrator nodes, corresponding to administrators of the organization, and No. 12-13 are target nodes.

[0017] Optionally, the process of constructing an attack-defense interaction model of the attacker and defender based on a set of discrete time steps includes:

[0018] The attacker successfully penetrates a node of the organization through reconnaissance and spear-phishing emails at the initial time step and uses it as the initial penetration node for lateral movement. Then, the attacker selects a target node and moves laterally through the shortest path from the initial penetration node to the target node at each subsequent time step.

[0019] The defender selects a node for security review at each time step. When the attacker and defender arrive at the same damaged node at the same time, the defender captures the attacker and restores the damaged node to a safe state.

[0020] Optionally, the state space and action space of the defender include:

[0021]

[0022] in, represents the defender state, t represents the time step, and h t represents the historical review node sequence up to time t, Indicates the defender's action, A def =V represents the defender's action space.

[0023] Optionally, at time t=0, The defender's status is The defender can select one of the nodes for security review. The defender’s action space is A. def =V, if at time t = 0, the defender decides to censor node v 7 , then the defender's state at time t = 1 becomes

[0024] Optionally, the specific process of obtaining the attacker's state space and action space includes: the attacker selects a target node after gaining control of the initial penetration node, and the attacker's state space is a set of non-target nodes The action space is the target node set V′, where the mathematical expressions of the non-target node set and the target node set are:

[0025] V′={v 12 ,v 13};

[0026]

[0027] Among them, v 12 ,v 13 represents the target nodes 12 and 13, {v 1 ,…,v 11} represents nodes 1-11, and \ represents set subtraction operation.

[0028] Optionally, the defender's strategy space includes: Let π def :S def →Δ(A def ) is the defender’s strategy, defined as a mapping from state space to action space probability distribution, with π def ∈Π def , where Πdef represents the defender’s strategy space, S def represents the state space of the defender, Δ(A def ) represents the probability distribution of the defender’s action space;

[0029] The attacker's strategy space includes: Let π att : The attacker's strategy is to determine the attacker's target node at time t = 0, and then select a shortest path p from the initial penetration node to the target node. att For lateral movement, there is π att ∈Π att , where Π att represents the attacker’s strategy space, represents the set of non-target nodes, and Δ(V′) represents the probability distribution over the set V′.

[0030] Optionally, the process of obtaining rewards for the attacker and the defender based on the game end condition includes:

[0031] The defender captures the attacker within the preset maximum time step, and at the current time, the defender's state space is equal to the attacker's action space. If the current time is less than the game deadline, the attacker and defender's rewards are both 0. If the current time is equal to the game deadline, the defender receives a positive reward. Attackers are punished

[0032] The attacker reaches the selected target node within the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. The attacker gets a positive reward

[0033] The game time reaches the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. The attacker gets a positive reward

[0034] Optionally, the mathematical expression of the value function is:

[0035]

[0036] Among them, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy πdef and the value function of the defender and the attacker when the attacker selects the target node v′, T represents the maximum time step, represents the reward obtained by the defender at time t, represents the reward obtained by the attacker at time t, and the expectation Through the defender strategy π def The multiple interaction trajectories generated under a given target node v′ are calculated. For a given attack and defense strategy combination (π def ,π att ), the mathematical expression of the value function of the attacker and the defender is:

[0037]

[0038] The mathematical expression of Nash equilibrium is:

[0039]

[0040] Among them, V def (π def ,π att ) and V att (π def ,π att ) respectively represent the attack and defense strategy combinations in a given def ,π att ) under the value function of the defender and the attacker, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy π def and the value function of the defender and the attacker when the attacker chooses the target node v′, and Respectively represent the equilibrium strategy portfolio The value functions of the defender and attacker are: Indicates that the attacker adopts a balanced strategy and the defender adopts any strategy π def The value function of the defender is Indicates that the defender adopts an equilibrium strategy and the attacker adopts an arbitrary strategy π att The attacker's value function. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flow chart showing an advanced persistent threat intelligent lateral movement behavior game method provided by the present invention;

[0042] Figure 2 A schematic diagram of the game between the attacker and the defender during the APT lateral movement provided by the present invention is shown. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0044] The embodiment of the present invention provides an advanced persistent threat intelligent lateral movement behavior game method, see Figure 1 ,include:

[0045] S1. Construct an undirected graph corresponding to the organizational structure, wherein the undirected graph includes a plurality of organizational nodes;

[0046] S2, classifying the organization nodes into target nodes, common nodes, senior staff nodes and administrator nodes;

[0047] S3. constructing an attack-defense interaction model of the attacker and the defender based on a discrete time step set, and obtaining the state space and action space of the attacker and the defender, and the strategy space of the attacker and the defender based on the attack-defense interaction model;

[0048] S4. Obtain the rewards of the attacker and defender based on the game end conditions, calculate the value functions of both parties, and obtain the Nash equilibrium strategies of both parties.

[0049] In some embodiments, when executing step S1, the organization includes 13 nodes, including nodes 1-13, represented as an undirected graph G=(V, E), wherein the mathematical expressions of the node set and the edge set are:

[0050] V={v 1 ,…,v 13};

[0051]

[0052] Where V = {v 1 ,…,v N} is the node set, E is the edge set, {v i ,v j}∈E means that node i can communicate with node j through the intranet.

[0053] For details, see Figure 2 , which contains a set of N nodes numbered from 1 to N. Nodes can be divided into different types with different importance, such as ordinary hosts used by ordinary employees to organize daily business, workstations used by senior employees for more complex or critical tasks, and various types of servers that can only be accessed by authorized members (such as administrators). Each node is connected to other nodes through the intranet. Without loss of generality, the organization can be abstracted as a simple undirected graph G = (V, E), where V = {v 1 ,…,v N} is the node set, and E is the edge set. i ,v j}∈E means that node i can communicate with node j through the intranet.

[0054] In some embodiments, when executing step S2 to classify the organizational nodes, among the 13 nodes, No. 1-6 are ordinary nodes, corresponding to ordinary employees of the organization, No. 7-9 are senior employee nodes, corresponding to senior employees of the organization, No. 10-11 are administrator nodes, corresponding to administrators of the organization, and No. 12-13 are target nodes.

[0055] In fact, in an organization, there are multiple important nodes, such as different types of servers. These nodes are used to store the organization's high-value data, perform data analysis, or control critical infrastructure. Therefore, these nodes are often targeted by APT attackers because their main purpose is to steal sensitive information and private data from the organization. Let the set of these target nodes be Although these nodes are attractive to attackers, it is usually difficult for APT attackers to directly infiltrate these target nodes because organizations usually give them more advanced security technologies to resist network attacks; in other words, if these target nodes are attacked directly, the cost of the attack will be very high. Instead, the more common strategy of APT attackers is to first break into some ordinary nodes with relatively weak defense capabilities, such as hosts used by ordinary employees, and then gradually approach the target node by lateral movement.

[0056] In some embodiments, the process of executing step S3 to construct an attack-defense interaction model of the attacker and the defender based on a discrete time step set includes:

[0057] S3-1, the attacker successfully penetrates a node of the organization through reconnaissance and spear-phishing emails at the initial time step and uses it as the initial penetration node for lateral movement, then selects a target node and moves laterally through the shortest path from the initial penetration node to the target node at each subsequent time step;

[0058] S3-2, the defender selects a node for security review at each time step. When the attacker and the defender arrive at the same damaged node at the same time, the defender successfully captures the attacker and restores the damaged node to a safe state.

[0059] Specifically, when executing step S3-1, it is assumed that represents the set of discrete time steps. Let the initial node that the attacker successfully penetrates through social engineering means such as reconnaissance and spear phishing emails be Next, the attacker selects a target node And move laterally through the shortest path from the initial penetration node to the target node, attempting to reach the target node within T time steps, such as Figure 2 Specifically, the attacker Determine the node to which you need to move at each time step.

[0060] Furthermore, when executing step S3-2, the attacker's goal is to satisfy the conditions: t′≤T and That is, reach the target node before the game time ends For the defender, at each time step The defender selects a node Conduct security audits. Once an attacker and defender reach the same node at the same time, the defender can capture the attacker and restore the compromised node to a safe state.

[0061] In fact, if the defender always selects the most important nodes (i.e., the target nodes in V′) for review, the defense efficiency may be relatively low, because on the one hand, it takes a certain amount of time for the attacker to reach the target node, and on the other hand, carefully reviewing these nodes may cost a high cost, such as consuming more computing resources. Therefore, the defender needs to adopt a more efficient node review strategy based on the current state of the system.

[0062] See also Figure 2 , the process of establishing the attack-defense interaction model includes: setting the maximum time step to T = 10. Figure 2 As shown in (b), assuming that the attacker's initial penetration node is node 4, that is, The target node selected by the attacker is node 12, that is, The attacker uses the shortest path p att =(v 4 ,v 7 ,v 10 ,v 12 ) determines the node to move to at each time step. The defender selects a node for security review based on the current state.

[0063] In some embodiments, when executing step S3, the state space and action space of the defender include:

[0064]

[0065] in, represents the defender state, t represents the time step, and h t represents the historical review node sequence up to time t, Indicates the defender's action, A def =V represents the defender's action space.

[0066] Specifically, at time t=0, since the defender has no historical review nodes, The defender's state is In this state, the defender can select one of the nodes for security review, so the defender’s action space is A def = V. Suppose at time t = 0, the defender decides to censor node v 7 , then the defender's state at time t = 1 becomes

[0067] In some embodiments, when executing step S3, the specific process of obtaining the attacker's state space and action space includes: the attacker selects a target node after obtaining control of the initial penetration node, and the attacker's state space is a set of non-target nodes. The action space is the target node set V′, where the mathematical expression is:

[0068] V′={v 12 ,v 13};

[0069]

[0070] Among them, v 12 ,v 13 represents the target nodes 12 and 13, {v 1 ,…,v 11} represents nodes 1-11, and \ represents set subtraction operation.

[0071] In some embodiments, when executing step S3, the defender's strategy space includes: assuming π def :S def →Δ(A def ) is the defender’s strategy, defined as a mapping from state space to action space probability distribution, with π def ∈Π def , where Π def represents the defender’s strategy space, S defrepresents the state space of the defender, and Δ(A def ) represents the probability distribution on the action space of the defender;

[0072] The strategy space of the attacker includes: Let π att : be the strategy of the attacker. At time t = 0, determine the target node of the attacker, and then select a shortest path p from the initial penetration node to the target node att for lateral movement. There is π att ∈Π att , where Π att represents the strategy space of the attacker, represents the set of non-target nodes, and Δ(V′) represents the probability distribution on the set V′.

[0073] In some embodiments, when performing step S4, the process of obtaining the rewards of the attacker and the defender based on the game end condition includes:

[0074] 1) The defender captures the attacker within the preset maximum time step T, and when the state space of the defender is equal to the action space of the attacker at the current time t, if the current time t is less than the game cut-off time t′, the rewards of both the attacker and the defender are 0. If the current time t is equal to the game cut-off time t′, the defender obtains a positive reward and the attacker is punished

[0075] 2) The attacker reaches the selected target node within the preset maximum time step T. If the current time t is less than the game cut-off time t′, the rewards of both the attacker and the defender are 0. If the current time t is equal to the game cut-off time t′, then the defender is punished and the attacker obtains a positive reward

[0076] 3) The game time reaches the preset maximum time step T. If the current time t is less than the game cut-off time t′, the rewards of both the attacker and the defender are 0. If the current time t is equal to the game cut-off time t′, the defender is punished and the attacker obtains a positive reward

[0077] Specifically, the preset maximum time step is T = 10. For t < t′, the attacker and the defender

[0078] receive a reward of 0, that is when t = t′, for end condition 1), the defender can obtain a positive reward Because the defender successfully captured the attacker, e.g. Figure 2 (c) For the ending conditions 2) and 3), the defender is penalized The attacker gets a positive reward Because the attacker successfully evades the defender's detection or successfully reaches the target node v within a given time 12 ,like Figure 2 (d) is shown, that is,

[0079] In some embodiments, when executing step S4, given the target node The mathematical expression of the value function is:

[0080]

[0081] Among them, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy π def and the value function of the defender and the attacker when the attacker selects the target node v′, T represents the maximum time step, represents the reward obtained by the defender at time t, represents the reward obtained by the attacker at time t, and the expectation Through the defender strategy π def The multiple interaction trajectories generated under a given target node v′ are calculated. For a given attack and defense strategy combination (π def ,π att ), the mathematical expression of the value function of the attacker and the defender is:

[0082]

[0083] Furthermore, according to the value functions of the attacker and the defender, we can get the Nash equilibrium strategy combination of the attacker and the defender: The mathematical expression is:

[0084]

[0085] Among them, V def (π def ,π att ) and V att (π def ,π att ) respectively represent the attack and defense strategy combinations in a given def ,π att ) under the value function of the defender and the attacker, V def (πdef ,v′) and V att (π def ,v′) represent the given defender strategy π def and the value function of the defender and the attacker when the attacker chooses the target node v′, and Respectively represent the equilibrium strategy portfolio The value functions of the defender and attacker are: Indicates that the attacker adopts a balanced strategy and the defender adopts any strategy π def The value function of the defender is Indicates that the defender adopts an equilibrium strategy and the attacker adopts an arbitrary strategy π att The attacker's value function.

[0086] Under the above conditions, neither the attacker nor the defender can achieve higher expected returns by unilaterally changing their own strategies.

[0087] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. An advanced persistent threat intelligent lateral movement behavior game method, characterized in that: include: Constructing an undirected graph corresponding to the organizational structure, wherein the undirected graph includes a plurality of organizational nodes; Classifying the organization nodes into target nodes, common nodes, senior staff nodes and administrator nodes; Constructing an attack-defense interaction model of the attacker and the defender based on a discrete time step set, and obtaining the state space and action space of the attacker and the defender, and the strategy space of the attacker and the defender based on the attack-defense interaction model; Based on the game end conditions, the rewards of the attacker and the defender are obtained, and the value functions of the attacker and the defender are calculated to obtain the Nash equilibrium strategies of the attacker and the defender.

2. According to claim 1, an advanced persistent threat intelligent lateral movement behavior game method is characterized in that: The organization structure includes 13 nodes, including nodes 1 to 13, which are represented as an undirected graph G=(V, E), where the mathematical expressions of the node set and the edge set are: V={v1,…,v 13 }; Where V = {v1,…,v N } is the node set, E is the edge set, {v i ,v j }∈E means that node i can communicate with node j through the intranet.

3. According to claim 2, an advanced persistent threat intelligent lateral movement behavior game method is characterized in that: Among the 13 nodes, No. 1-6 are ordinary nodes, corresponding to ordinary employees of the organization, No. 7-9 are senior employee nodes, corresponding to senior employees of the organization, No. 10-11 are administrator nodes, corresponding to administrators of the organization, and No. 12-13 are target nodes.

4. According to claim 1, an advanced persistent threat intelligent lateral movement behavior game method is characterized in that: The process of constructing the attack-defense interaction model of attackers and defenders based on a set of discrete time steps includes: The attacker successfully penetrates a node of the organization through reconnaissance and spear-phishing emails at the initial time step and uses it as the initial penetration node for lateral movement. Then, the attacker selects a target node and moves laterally through the shortest path from the initial penetration node to the target node at each subsequent time step. The defender selects a node for security review at each time step. When the attacker and defender arrive at the same damaged node at the same time, the defender captures the attacker and restores the damaged node to a safe state.

5. According to claim 1, an advanced persistent threat intelligent lateral movement behavior game method is characterized in that: The state space and action space of the defender include: in, represents the defender state, t represents the time step, and h t represents the historical review node sequence up to time t, Indicates the defender's action, A def =V represents the defender's action space.

6. According to claim 5, an advanced persistent threat intelligent lateral movement behavior game method is characterized in that: At time t = 0, The defender's status is The defender can select one of the nodes for security review. The defender’s action space is A. def =V, if at time t = 0, the defender decides to censor node v7, then the state of the defender at time t = 1 becomes 7. The method for intelligent lateral movement behavior of advanced persistent threats according to claim 1, characterized in that: The specific process of obtaining the attacker's state space and action space includes: the attacker selects a target node after gaining control of the initial penetration node, and the attacker's state space is a set of non-target nodes The action space is the target node set V′, where the mathematical expressions of the non-target node set and the target node set are: V′={v 12 ,v 13 }; Among them, v 12 ,v 13 represents the target nodes 12 and 13, {v1,…,v 11 } represents nodes 1-11, and \ represents set subtraction operation.

8. According to claim 1, an advanced persistent threat intelligent lateral movement behavior game method is characterized in that: The defender's strategy space includes: Let π def :S def →Δ(A def ) is the defender’s strategy, defined as a mapping from state space to action space probability distribution, with π def ∈Π def , where Π def represents the defender’s strategy space, S def represents the state space of the defender, Δ(A def ) represents the probability distribution of the defender’s action space; The attacker's strategy space includes: Let π at t: The attacker's strategy is to determine the attacker's target node at time t = 0, and then select a shortest path p from the initial penetration node to the target node. att For lateral movement, there is π att ∈Π att , where Π att represents the attacker’s strategy space, represents the set of non-target nodes, and Δ(V′) represents the probability distribution over the set V′.

9. The method for intelligent lateral movement behavior of advanced persistent threats according to claim 1, characterized in that: The process of obtaining rewards for the attacker and the defender based on the game end condition includes: The defender captures the attacker within the preset maximum time step, and at the current time, the defender's state space is equal to the attacker's action space. If the current time is less than the game deadline, the attacker and defender's rewards are both 0. If the current time is equal to the game deadline, the defender receives a positive reward. Attackers are punished The attacker reaches the selected target node within the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. The attacker gets a positive reward The game time reaches the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. The attacker gets a positive reward 10. The method for intelligent lateral movement behavior of advanced persistent threats according to claim 1, characterized in that: The mathematical expression of the value function is: Among them, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy π def and the value function of the defender and the attacker when the attacker selects the target node v′, T represents the maximum time step, represents the reward obtained by the defender at time t, represents the reward obtained by the attacker at time t, and the expectation E is obtained through the defender's strategy π def The multiple interaction trajectories generated under a given target node v′ are calculated. For a given attack and defense strategy combination (π def ,π att ), the mathematical expression of the value function of the attacker and the defender is: The mathematical expression of Nash equilibrium is: Among them, V def (π def ,π att ) and V att (π def ,π att ) respectively represent the attack and defense strategy combinations (π def ,π att ) under the value function of the defender and the attacker, V def (π def ,v′) and V att (π def ,v′) distribution represents the given defender strategy π def and the value function of the defender and the attacker when the attacker chooses the target node v′, and Respectively represent the equilibrium strategy portfolio The value functions of the defender and attacker are: They represent the situation when the attacker adopts a balanced strategy. and the defender adopts any strategy π def The value function of the defender is Indicates that the defender adopts an equilibrium strategy and the attacker adopts an arbitrary strategy π att The attacker's value function.

Images