Defense Strategy Against Man-In-The-Middle Attack Based On Security Game Theory

The man-in-the-middle attack is a common method of cyber attack.The attacker can obtain the sensitive information of users by applying some technologies,that brings certain economic losses and security issues to users.Therefore,it is of great significance to study the man-in-the-middle attack defense problem and it has attracted extensive attention.This paper studies the man-in-the-middle attack defense problem from a novel perspective based on the security game theory.Given that the man-in-the-middle attacks are inevitable,we study how to design the optimal strategy from the perspective of the whole and the individual with the goal of reducing the defender's losses when it suffers from attack.From an overall point of view,the server and all users are considered as a whole which regarded as a defender.The interaction between the attacker and the defender is modeled as a Stackelberg security game,and strong Stackelberg equilibrium is adopted as the defender's optimal defense strategy.In order to compute the optimal defense strategy efficiently,a novel method is proposed to reduce the searching space of computing the optimal defense strategy.From an individual point of view,each user is treated as a defender.The simultaneous-move game is used to model the interaction between multiple defenders and an attacker,and Nash equilibrium is adopted as the optimal defense strategy.In order to solve Nash equilibrium in practice,we proposes practical adaptive algorithms for the defender and the attacker which enable the both sides learn towards Nash equilibrium through repeated interaction.Finally,the experiment results indicate that optimal defense strategy which is designed from the perspective of the whole significantly outperforms other non-strategic defense strategies in terms of decreasing the total losses against the man-in-the-middle attack.It also shows that the learning algorithms proposed from the perspective of the individual can ensure the strategy of the defender converges to Nash equilibrium and the expected payoff of the attacker approximates the expected payoff in Nash equilibrium.This paper uses the security game theory to study the man-in-the-middle attack defense problem.Not only does it complement the existing man-in-the-middle attack defense approaches and have certain theoretical significance for the development of security game theory,but also it provides a new development direction of the security game theory.