[Paper Review] Moving Target Defense for Web Applications using Bayesian Stackelberg Games

Sailik Sengupta, Satya Gautam Vadlamudi+5 more|arXiv (Cornell University)|Feb 23, 2016

Web Application Security Vulnerabilities53 references20 citations

TL;DR

This paper proposes a Bayesian Stackelberg Game framework to generate cost-aware switching strategies for Moving Target Defense (MTD) in web applications, using real-world CVE data and CVSS scores to model attacker types and defender rewards. The approach outperforms state-of-the-art methods in robustness under attacker uncertainty, with a normalized loss in rewards (NLR) of 0.061 (vs. 0.88 for URS) on average.

ABSTRACT

The present complexity in designing web applications makes software security a difficult goal to achieve. An attacker can explore a deployed service on the web and attack at his/her own leisure. Moving Target Defense (MTD) in web applications is an effective mechanism to nullify this advantage of their reconnaissance but the framework demands a good switching strategy when switching between multiple configurations for its web-stack. To address this issue, we propose modeling of a real-world MTD web application as a repeated Bayesian game. We then formulate an optimization problem that generates an effective switching strategy while considering the cost of switching between different web-stack configurations. To incorporate this model into a developed MTD system, we develop an automated system for generating attack sets of Common Vulnerabilities and Exposures (CVEs) for input attacker types with predefined capabilities. Our framework obtains realistic reward values for the players (defenders and attackers) in this game by using security domain expertise on CVEs obtained from the National Vulnerability Database (NVD). We also address the issue of prioritizing vulnerabilities that when fixed, improves the security of the MTD system. Lastly, we demonstrate the robustness of our proposed model by evaluating its performance when there is uncertainty about input attacker information.

Motivation & Objective

• To design an effective, cost-aware switching strategy for Moving Target Defense (MTD) in web applications, given the dynamic reconfiguration of system components.
• To model real-world attacker behaviors using Common Vulnerabilities and Exposures (CVEs) and assign realistic reward values based on security domain expertise and CVSS scores.
• To develop a framework that accounts for switching costs between configurations, which existing solvers overlook.
• To evaluate the robustness of MTD strategies under uncertainty in attacker type probabilities, using a normalized loss in rewards (NLR) metric.
• To identify and prioritize critical vulnerabilities that most impact MTD system security.

Proposed method

• Model the MTD web application as a repeated Bayesian Stackelberg Game (BSG), where the defender (leader) commits to a mixed strategy and the attacker (follower) responds rationally.
• Automatically generate attack sets for predefined attacker types (e.g., Script Kiddie, Database Hacker) by mining and classifying CVEs from the National Vulnerability Database (NVD).
• Assign realistic utility values to defender and attacker outcomes using CVSS scores and security expert insights, ensuring practical relevance.
• Formulate an optimization problem that maximizes defender utility while penalizing high switching costs between configurations, enabling cost-aware strategy generation.
• Use a normalized loss in rewards (NLR) metric to quantify strategy robustness when attacker type probabilities are misestimated.
• Propose a vulnerability prioritization method to identify which fixes most improve MTD system resilience.

Experimental results

Research questions

• RQ1 How can a cost-aware switching strategy be generated for MTD in web applications to maximize security while minimizing operational overhead?
• RQ2 How can real-world attacker behaviors be modeled using CVE data and CVSS scores to reflect realistic attack capabilities and outcomes?
• RQ3 How robust are MTD strategies to uncertainty in attacker type probabilities, and how can this robustness be quantitatively measured?
• RQ4 Which vulnerabilities, when fixed, most significantly improve the security of an MTD system under the proposed game-theoretic framework?
• RQ5 Can the proposed BSG-based strategy outperform existing state-of-the-art methods in terms of security and robustness under uncertainty?

Key findings

• The proposed Bayesian Stackelberg Game (BSG) strategy achieves an average normalized loss in rewards (NLR) of 0.061 under attacker type probability uncertainty, compared to 0.88 for the state-of-the-art URS method.
• The BSG strategy is significantly more robust than URS, with a maximum NLR of 2.35 versus 9.0 for URS when attacker probabilities vary.
• Mainstream and Database hackers are the least sensitive attacker types, as their attack actions remain unchanged under probability shifts, resulting in NLR = 0.
• Script Kiddies are the most sensitive attacker type; underestimating their probability leads to substantial strategy deviation from optimal, highlighting the need for accurate modeling.
• The framework successfully incorporates real-world switching costs into strategy generation, a gap in prior physical security solvers that were adapted to cyber-security.
• The proposed vulnerability prioritization method provides a formal approach to identifying critical fixes that enhance MTD resilience, addressing a previously unstructured problem.