Multi-stage game model based intrusion detection method for advanced persistent threats of industrial control networks

In this paper, a multi-stage game model based intrusion detection method is investigated for Advanced Persistent Threat (APT) identification of industrial control networks. By considering that APT usually contains multiple sequential attack stages, a multi-stage game model covering APT life cycle is established to describe the whole confrontation process between the attacker and the defender. In the game model, the payoff goals of the players are to maximize the damage and the defense to security assets of industrial networks, and the action strategies are attack power and detection threshold, respectively. Nash equilibrium theory is introduced to help analyze the optimal strategies, and it’s strictly proved that Nash equilibrium point of the game model at each stage must exist and also must be unique. These provide the optimal adaptive strategic parameters for intrusion detection at each stage. At last, a numerical example is utilized to verify the conclusions.