Software-defined networking (SDN) has become a promising trend for managing the Industrial Internet of Things (IIoT) devices. As the core of sensitive data storage and business interaction, the SDN is vulnerable to advanced persistent threats (APTs) attacks, while honeypots have shown great promise against APT attacks. In this article, we propose a new SDN-based dynamic bounded rational honeypot-APT game model in IIoT. Specifically, the defender maximizes the utility by chossing the period strategy of honeypot collecting and analyzing the data, while the attacker maximizes utility by choosing the period strategy of its latency and attack. To describe the bounded rationality, we model the simultaneous dynamic attack and defense process through the prospect theory, in which the Prelec function and the value function are both introduced. Experiment results show that bounded rationality affects strategy selection and reduces defender and attacker’s utilities. Furthermore, our strategy outperforms the existing work in defensive performance.

As one of the most critical infrastructure, the power grid has been increasingly threatened by network attacks, especially advanced persistent threats (APTs). APT in the power grid is a continual and stealthy attack that analyzes the interaction between the cyber layer and the physical layer. The existing offensive and defensive processes for power grid using honeypots against APTs are modeled based on full rationality. Therefore, both the attacker and the defender make decisions to maximize their payoffs under full rationality. However, fully rational decisions made by end-users are not always conformed with the real cases, and prospect theory is a typical boundedly rational method to model these deviations. In this study, we propose a subjective APT-honeypot game model to study the offensive and defensive interactions between the attacker and the defender based on the prospect theory. In this model, we protect the power grid bus nodes by deploying honeypots, which consider both low- and high-interaction honeypot modes. We prove the existence of Bayesian-Nash equilibrium strategies in defense and attack strategies under bounded rationality. In addition, we used IEEE-30 Bus system to verify the proposed model in this paper. Experiment results show that bounded rationality affects strategy selection and reduces attacker's payoffs.

Unmanned aerial vehicles (UAVs) are viewed as a key component of 5G, 6G and beyond wireless networks to receive, store and forward information. Benefiting from swift deployment, low cost and high mobility, it has become a promising trend to leverage the UAVs to assist the covert communicator (Alice) against the detector’s (Willie’s) detection in a covert communication network. Nevertheless, once Willie notices the covert transmission process, the covert information is exposed to the risk of being cracked. In this paper, we propose a UAV-assisted covert communication asymmetric information game model (UCCAIG) that focuses on the covert communication countermeasure process based on information asymmetry. We introduce the UAV into covert communication relay assistant Alice and interference assistant Willie respectively, analyze the interaction between Alice and Willie, and derive the optimal strategies for both sides. We further prove the existence of a Bayesian Nash equilibrium (BNE) in the UCCAIG. In addition, we evaluate our proposals on a covert communication testbed with software radio, and the numerical results show that our proposed strategy increases the payoffs of Alice, reduces the payoffs of Willie in a variety of scenarios, and improves the covert communication rate compared with UAV-relayed game (URG).

In highly sophisticated network attacks, command-and-control (C&C) servers always use domain generation algorithms (DGAs) to dynamically produce several candidate domains instead of static hard-coded lists of IP addresses or domain names. Distinguishing the domains generated by DGAs from the legitimate ones is critical for finding out the existence of malware or further locating the hidden attackers. The word-based DGAs disclosed in recent network attack events have shown significantly stronger stealthiness when compared with traditional character-based DGAs. In word-based DGAs, two or more words are randomly chosen from one or more specific dictionaries to form a dynamic domain, these regularly generated domains aim to mimic the characteristics of a legitimate domain. Existing DGA detection schemes, including the state-of-the-art one based on deep learning, still cannot find out these domains accurately while maintaining an acceptable false alarm rate. In this study, we exploit the inter-word and inter-domain correlations using semantic analysis approaches, word embedding and the part-of-speech are taken into consideration. Next, we propose a detection framework for word-based DGAs by incorporating the frequency distribution of the words and that of part-of-speech into the design of the feature set. Using an ensemble classifier constructed from Naive Bayes, Extra-Trees, and Logistic Regression, we benchmark the proposed scheme with malicious and legitimate domain samples extracted from public datasets. The experimental results show that the proposed scheme can achieve significantly higher detection accuracy for word-based DGAs when compared with three state-of-the-art DGA detection schemes.

A cyber‐physical system (CPS) is a new mechanism controlled or monitored by computer algorithms that intertwine physical and software components. Advanced persistent threats (APTs) represent stealthy...

Unmanned aerial vehicles (UAVs) are an important component of a communication system to measure, collect, store, forward, analyze, and operate covert data. Due to the advantages of rapid deployment and high mobility, it has become a promising trend to leverage the UAVs to assist Alice against Willie's detection. Nevertheless, the covert communication process between Alice and Bob is vulnerable to various detections by illegal. In this paper, we propose the UAV-assisted covert communication game (UCCG) model that focuses on the covert communication countermeasure process assisted by the UAV. Specifically, we introduce the UAVs into covert communication to interfere with Willie's detection via disguising the interference signals of the UAV as ambient noise, analyze the interaction between Alice and Willie, and derive optimal strategies for both sides. We further prove the existence of Nash equilibriums (NE) in the UCCG model. Finally, we evaluate our proposals on a covert communication testbed, and the results show that our strategy outperforms the existing work in covert throughput performance.