My publications reflect a commitment to bridging theory and application in high-stakes domains. I have co-authored with scholars from France, Cameroon, the USA, Brazil, and Uruguay, with results presented in top conferences (GameSec, ROADEF) and published in journals such as the IEEE IoT Journal and Dynamic Games and Applications.
A Decentralized Denial of Service is an attack done by an agent capable to control the spread of a malware. This is a combination of epidemiological and conflictual aspects between several decision makers. There exists in the literature papers that study (non oriented) epidemics and papers that study network attacks regardless the epidemiological aspect. We put together the two aspects and provide a new game theoretical model which is part of the family of partially observable stochastic games (POSG) but with particular features. We prove the consistency of heuristic search value iteration (HSVI) based algorithms. Our framework is applied to optimally design a cyber deception technique based on honeypots in order to control an epidemic cyber-attack of a network by a strategic attacker. Some basic simulations are proposed to illustrate the framework described in this work-in-progress paper.
The mathematical theory of epidemics borrows its fundamental notions from epidemiology. These notions encompass the division of the population of individuals into compartments and thereafter the classification of epidemics in models like SIR (susceptible-infected-removed). Unlike in biology, a broad number of epidemics are spread under the action of rational and intelligent malicious individuals, called attackers. The centralized control of such epidemics implies that a network defender is in conflict with the attacker and therefore should be modeled by a zero-sum noncooperative game theoretic concept. We design a new zero-sum partially observable stochastic game (POSG) theoretic framework in order to capture the interactions between network defender and an attacker. More, our model takes into account random node state transitions. The particularity of our model is that even though the attacker knows the state of the network, which is not the case for the defender, she cannot infer the defender’s actions. The tractability of the solution of classical POSG is improved by the mean of value backup iteration. We prove that the value backup operator converges even in our particular POSG coupled with a compartmental epidemic model.
Many epidemic networks admit the partition of the population into three compartments of respective susceptible, infected, and removed individuals. These epidemics involve a conflict between the agent who is propagating the threat and the defender who tries to limit the importance of the propagation. In case of incapability of both agents to monitor the transitions of the network state, this conflict is generally modeled by a stochastic game. The resolution of this class of game is general enough, but remains unscalable. To overcome the curse of dimensionality, we propose a new framework that takes into account the network topology, and we show that the best strategy for each player at each period to optimize his/her overall outcome is to focus on the set of most influential nodes. That is, the use of players’ memory is no longer necessary and, as a matter of result, the proposed algorithm is less time and memory consumptive than the value iteration-based algorithms.
Best Paper Honorable Mention
Attack graphs are pivotal in cybersecurity, providing insights into potential attack paths. Effective cybersecurity and cyberdeception necessitate the prioritization of vulnerabilities for resource allocation and proactive defense. However, current methods fall short in capturing vulnerability interactions and addressing multi-target scenarios. In response, we introduce a cooperative game framework utilizing the Shapley value for vulnerability ranking, enhancing fairness and realism. Simulations demonstrate the Shapley value’s superiority in honeypot allocation and vulnerability prioritization. Our study contributes a novel centrality measure with practical applications in network security and cyberdeception.
We tackle radio resource allocation in 5G and B5G networks, focusing on applications with stringent delay requirements. We formulate this problem as a discounted Markov Decision Process (MDP), considering each user’s Channel Quality Indicator and queue status. We introduce a reducible MDP using state abstraction. By mapping transition dynamics and rewards to an abstract state space, we simplify solving MDPs with smaller state spaces, avoiding the complexity of the original high-dimensional state space. We explore different methods for weighted state aggregation and verify through simulations that our dimension reduction strategy yields results close to the optimal policy.
Practically, a botnet is spread over the Internet of Things (IoT) to ensure an attacker the control of a large number of devices. In this context, in which IoT users react to protect their devices against the threat, a zero-sum one-sided partially observable stochastic game (OS-POSG) model is proposed in which a defender strategically places honeypots in the IoT network in order to deceive attacker’s actions and mitigate the botnet propagation. No player (attacker and defender) observes the opponent’s action but, realistically, the attacker—who is the maximizer—has a perfect knowledge of the state of the network while the defender—who is the minimizer—only is informed of the decisions of IoT users. The objective is to find an optimal deception strategy for the defender that better limits from above the proportion of infected IoT devices. We show in numerous simulations the impact of the partial observation and of the strategic defender’s action on the particular metrics which are the maximum proportion of infected IoT devices during the botnet propagation and the time to botnet extinction in the IoT network.
Intrusion Detection Systems (IDS) are security tools that aim to detect tentative of virus propagation between two interconnected devices. As the propagation of a virus or malware is dynamic and can be strategically controlled by the attacker, we model the problem of optimally determining IDS position in a network as a partially observable zero-sum stochastic Minimum-Threat path game (POSMPG). The goal of the attacker is to infect a maximum number of nodes at a given instant, and then a state-extended stochastic game framework is proposed in order to get optimality equations. We are then able to determine optimal solutions of the POSMPG and to apply our result to an adversarial control of virus propagation on a network.
The Mirai botnet network epidemic discovered in 2016 falls into the category of numerous epidemics propagated by attackers over a network to gain control over multiple devices. This particular epidemic has been employed in some of the most extensive and widespread distributed denial of service (DDoS) attacks [24]. To take control of numerous devices, the attacker’s strategy consists of injecting malicious code from an infected device into one or more vulnerable neighboring devices. This initiates a conflict, as the defender attempts to restrict the attacker’s influence and control. Intelligent and rational agents (defender and attacker) thus engage in a conflictual interaction, constantly competing for optimal strategies within the network. Their objective is to gain control over the most crucial devices, which are identified using centrality measures. Nevertheless, an agent’s perception of the significance of devices may vary due to factors such as variations in roles, information accessibility, available resources, and diverse viewpoints on risks, issues, or opportunities [8]. Consequently, the agents involved in the process may hold different views regarding the significance of devices, resulting in the utilization of different centrality measures. The significance of considering these variations in centrality measures, as well as the impact on each agent’s objective, is emphasized by our analysis. Hence, we propose a non-zero-sum game model to identify the optimal centrality measure for each agent in the context of controlling an epidemic spread. Our model also provides the NE (Nash Equilibrium) strategy profile for agents at each stage of the game. Numerical experiments show that, by taking into account these differences in centrality measures and using our game model, defenders effectively limit the impact of epidemics caused by malicious attackers.
The mathematical theory of epidemics draws upon essential concepts from epidemiology, categorizing the population into three distinct compartments: Susceptible, Infected, and Resistant individuals. This battle between a malicious, intelligent, and rational agent disseminating the threat and a defender attempting to restrict its propagation is generally modeled by a partially observable stochastic game (POSG). Despite its broad applicability, solving this game is still not feasible due to the size of the state space and thus the complexity of updating the defender's belief at each step. To circumvent this “curse of dimensionality”, we present a novel framework that takes into account the network topology through centrality measures. We demonstrate that the defender, instead of updating his belief concerning the state of the network, can apply a condensed representation of his belief regarding the state of each node at each step, without changing his optimal strategy. The defender manages a vector of size n (in a network with n nodes) instead of a vector of size. Numerical illustrations demonstrate that using the condensed representation of the defender's belief enhances the scalability and reduces the convergence time of the algorithm.
Scalable Solutions for Markov Decision Processes with Weighted State Aggregation. Workshop of the ROADEF 2024.
The paper addresses the computational challenges faced when solving large-scale Markov Decision Processes, which are common in domains like telecommunications and resource management.
This body of work reflects my deep interest in modeling adversarial interactions and strategic decision-making under uncertainty. I am currently exploring new collaborations and teaching engagements.
