"A Gambit Against the Kill Chain: When Game Theory Meets the Adversary's Next Move"

This paper described a testbed and pipeline that turn emulated attacks into ATT&CK-labeled sequences, a depth-3 alpha-beta minimax engine that predicts the next technique, and a static kill-chain baseline, and used them to test whether lookahead improves next-step prediction. On 35 prediction steps drawn from two sequences the two systems performed identically: neither predicted the exact technique at any step, and each was right at the tactic level once. The paired tests show no significant difference, so H1 is not supported by this dataset. The pilot does not show that lookahead helps, and it does not show that it fails to help. The small sample, the hand-set scoring, the absence of transition information and the mixed session data limit what can be concluded, and the engine mostly returned a single high-value technique. What the work does provide is a working pipeline, an evaluation protocol that can be reused with more data, and a record of the design and data problems to avoid. The next steps are a larger and more varied corpus, transition statistics learned from data, stronger baselines and hyperparameters fixed in advance (Section V-E).

[1] MITRE Corporation, “Caldera: A scalable, automated adversary emulation platform,” software. [Online]. Available: https://github.com/mitre/caldera [2] Microsoft, “Sysmon,” Sysinternals documentation, Microsoft Learn. [3] B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, “MITRE ATT&CK: Design and philosophy,” MITRE Corporation, Technical Report, 2018. [4] X. Ou, S. Govindavajhala, and A. W. Appel, “MulVAL: A logic-based network security analyzer,” in Proc. 14th USENIX Security Symposium, 2005, pp. 113–128. [5] X. Ou, W. F. Boyer, and M. A. McQueen, “A scalable approach to attack graph generation,” in Proc. 13th ACM Conf. on Computer and Communications Security (CCS), 2006, pp. 336–345. [6] M. Tambe, Security and Game Theory: Algorithms, Deployed Systems, Lessons Learned. Cambridge, U.K.: Cambridge University Press, 2011. [7] J. Pawlick, E. Colbert, and Q. Zhu, “A game-theoretic taxonomy and survey of defensive deception for cybersecurity and privacy,” ACM Computing Surveys, vol. 52, no. 4, pp. 1–28, 2019. [8] B. Collins, S. Xu, and P. N. Brown, “Game-theoretic cybersecurity: The good, the bad and the ugly,” arXiv preprint arXiv:2401.13815, 2024. [9] L. Yang, Z. Chen, C. Wang, Z. Zhang, S. Booma, P. Cao, C. Adam, A. Withers, Z. Kalbarczyk, R. K. Iyer, and G. Wang, “True attacks, attack attempts, or benign triggers? An empirical measurement of network alerts in a security operations center,” in Proc. 33rd USENIX Security Symposium, 2024, pp. 1525–1542. [10] C. E. Shannon, “Programming a computer for playing chess,” Philosophical Magazine, ser. 7, vol. 41, no. 314, pp. 256–275, 1950.