PaperlayerView exact revision on arXiv

Source-linked AI summary

From Reconnaissance to Response: Quantitative Risk Parameterization and Game Theoretic Containment in Modern Enterprise Attack

Shadeeb Hossain

arXiv:2609.36485v2cs.GTcs.CRcs.SYeess.SY

TL;DR

The paper addresses the gap between security games with static, uncalibrated payoffs and live enterprise telemetry. It combines CVSS and FAIR risk inputs with Bayesian SIEM updates and a Stackelberg threshold; simulations report automated containment 58 seconds after sustained anomalies cross that boundary.

  • Problem

    Existing security game frameworks either use uncalibrated utility parameters or lack continuous integration with live enterprise telemetry.

    Source: D. Research Gap and Literature… · p. 3

  • Method

    The framework calibrates game payoffs with CVSS and FAIR risk parameters, then updates Bayesian threat beliefs from SIEM telemetry to evaluate a Stackelberg containment boundary.

    Source: §I · p. 2, C. Factor Analysis of Information Risk… · p. 4, §D.1 · p. 5

  • Results

    At 58 seconds, sustained anomalous telemetry raises the posterior to μ(t) ≥ 0.219 and triggers automated proactive containment, while transient noise remains below the decision boundary.

    Source: §I · p. 7

  • Takeaways & Limitations

    Sensitivity analysis shows that the decision threshold changes with exploitability and containment cost, while the engine suppresses transient telemetry noise below the boundary.

    Source: §I · pp. 7–8

    The model treats initial exploitability as a static upper-bound probability rather than a variable that fluctuates during active probing.

    Source: §V · p. 8

Abstract

from arXiv · show

Modern Security Operations Centers struggle with delayed manual incident response, enabling adversaries to advance through the Cyber Kill Chain during early stage reconnaissance. While classical game theoretic defense models optimize strategic resource allocation, they rely on static utility matrices that fail to adapt to dynamic telemetry. This paper presents an integrated, metrics driven decision engine that bridges quantitative risk parameterization and continuous automated response time. Common Vulnerability Scoring Systems exploitability parameters are mapped to attacker success probabilities and evaluate defender log distributions via Factor Analysis of Information Risk Monte Carlo simulations. Real time SIEM logs streams are modeled as Poisson process arrival rates, dynamically updating defender posterior threat belief through sequential Bayesian filtering. A closed form threshold is derived by framing the interaction as a dynamic Bayesian Stackelberg game, where the expected unmitigated risk exceeds proactive containment cost. Parameterized against empirical data from the 2023 MGM Resorts and Caesars Entertainment cyber incident, simulation results demonstrate that the engine suppresses transient background noise while triggering automated SOAR network isolation within seconds of adversarial probing. Multi parameter sensitivity analysis confirms that the decision boundary dynamically adjusts to live perimeter vulnerability, offering a control theoretic foundation for sub minute automated threat containment.

I. INTRODUCTION

The paper frames reconnaissance as an important early phase of the Cyber Kill Chain and identifies static game-theoretic payoffs as a limitation for modeling adaptive cyber threats. It proposes an empirically parameterized, telemetry-driven decision pipeline for automated containment.

I. INTRODUCTION

  • The Cyber Kill Chain comprises seven phases, and reconnaissance gives attackers intelligence about systems and vulnerabilities before they engineer an attack [1] [5].The paper describes early detection at this stage as challenging and disruption as strategically valuable to defenders.Source: §I · p. 1

II. Related Work and Main Contributions

  • Conventional game-theoretic security models rely on static utility matrices that do not capture adaptive adversaries or changing network conditions.The paper identifies empirical parameterization from live security telemetry as a way to address this limitation.Source: §I · p. 1, §II · p. 2

I. INTRODUCTION

  • The proposed pipeline uses CVSS exploitability and FAIR loss distributions to calibrate payoffs, while SIEM streams update Bayesian threat beliefs for threshold-based SOAR containment.The architecture connects static vulnerability and financial-risk inputs to live telemetry and automated control.Source: §I · p. 2
  • The engine is reported to trigger sub-minute automated SOAR containment when it detects sustained SIEM anomaly streams.The paper also describes sensitivity analysis and modeling boundaries as part of its results and conclusion.Source: §I · p. 2

A. Qualitative and Architectural Defensive Strategies

The related work moves from qualitative evaluations of defensive posture to game-theoretic deception and moving-target defense. The paper identifies uncalibrated payoffs, static telemetry, and limited integration with automated response as operational gaps.

A. Qualitative and Architectural Defensive Strategies

  • Ahmad et al. found that organizations used perimeter prevention broadly but rarely used proactive deception, and their posture evaluation was qualitative.The cited study covered prevention, deterrence, surveillance, detection, response, and deception.Source: A. Qualitative and Architectural… · p. 2

B. Game Theoretic Modeling and Cyber Deception

  • Signaling and cyber-deception games model strategic interactions with rational and boundedly rational attackers, but their payoff values lack direct links to CVSS or FAIR parameters.The paper also characterizes their threat updating as relying on static, offline probabilities rather than live SIEM streams.Source: B. Game Theoretic Modeling and Cyber… · p. 2

C. Moving Target Defense and Automated Control

D. Research Gap and Literature Comparison

The paper identifies a gap in end-to-end security games that combine empirical vulnerability and loss parameters with live telemetry and automated containment. Its contributions connect CVSS and FAIR risk inputs to Bayesian threat updates and a Stackelberg decision boundary.

D. Research Gap and Literature Comparison

  • Existing security game frameworks either use uncalibrated utility parameters or lack continuous integration with live enterprise telemetry.The identified gap is an end-to-end framework using CVSS v3.1, FAIR Monte Carlo loss distributions, Bayesian updates of SIEM Poisson event streams, and automated SOAR containment.Source: D. Research Gap and Literature… · p. 3

E. Main Contributions

  • The contributions map CVSS exploitability and PERT-bounded FAIR losses into game utilities, update threat beliefs from Poisson SIEM streams, and use a Stackelberg boundary for SOAR isolation.The framework is calibrated and validated using operational data from the 2023 MGM Resorts and Caesars Entertainment incidents, with sensitivity analysis across exploitability levels and noise floors.Source: E. Main Contributions · p. 3

III. BACKGROUND AND PARAMETERIZATION FRAMEWORK

The background section uses the 2023 MGM Resorts and Caesars Entertainment breaches as case studies and maps CVSS exploitability to an initial attack-success probability. For the modeled MGM helpdesk interface, the normalized estimate is 73.9%.

A. Case Studies: MGM Resorts and Caesars Entertainment Breaches

  • The case studies contrast MGM's manual network severance and over $100 million in reported losses with Caesars' estimated $15 million ransom payment.The incidents involved different initial-access routes: social engineering at MGM and a compromised third-party vendor endpoint at Caesars.Source: A. Case Studies: MGM Resorts and… · pp. 3–4

B. Quantitative Vulnerability Modeling via CVSS v3.1

  • 73.9% is the normalized attacker success probability reported for the modeled MGM initial compromise, with an exploitability subscore of 2.87.The calculation normalizes the subscore against its theoretical upper bound of 3.887.Source: B. Quantitative Vulnerability Modeling… · p. 4

C. Factor Analysis of Information Risk (FAIR) for MGM

The FAIR model estimates cyber-incident loss exposure by combining threat-event frequency with vulnerability. For the MGM case, its Monte Carlo simulation provides expected-loss parameters for the defender’s game-theoretic payoff.

C. Factor Analysis of Information Risk (FAIR) for MGM

  • FAIR models loss-event frequency as threat-event frequency multiplied by vulnerability, the conditional probability that a threat event produces a loss.Vulnerability is expressed as a logistic function comparing threat capability with resistance strength.Source: C. Factor Analysis of Information Risk… · p. 4
  • For MGM, the model uses a PERT threat-event frequency distribution of 0.5, 1.14, and 2.0 attempts per year and estimates 0.84 loss events per year.Primary and secondary loss modes are $94 million and $15 million, respectively, with separate stated bounds.Source: C. Factor Analysis of Information Risk… · p. 4
  • $92.58 million is the estimated mean FAIR loss, with a $122.03 million 95th-percentile VaR and $16.87 million standard deviation.The loss estimate supplies the defender’s payoff parameter in the game-theoretic framework.Source: C. Factor Analysis of Information Risk… · p. 4, Figure 2 · p. 5

A. Analyzing

The supplied passages identify a Security Information and Event Management section and state that a temporal state variable drives automated response thresholds.

A. Analyzing

  • A temporal state variable drives the automated response thresholds in the game-theoretic control engine.The supplied section heading identifies the topic as SIEM for the MGM Resorts case study.Source: A. Analyzing · p. 5

D.2 Continuous Time Poisson Alert Stream (for Multiple Log Events)

The model treats SIEM alerts as telemetry for updating the defender’s belief about an active attack. It combines a Poisson alert-stream model with a Bayesian decision threshold for containment.

D.2 Continuous Time Poisson Alert Stream (for Multiple Log Events)

  • Alert arrivals differ by network state: normal operations use rate λ0, while an active attack uses λ1 = λ0 + λA.The attack signature rate λA is added to the background rate.Source: §D.2 · p. 5
  • The number of aggregated SIEM alerts k during an observation window Δt is modeled with a Poisson probability, then used to update the defender’s posterior threat belief.SIEM events include login and security alerts from varied sources; k is the total event count in the window.Source: §D.2 · p. 5

D.1 Discrete Alert State Update for a Single Signal

  • The threshold is 21.9%; a single alert is assessed against the point where expected risk of inaction outweighs proactive containment cost.The model reports the threshold as the point at which containment cost equals posterior threat probability multiplied by exploitability and expected FAIR loss.Source: §D.1 · pp. 5–6

D.4 Derivation of Events per second (EPS) and Stackelberg trigger threshold

The model accounts for background SIEM volume and uses posterior threat belief to drive automated containment. In the no-alert case, the estimated attack belief falls to 0.21%.

D.4 Derivation of Events per second (EPS) and Stackelberg trigger threshold

  • The control engine automatically triggers containment when μ(t) reaches or exceeds μ*, transitioning the network to a proactive isolated state.The stated normal-operation baseline is λ0 = 5000 EPS; the modeled active-exploitation rate parameter is λA = 6200 EPS.Source: §D.4 · p. 6
  • 0.21% is the posterior active-attack belief after no alert, suppressing the estimate and avoiding unnecessary containment cost.The model allows the background arrival rate to be adjusted using occupancy or device profiling to reduce false-alarm cascades.Source: §D.4 · p. 6

IV. STRATEGIC GAME FORMULATION AND PAYOFF MATRIX

The section models the enterprise defender and external adversary as a non-cooperative Bayesian-Stackelberg game, with strategies and utilities parameterized by operational states and empirical risk metrics. In the MGM Resorts case study, a high-fidelity identity alert raises the posterior threat belief above the containment threshold.

IV. STRATEGIC GAME FORMULATION AND PAYOFF MATRIX

  • The interaction is a non-cooperative Bayesian-Stackelberg game between enterprise defender D and external adversary A, with discrete strategy spaces and expected utilities.The formulation is motivated by evaluating decisions under state uncertainty, including lateral-movement mitigation in the MGM Resorts breach scenario.Source: §IV · p. 6
  • A single high-fidelity identity alert raises the MGM Resorts threat belief from 2% to 37.9%, exceeding the 0.219 trigger threshold.The expected loss of doing nothing rises to $26 million, calculated as 0.38 × $68.42 million, above containment cost CD.Source: §IV · p. 6
  • The finite-state model keeps the enterprise in normal operation under quiet telemetry below the threshold, while anomalous alerts move belief into a suspicious state.Quiet observations can restore belief to baseline; sustained anomalies can raise belief to the containment threshold.Source: §IV · p. 6
  • The game assigns the defender proactive containment or passive monitoring, and the adversary full breach with lateral movement or abort after probe failure.The defender utility for containment against breach is −CD; for monitoring against breach it is −P(E) · E[LFAIR].Source: §IV · p. 6
  • The case study simulates attacker value VA at $15–30 million and attacker investment CA at $50,000–250,000.The stated value range is aligned with Caesar’s initial demand, and CA represents costs such as initial-access credentials and phishing or vishing infrastructure.Source: §IV · p. 7

I. Simulation Results and Discussion

In simulation, sustained anomalous telemetry drives the Bayesian belief above the Stackelberg threshold and triggers automated proactive containment, while transient noise remains below the decision boundary. Sensitivity analyses show that vulnerability, intervention cost, and telemetry conditions affect the threshold or time to response.

Simulation Results and Discussion

  • The simulation uses 50 EPS baseline noise and an 80 EPS active attack rate, with CD = $15M, P(E) ≈ 0.739, expected FAIR loss ≈ $92.58M, and threshold 0.219.Telemetry is generated with MATLAB’s poissrnd function from a 2% prior during a 100-second scenario.Source: §I · p. 7
  • Algorithm 1 continually ingests SIEM telemetry, computes a Poisson likelihood ratio, updates posterior belief, and compares it with the Stackelberg boundary.Its stated inputs include CVSS subscores, a FAIR loss distribution, prior belief, baseline and attack signal rates, and the telemetry window.Source: §I · p. 7
  • At t=58s, sustained anomalous telemetry raises posterior belief to the 0.219 threshold and triggers automated proactive containment.The simulated attack window runs from t=35s to 75s.Source: §I · p. 7
  • When posterior belief reaches the threshold, the algorithm triggers automated network isolation; otherwise, it maintains continuous monitoring.The loop applies a belief floor before making this decision.Source: §I · p. 7
  • With P(E) = 0.450, the threshold is 0.360 and isolation is delayed to 20s; Fig. 5 compares belief trajectories and containment times across exploitability values.The scheme is described as suppressing transient telemetry noise below the decision boundary while isolating on persistent probing.Source: §I · p. 7
  • Raising containment cost CD from $15M to $45M raises the threshold from 0.219 to 0.657, while higher FAIR loss lowers the threshold.Detection sensitivity and false-positive rates affect how quickly belief reaches the threshold, not its magnitude; high background noise delays containment.Source: §I · p. 8

V. LIMITATIONS, FUTURE DIRECTION AND CONCLUSION

The conclusion presents a CVSS- and FAIR-grounded Stackelberg decision engine that updates threat beliefs from live SIEM telemetry and triggers automated isolation. Its operational boundaries include fixed vulnerability and containment-cost parameters, simplified state and alert models, and assumptions about attacker behavior; future work targets broader models and live-system validation.

V. LIMITATIONS, FUTURE DIRECTION AND CONCLUSION

  • Current boundaries include fixed P(E)=0.739, unimodal PERT losses, binary network and alert states, a rational utility-maximizing attacker, and deterministic containment costs of $15M.The PERT loss estimates are bounded by a minimum of $80M, mode of $94M, and maximum of $120M; the threshold is μ*=0.219.Source: §V · p. 8

MULTI-PARAMETER SENSITIVITY ANALYSIS OF STACKELBERG

  • Fig. 5 examines how Stackelberg containment thresholds and SOAR trigger times shift as perimeter exploitability P(E) varies.The passage identifies the variables compared but does not state the direction or magnitude of the shifts.Source: Figure 5 · p. 9
  • Future work proposes continuous multi-state Markov models, adaptive filtering for nonstationary traffic, heavy-tailed FAIR loss distributions, and validation in live red-team and enterprise systems.The proposed loss models include generalized extreme value and Pareto distributions; SOAR and hardware-enforced isolation are identified for validation.Source: MULTI-PARAMETER SENSITIVITY ANALYSIS… · p. 9
  • The framework grounds defender utilities in CVSS v3.1 exploitability and PERT-bounded FAIR loss distributions, then evaluates Poisson SIEM telemetry against a closed-form Stackelberg threshold.The threshold triggers automated network isolation upon suspicious telemetry streams.Source: MULTI-PARAMETER SENSITIVITY ANALYSIS… · p. 9
  • Sub-minute automated isolation is reported to restrict lateral movement and mitigate multi-million-dollar operational disruption compared with delayed manual response.The framework is calibrated against empirical data from the 2023 MGM Resorts and Caesars Entertainment incidents.Source: MULTI-PARAMETER SENSITIVITY ANALYSIS… · p. 9
Loading 2609.36485v2…