On Multi-Phase and Multi-Stage Game-Theoretic Modeling of Advanced Persistent Threats

Quanyan Zhu and Stefan Rass

Advanced persistent threats (APT) are considered as a significant security threat today. Despite their diversity in nature and details, a common skeleton and sequence of phases can be identified that these attacks follow (in similar ways), which admits a game-theoretic description and analysis. This paper describes a general framework that divides a general APT into three major temporal phases, and fits an individual game model to each phase, connecting the games at the transition points between the phases (similarly to “milestones” accomplished during the launch of an APT).