Development of the interacting agents behavior scenario in the cyber security system

Abstract

The results of modeling and analysis of scenarios of the behavior of interacting agents in conditions of cyber conflict are presented. General approaches to the development of a scenario of the behavior of antagonistic agents are presented. The definition of the scenario is given and the factors determining the scenario of behavior are highlighted. The given scenarios are determined by such factors as the ratio of the capabilities of the attacking and the defending sides, the presence or absence of information exchange between security agents, and the time of switching to a new attack vector. The value of the time of switching to a new attack vector is found, at which the interaction is more stable. This indicates that the reaction of the defense side should not be purely reactive, and the “wait and see” strategy is not always the best. Modeling and analysis of the results were carried out in the conditions of information exchange between agents of the protection system and in the absence of such an exchange. The advantages and disadvantages of this behavior are noted. It is shown that when changing the time of switching to a new attack vector, not only the financial indicators of the activity of the participants in cyber conflict change, but also the nature of the interaction. The value of the time of switching to a new attack vector was found, in which the interaction is more stable, which suggests that the reaction of the defense side should not be purely reactive, and the “wait and see” strategy is not always the best. It is shown how the proposed approach can be used to justify the choice of a strategy for agent behavior in security systems, as well as for economic assessments of countermeasures and their deterrent effect on attackers. The proposed scenarios can be considered as a useful tool for assessing investments in the security of the business process circuit by decision makers.