Shapley value to rank vulnerabilities on attack graphs: Applications to cyberdeception

Attack graphs play a vital role in cyber defense by identifying vulnerabilities and potential attack paths that can be exploited by attackers to compromise systems or networks. The ranking of these vulnerabilities (edges) and hosts (nodes) is essential for effective cybersecurity and cyberdeception. It facilitates optimal resource allocation, including the deployment of honeypots, proactive defense measures, efficient incident response, and effective cyberdeception strategies. Additionally, it supports risk management, value-effective defense, timely decision making, compliance requirements, and incident recovery. An understanding of the relative importance of vulnerabilities and hosts can empower organizations to prioritize efforts, allocate resources efficiently, and mitigate risks effectively, thereby enhancing overall cybersecurity posture and protecting critical assets. However, current game-theoretical approaches and those based on centrality measures have limitations. They overlook the interactions between vulnerabilities and the scenario where attack graphs involve multiple targets with varying values or importance. To address these limitations, we propose a cooperative game formulation for attack graphs. By leveraging the Shapley value, we measure the contribution of each vulnerability and utilize this measure for ranking. This approach considers vulnerability interactions and accounts for different target values, resulting in a fair and realistic allocation of importance. We demonstrate the effectiveness of the Shapley value through simulations, showcasing its utility in allocating honeypots and prioritizing vulnerability fixes. Our work contributes to the field by introducing a new centrality measure based on cooperative game theory and highlighting its applications in network security and cyberdeception.Attack graphs, Shapley value, honeypots, cyberdeception, network security, vulnerability.