An Extension of Network Security Games for Large-Scale Infrastructure Protection

In this paper an extension of the Network Security Games (NSG) is presented, that aims to incorporate the advantages of "standard" expert-based security risk assessment procedures and provide proper formalisation for general large-scale infrastructure protection problems. An instantiation procedure of the model is proposed, which is grounded on the classical security risk assessment methodologies, building a bridge between general standards and Game Theory Security models. The security control selection problem is modelled as a multi-objective optimisation problem. Two interwoven models are developed for addressing the security risk assessment problem. The asset model describes the system and its parameters, while the attack model is used to formalise possible threat scenarios. A specific solver for the stated multi-objective optimisation problem is described in details with theoretically grounded justification of its' correctness. Proposed model is instantiated for an airport case study, and the essential building blocks of the methodology are discussed. The work reported in this paper shows the feasibility of a generalised mathematically founded approach to security risk assessment in large-scale system engineering.