@conference {1502028,
	title = {Data Exfiltration Detection and Prevention: Virtually Distributed POMDPs for Practically Safer Networks },
	booktitle = {Decision and Game Theory for Security (GameSec 2016)},
	year = {2016},
	abstract = {We address the challenge of detecting and addressing advanced persistent threats
(APTs) in a computer network, focusing in particular on the challenge of detecting data exfiltration over Domain Name System (DNS) queries, where existing detection sensors are
imperfect and lead to noisy observations about the network{\textquoteright}s security state. Data exfiltration
over DNS queries involves unauthorized transfer of sensitive data from an organization to a
remote adversary through a DNS data tunnel to a malicious web domain. Given the noisy
sensors, previous work has illustrated that standard approaches fail to satisfactorily rise to the
challenge of detecting exfiltration attempts. Instead, we propose a decision-theoretic technique
that sequentially plans to accumulate evidence under uncertainty while taking into account
the cost of deploying such sensors. More specifically, we provide a fast scalable POMDP formulation to address the challenge, where the efficiency of the formulation is based on two
key contributions: (i) we use a virtually distributed POMDP (VD-POMDP) formulation, motivated by previous work in distributed POMDPs with sparse interactions, where individual
policies for different sub-POMDPs are planned separately but their sparse interactions are
only resolved at execution time to determine the joint actions to perform; (ii) we allow for
abstraction in planning for speedups, and then use a fast MILP to implement the abstraction
while resolving any interactions. This allows us to determine optimal sensing strategies, leveraging information from many noisy detectors, and subject to constraints imposed by network
topology, forwarding rules and performance costs on the frequency, scope and efficiency of
sensing we can perform.},
	author = {Mc Carthy, Sara Marie and Sinha, Arunesh and Tambe, Milind and Manadhata, Pratyusa}
}
