FlipThem: Modeling Targeted Attacks with FlipIt for Multiple Resources

  • Aron Laszka
  • Gabor Horvath
  • Mark Felegyhazi
  • Levente Buttyán
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8840)


Recent high-profile targeted attacks showed that even the most secure and secluded networks can be compromised by motivated and resourceful attackers, and that such a system compromise may not be immediately detected by the system owner. Researchers at RSA proposed the FlipIt game to study the impact of such stealthy takeovers. In the basic FlipIt game, an attacker and a defender fight over a single resource; in practice, however, systems typically consist of multiple resources that can be targeted. In this paper, we present FlipThem, a generalization of FlipIt to multiple resources. To formulate the players’ goals and study their best strategies, we introduce two control models: in the AND model, the attacker has to compromise all resources in order to take over the entire system, while in the OR model, she has to compromise only one. Our analytical and numerical results provide practical recommendations for defenders.


FlipIt game theory advanced persistent threats targeted attacks attacker-defender games 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bowers, K.D., van Dijk, M., Griffin, R., Juels, A., Oprea, A., Rivest, R.L., Triandopoulos, N.: Defending against the unknown enemy: Applying flipIt to system security. In: Grossklags, J., Walrand, J. (eds.) GameSec 2012. LNCS, vol. 7638, pp. 248–263. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  2. 2. Comodo hack may reshape browser security (April 4, (2011),
  3. 3.
    van Dijk, M., Juels, A., Oprea, A., Rivest, R.L.: FlipIt: The game of “stealthy takeover”. Cryptology ePrint Archive, Report 2012/103 (2012)Google Scholar
  4. 4.
    Falliere, N., Murchu, L.O., Chien, E.: W32.Stuxnet Dossier (February 2011),
  5. 5.
    Finkle, J., Shalal-Esa, A.: Hackers breached U.S. defense contractors (May 27, 2011),
  6. 6.
    Grossklags, J., Reitter, D.: How task familiarity and cognitive predispositions impact behavior in a security game of timing. In: Proceedings of the 27th IEEE Computer Security Foundations Symposium, CSF (2014)Google Scholar
  7. 7.
    Kaspersky Lab: Flame…the latest cyber-attack (May 2012),
  8. 8.
    Kaspersky Lab: The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor (February 2013),
  9. 9.
    Laszka, A., Felegyhazi, M., Buttyán, L.: A survey of interdependent security games. Tech. Rep. CRYSYS-TR-2012-11-15, CrySyS Lab, Budapest University of Technology and Economics (November 2012)Google Scholar
  10. 10.
    Laszka, A., Horvath, G., Felegyhazi, M., Buttyán, L.: FlipThem: Modeling targeted attacks with FlipIt for multiple resources (extended version),
  11. 11.
    Laszka, A., Johnson, B., Grossklags, J.: Mitigating covert compromises: A game-theoretic model of targeted and non-targeted covert attacks. In: Proceedings of the 9th Conference on Web and Internet Economics (WINE), pp. 319–332 (2013)Google Scholar
  12. 12.
    Laszka, A., Johnson, B., Grossklags, J.: Mitigation of targeted and non-targeted covert attacks as a timing game. In: Das, S.K., Nita-Rotaru, C., Kantarcioglu, M. (eds.) GameSec 2013. LNCS, vol. 8252, pp. 175–191. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  13. 13.
    Mandiant: APT1: Exposing one of China’s cyber espionage units (February 18, 2013),
  14. 14.
    Menn, J.: Key Internet operator VeriSign hit by hackers (February 2, 2012),
  15. 15.
    Nochenson, A., Grossklags, J.: A behavioral investigation of the FlipIt game. In: Proceedings of the 12th Workshop on the Economics of Information Security, WEIS (2013)Google Scholar
  16. 16.
    Pham, V., Cid, C.: Are we compromised? Modelling security assessment games. In: Grossklags, J., Walrand, J. (eds.) GameSec 2012. LNCS, vol. 7638, pp. 234–247. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  17. 17.
    Reitter, D., Grossklags, J., Nochenson, A.: Risk-seeking in a continuous game of timing. In: Proceedings of the 13th International Conference on Cognitive Modeling (ICCM), pp. 397–403 (2013)Google Scholar
  18. 18.
    Rivner, U.: Anatomy of an attack (April 2011),
  19. 19.
    Symantec Security Response: W32.Duqu: The Precursor to the Next Stuxnet (October 18, 2011),
  20. 20.
    Varian, H.: System reliability and free riding. In: Economics of Information Security, pp. 1–15. Springer (2004)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  • Aron Laszka
    • 1
  • Gabor Horvath
    • 2
  • Mark Felegyhazi
    • 2
  • Levente Buttyán
    • 2
  1. 1.Institute for Software Integrated Systems (ISIS)Vanderbilt UniversityNashvilleUSA
  2. 2.Department of Networked Systems and Services (HIT)Budapest University of Technology and Economics (BME)BudapestHungary

Personalised recommendations