Fig 1.
Infrastructure from [38] to illustrate game-theoretic APT modeling.
Fig 2.
Example Attack Graph [38].
Table 1.
Security controls (selection).
Table 2.
Example assessment of a security precaution.
Fig 3.
Agreeing vs. disagreeing expert ratings.
Fig 4.
Comparing Different Preference Rules.
Table 3.
APT scenarios (adversary’s action set AS2, based on Fig 2).
Fig 5.
Example of ⪯-choosing among two empirical distributions (inconsistent expert opinions).
Table 4.
Correspondence of Attack Trees/Graphs and Extensive Form Games.
Table 5.
Possible mapping of graph distance to risk categories.
Fig 6.
Loss Assessment of Counteraction vs. Threat.
Fig 7.
Specification of an APT Game (Example Workflow Snapshot).
Table 6.
Benefits of Distribution-Valued Game-Modeling over Classical Game-Modeling.
Fig 8.
Applying Fictitious Play.
Fig 9.
Equilibrium loss distribution for the example APT mitigation game.
Fig 10.
Optimal Tradeoffs (simple case).
Table 7.
Selected Strategies for the Example.
Table 8.
Example Expert Assessments.
Fig 11.
R-plot of our example APT matrix game.