Efficient State Estimation of a Networked FlipIt Model

2025-04-01

AI Summary

This paper addresses the challenge of real-time estimation of attack infection states in large-scale networks, where the Boolean Kalman filter suffers from exponential time and space complexity. We propose a mean-field-theoretic state estimation algorithm that—novelty notwithstanding—introduces mean-field approximation into the networked FlipIt game framework. The model jointly captures attack propagation dynamics, noisy observations (e.g., IDS false positives/negatives), and the defender’s dynamic cleanup mechanism. Crucially, we provide a rigorous theoretical proof showing that, under nontrivial conditions, this heuristic estimator is *exactly equivalent* to the optimal Boolean Kalman filter. Computationally, the algorithm reduces complexity from exponential to polynomial time. Simulation results confirm substantial runtime reduction while preserving near-optimal estimation accuracy. Thus, our approach delivers a scalable, provably correct solution for real-time security situational awareness in large-scale networks.

Technology Category

• Intelligent Robots: State Estimation
• Reasoning under Uncertainty: Stochastic Optimization
• Search and Optimization: Adversarial Search

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

The Boolean Kalman Filter and associated Boolean Dynamical System Theory have been proposed to study the spread of infection on computer networks. Such models feature a network where attacks propagate through, an intrusion detection system that provides noisy signals of the true state of the network, and the capability of the defender to clean a subset of computers at any time. The Boolean Kalman Filter has been used to solve the optimal estimation problem, by estimating the hidden true state given the attack-defense dynamics and noisy observations. However, this algorithm is infeasible because it runs in exponential time and space with respect to the network size. We address this feasibility problem by proposing a mean-field estimation approach, which is inspired by the epidemic modeling literature. Although our approach is heuristic, we prove that our estimator exactly matches the optimal estimator in certain non-trivial cases. We conclude by using simulations to show both the run-time improvement and estimation accuracy of our approach.

Problem

• Estimating hidden network state from noisy observations efficiently
• Reducing exponential complexity of optimal estimation algorithm
• Proposing feasible mean-field approach for state estimation

Innovation

• Boolean Kalman Filter for optimal state estimation
• Mean-field estimation to reduce complexity
• Heuristic matching optimal estimator in cases