# Defense Against Advanced Persistent Threats in Dynamic Cloud Storage: A Colonel Blotto Game Approach

**Authors:** Minghui Min, Liang Xiao, Caixia Xie, Mohammad Hajimirsadeghi, Narayan B. Mandayam  
**arXiv:** [1801.06270](https://arxiv.org/abs/1801.06270)  
**Date:** 2018-01-19  
**Summary page:** https://www.summarizepaper.com/en/paper/1801.06270v1/

## Key points

- Authors delve into Advanced Persistent Threat (APT) attacks on cloud storage systems
- Study formulates interactions as a Colonel Blotto game between APT attacker and defender
- Focus on deriving Nash equilibria for CPU allocation games with symmetric and asymmetric CPUs
- Assess impact of limited CPU resources, data storage size, and number of storage devices on data protection level and utility
- Proposed CPU allocation scheme based on "hotbooting" policy hill-climbing (PHC) to enhance defense performance
- Introduction of hotbooting deep Q-network (DQN)-based CPU allocation scheme to improve APT detection performance
- Simulation results show reinforcement learning-based strategy outperforms Q-learning-based approaches in enhancing data protection levels and overall utility

## Summary

In their paper titled "Defense Against Advanced Persistent Threats in Dynamic Cloud Storage: A Colonel Blotto Game Approach," authors Minghui Min, Liang Xiao, Caixia Xie, Mohammad Hajimirsadeghi, and Narayan B. Mandayam delve into the realm of Advanced Persistent Threat (APT) attacks on cloud storage systems. These attackers employ sophisticated methods to stealthily extract information from targeted cloud storage systems while manipulating defense strategies to their advantage. The study formulates the interactions between an APT attacker and a defender allocating their Central Processing Units (CPUs) across multiple storage devices as a Colonel Blotto game. The research focuses on deriving Nash equilibria (NEs) for CPU allocation games with symmetric and asymmetric CPUs between the APT attacker and the defender. The goal is to assess how limited CPU resources, data storage size, and the number of storage devices impact the expected data protection level and utility of the cloud storage system. To enhance defense performance against APT attacks without prior knowledge of attack or data storage models, a CPU allocation scheme based on "hotbooting" policy hill-climbing (PHC) is proposed. This approach leverages past experiences in similar scenarios to accelerate learning speed and achieve optimal defense outcomes. Furthermore, a hotbooting deep Q-network (DQN)-based CPU allocation scheme is introduced to enhance APT detection performance in scenarios involving numerous CPUs and storage devices. Simulation results demonstrate that the reinforcement learning-based CPU allocation strategy outperforms Q-learning-based approaches in improving both data protection levels and overall utility of cloud storage systems when combating APT threats. Through innovative methodologies like hotbooting PHC and DQN-based schemes, this research offers valuable insights into bolstering defenses against dynamic APT attacks in cloud environments.