Information security analysis using game theory and simulation

A system for quantitatively predicting vulnerability in security of an information system, the system comprising one or more processors or circuits, wherein for the information system, which is operable to receive malicious actions against security of the information system and is operable to receive corrective actions relative to the malicious actions for restoring security in the information system, said one or more processors or circuits is operable to:

• construct a game oriented agent based model which represents security activity in the information system in a simulator application, wherein the game oriented agent based model is constructed as a game having two opposing participants including an attacker and a defender, a plurality of probabilistic game rules and a plurality of allowable game states;
• run the simulator application comprising the constructed game oriented agent based model representing security activity in the information system, for a specified number of simulation runs and reaching a probabilistic number of the plurality of allowable game states in each of the simulation runs, wherein the probability of reaching a specified one or more of the plurality of allowable game states in each of the simulation runs is unknown prior to running each of the simulation runs;
• and
• collect data which is generated during one or more of the plurality of allowable game states and for one or more of the specified simulation runs to determine a probability of one or more aspects of security in the information system.

A non-transitory computer-readable medium comprising a plurality of instructions executable by a processor for quantitatively predicting vulnerability in security of an information system, wherein for the information system, which is operable to receive malicious actions against security of the information system and is operable to receive corrective actions relative to the malicious actions for restoring security in the information system, the non-transitory computer-readable medium comprises instructions for:

• constructing a game oriented agent based model which represents security activity in the information system in a simulator application, wherein the game oriented agent based model is constructed as a game having two opposing participants including an attacker and a defender, a plurality of probabilistic game rules and a plurality of allowable game states;
• running the simulator application comprising the constructed game oriented agent based model representing security activity in the information system, for a specified number of simulation runs and reaching a probabilistic number of the plurality of allowable game states in each of the simulation runs, wherein the probability of reaching a specified one or more of the plurality of allowable game states in each of the simulation runs is unknown prior to running each of the simulation runs;
• and
• collecting data which is generated during one or more of the plurality of allowable game states and for one or more of the specified simulation runs to determine a probability of one or more aspects of security in the information system.