FFICIENCY EVALUATION MODEL OF PROACTIVE DEFENSE AGAINST HNDL ATTACKS

Abstract

The object of the study is the process of proactive counteraction to cyber threats of the "Harvest Now, Decrypt Later" (HNDL) type in the context of the quantum transition. The aim of the paper is to develop and justify a stochastic game-theoretic model of the conflict between an Attacker and a Defender to optimize proactive threat hunting resources under conditions of high network volatility in critical information infrastructure (CII). The paper employs the framework of zero-sum stochastic differential games (SDG). In contrast to classical deterministic models, the proposed model is built upon a system of Itô stochastic differential equations describing the dynamics of two primary factors: the cumulative volume of exfiltrated data and the intruder's "Stealth Index." The Hamilton-Jacobi-Bellman-Isaacs (HJBI) equation is utilized to find optimal control strategies. The numerical solution of the equation is obtained using the Markov chain approximation method (MCAM). The findings allow for accounting for the non-linearity of CII protection costs and the probabilistic nature of detecting digital footprints within noisy CII traffic. A computational experiment (CE) was conducted, comparing two contrasting CII operation scenarios: a baseline scenario (stable traffic) and a high-volatility scenario with a high level of network noise. It is established that under significant volatility, the attacker gains a strategic advantage through the effect of masking destructive actions as "white noise." It is proven that ignoring the stochastic component when modeling HNDL attacks potentially leads to a statistically significant underestimation of potential CII damage by an average of 19%. Optimal proactive search intensity trajectories are synthesized. The research results enable the Defender to minimize losses regardless of the attacker's level of aggression. The scientific novelty lies in the integration of a variable stealth index into the stochastic differential game model, which allows for the quantitative assessment of delayed data decryption risks under conditions of incomplete CII network monitoring. The practical significance of the results consists in the possibility of implementing the model into the decision support systems of Ukrainian SOC centers for resource allocation in countering advanced persistent threats (APT).