A Decision-support Model for Information Systems Based on Situational Awareness

The research proposed an approach that based on situational awareness to make decisions about the protection and defense against cyber attacks. The statistics of the situational awareness system outputs were formalized and described. Strategy sets of each player were set according to the system states. Cost-benefit factors were considered comprehensively to calculate the payoffs of each player. The best strategy is determined based on Bayesian Nash equilibrium. On one hand, the best strategy was based on the working status of network system and critical equipments; on the other hand the payoffs of the players were calculated comprehensively. The model deals well with the attack's intents and the alternation of strategies, and takes account of incentives of system and attacker across-the-board. The experimental results show that the model can effectively improve the accuracy and effectiveness of network defense.