Optimal thresholds for anomaly-based intrusion detection in dynamical environments
From MaRDI portal
Abstract: In cyber-physical systems, malicious and resourceful attackers could penetrate the system through cyber means and cause significant physical damage. Consequently, detection of such attacks becomes integral towards making these systems resilient to attacks. To achieve this objective, intrusion detection systems (IDS) that are able to detect malicious behavior can be deployed. However, practical IDS are imperfect and sometimes they may produce false alarms for a normal system behavior. Since alarms need to be investigated for any potential damage, a large number of false alarms may increase the operational costs significantly. Thus, IDS need to be configured properly, as oversensitive IDS could detect attacks early but at the cost of a higher number of false alarms. Similarly, IDS with low sensitivity could reduce the false alarms while increasing the time to detect the attacks. The configuration of IDS to strike the right balance between time to detecting attacks and the rate of false positives is a challenging task, especially in dynamic environments, in which the damage incurred by a successful attack is time-varying. In this paper, we study the problem of finding optimal detection thresholds for anomaly-based detectors implemented in dynamical systems in the face of strategic attacks. We formulate the problem as an attacker-defender security game, and determine thresholds for the detector to achieve an optimal trade-off between the detection delay and the false positive rates. In this direction, first, we provide an algorithm that computes optimal fixed threshold that remains fixed throughout. Second, we allow detector's threshold to change with time to further minimize the defender's loss and provide an algorithm to compute time-varying thresholds, which we call adaptive thresholds. Finally, we numerically evaluate our results using a water distribution network as a case-study.
Recommendations
- Stochastic detection against deception attacks in CPS: performance evaluation and game-theoretic analysis
- Window-type detector for stealthy false data injection attack in cyber-physical systems
- Quickest detection of deception attacks on cyber-physical systems with a parsimonious watermarking policy
- Attacks detection and security control for cyber-physical systems under false data injection attacks
- Detection of stealthy false data injection attacks against cyber-physical systems: a stochastic coding scheme
Cites work
- \texttt{FlipIt}: the game of ``stealthy takeover
- Adaptive threshold computation for CUSUM-type procedures in change detection and isolation problems
- Attack Detection and Identification in Cyber-Physical Systems
- Comparison of EWMA, CUSUM and Shiryayev-Roberts procedures for detecting a shift in the mean
- Detection of stochastic processes
- FlipThem: modeling targeted attacks with FlipIt for multiple resources
- scientific article; zbMATH DE number 3178062 (Why is no real title available?)
- Mitigating Covert Compromises
- Optimal thresholds for anomaly-based intrusion detection in dynamical environments
- Signaling game based strategy of intrusion detection in wireless sensor networks
- Stackelberg vs. Nash in security games: an extended investigation of interchangeability, equivalence, and uniqueness
Cited in
(3)
This page was built for publication: Optimal thresholds for anomaly-based intrusion detection in dynamical environments
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q3179203)
