Indices of power in optimal IDS default configuration: theory and examples

DOI10.1007/978-3-642-25280-8_3zbMATH Open1349.68018arXiv1110.1862OpenAlexW1525862211MaRDI QIDQ3098091FDOQ3098091

Authors: Quanyan Zhu, Tamer Başar 

Publication date: 11 November 2011

Published in: Lecture Notes in Computer Science (Search for Journal in Brave)

Abstract: Intrusion Detection Systems (IDSs) are becoming essential to protecting modern information infrastructures. The effectiveness of an IDS is directly related to the computational resources at its disposal. However, it is difficult to guarantee especially with an increasing demand of network capacity and rapid proliferation of attacks. On the other hand, modern intrusions often come as sequences of attacks to reach some predefined goals. It is therefore critical to identify the best default IDS configuration to attain the highest possible overall protection within a given resource budget. This paper proposes a game theory based solution to the problem of optimal signature-based IDS configuration under resource constraints. We apply the concepts of indices of power, namely, Shapley value and Banzhaf-Coleman index, from cooperative game theory to quantify the influence or contribution of libraries in an IDS with respect to given attack graphs. Such valuations take into consideration the knowledge on common attack graphs and experienced system attacks and are used to configure an IDS optimally at its default state by solving a knapsack optimization problem.

Full work available at URL: https://arxiv.org/abs/1110.1862

Recommendations

• A game theoretical model for optimal distribution of network security resources
• Inspection game analysis of intrusion prevention system management and configuration
• The management of intrusion detection: Configuration, inspection, and investment
• scientific article; zbMATH DE number 1979438
• A multi-objective optimisation approach to IDS sensor placement

zbMATH Keywords

cooperative gamesShapley valueBanzhaf-Coleman indexintrusion detection systemsIDS configuration

Mathematics Subject Classification ID

Combinatorial optimization (90C27) Cooperative games (91A12) Applications of game theory (91A80) Network design and communication in computer systems (68M10)

Cites Work

• Title not available (Why is that?)
• Game theory
• Title not available (Why is that?)
• Formal Methods for Components and Objects

Cited In (8)

• A multi-objective optimisation approach to IDS sensor placement
• Title not available (Why is that?)
• Title not available (Why is that?)
• Towards an information-theoretic framework for analyzing intrusion detection systems
• The management of intrusion detection: Configuration, inspection, and investment
• Inspection game analysis of intrusion prevention system management and configuration
• A game theoretical model for optimal distribution of network security resources
• Optimizing intrusion detection systems placement against network virus spreading using a partially observable stochastic minimum-threat path game

Uses Software

• Snort
• Gnort
• ADEPTS

This page was built for publication: Indices of power in optimal IDS default configuration: theory and examples

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q3098091)