An Adaptive Markov Strategy for Effective Network Intrusion Detection

Jianye Hao, Yinxing Xue, Mahinthan Chandramohan, Yang Liu, Jun Sun
2015 2015 IEEE 27th International Conference on Tools with Artificial Intelligence (ICTAI)  
Network monitoring is an important way to ensure the security of hosts from being attacked by malicious attackers. One challenging problem for network operators is how to distribute the limited monitoring resources (e.g., intrusion detectors) among the network to detect attacks effectively, especially when the attacking strategies can be changing dynamically and unpredictable. To this end, we adopt Markov game to model the interactions between the network operator and the attacker and propose
more » ... acker and propose an adaptive Markov strategy (AMS) to determine how the detectors should be placed on the network against possible attacks to minimize the network's accumulated cost over time. The AMS is guaranteed to converge to the best response strategy when the attacker's strategy is fixed (rationality), converge to a fixed strategy under self-play (convergence) and obtain a payoff no less than that under the precomputed Nash equilibrium strategy of the Markov game (safety). The experimental results show that the AMS can achieve better protection for the network compared with both previous approaches based on the prediction of attack paths and Nash equilibrium strategy.
doi:10.1109/ictai.2015.154 dblp:conf/ictai/HaoXCLS15 fatcat:w6jgxbz3w5htdctkvvd3mp5sx4