Visible to the public Optimal Thresholds for Intrusion Detection Systems

TitleOptimal Thresholds for Intrusion Detection Systems
Publication TypeConference Paper
Year of Publication2016
AuthorsLaszka, Aron, Abbas, Waseem, Sastry, S. Shankar, Vorobeychik, Yevgeniy, Koutsoukos, Xenofon
Conference NameProceedings of the Symposium and Bootcamp on the Science of Security
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-4277-3
Keywordscomposability, computational complexity, economics of security, game theory, IDS, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, pubcrawl, Resiliency, Stackelberg Equilibrium

In recent years, we have seen a number of successful attacks against high-profile targets, some of which have even caused severe physical damage. These examples have shown us that resourceful and determined attackers can penetrate virtually any system, even those that are secured by the "air-gap." Consequently, in order to minimize the impact of stealthy attacks, defenders have to focus not only on strengthening the first lines of defense but also on deploying effective intrusion-detection systems. Intrusion-detection systems can play a key role in protecting sensitive computer systems since they give defenders a chance to detect and mitigate attacks before they could cause substantial losses. However, an over-sensitive intrusion-detection system, which produces a large number of false alarms, imposes prohibitively high operational costs on a defender since alarms need to be manually investigated. Thus, defenders have to strike the right balance between maximizing security and minimizing costs. Optimizing the sensitivity of intrusion detection systems is especially challenging in the case when multiple inter-dependent computer systems have to be defended against a strategic attacker, who can target computer systems in order to maximize losses and minimize the probability of detection. We model this scenario as an attacker-defender security game and study the problem of finding optimal intrusion detection thresholds.

Citation Keylaszka_optimal_2016