An adaptive Markov strategy for effective network intrusion detection

• Main Authors: HAO, Jianye, XUE, Yinxing, CHANDRAMOHAN, Mahinthan, LIU, Yang, SUN, Jun
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2015
• Subjects: Artificial Intelligence and Robotics; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/4952; https://ink.library.smu.edu.sg/context/sis_research/article/5955/viewcontent/ictai15.pdf
• Institution: Singapore Management University

Network monitoring is an important way to ensure the security of hosts from being attacked by malicious attackers. One challenging problem for network operators is how to distribute the limited monitoring resources (e.g., intrusion detectors) among the network to detect attacks effectively, especially when the attacking strategies can be changing dynamically and unpredictable. To this end, we adopt Markov game to model the interactions between the network operator and the attacker and propose an adaptive Markov strategy (AMS) to determine how the detectors should be placed on the network against possible attacks to minimize the network’s accumulated cost over time. The AMS is guaranteed to converge to the best response strategy when the attacker’s strategy is fixed (rationality), converge to a fixed strategy under self-play (convergence) and obtain a payoff no less than that under the precomputed Nash equilibrium strategy of the Markov game (safety). The experimental results show that the AMS can achieve better protection for the network compared with both previous approaches based on the prediction of attack paths and Nash equilibrium strategy.