Stochastic Tools for Network Intrusion Detection

Preprint English OPEN
Yu, Lu ; Brooks, Richard R. (2017)

With the rapid development of Internet and the sharp increase of network crime, network security has become very important and received a lot of attention. We model security issues as stochastic systems. This allows us to find weaknesses in existing security systems and propose new solutions. Exploring the vulnerabilities of existing security tools can prevent cyber-attacks from taking advantages of the system weaknesses. We propose a hybrid network security scheme including intrusion detection systems (IDSs) and honeypots scattered throughout the network. This combines the advantages of two security technologies. A honeypot is an activity-based network security system, which could be the logical supplement of the passive detection policies used by IDSs. This integration forces us to balance security performance versus cost by scheduling device activities for the proposed system. By formulating the scheduling problem as a decentralized partially observable Markov decision process (DEC-POMDP), decisions are made in a distributed manner at each device without requiring centralized control. The partially observable Markov decision process (POMDP) is a useful choice for controlling stochastic systems. As a combination of two Markov models, POMDPs combine the strength of hidden Markov Model (HMM) (capturing dynamics that depend on unobserved states) and that of Markov decision process (MDP) (taking the decision aspect into account). Decision making under uncertainty is used in many parts of business and science.We use here for security tools.We adopt a high-quality approximation solution for finite-space POMDPs with the average cost criterion, and their extension to DEC-POMDPs. We show how this tool could be used to design a network security framework.
  • References (16)
    16 references, page 1 of 2

    1. Adachi, Y., Oyama, Y.: Malware analysis system using process-level virtualization. In: Proceedings of IEEE Symposium on Computers and Communications, pp. 550-556 (2009)

    2. Baecher, P., Koetter, M., Dornseif, M., Freiling, F.: The nepenthes platform: An efficient approach to collect malware. In: Proceedings of the 9 th International Symposium on Recent Advances in Intrusion Detection (RAID), pp. 165-184. Springer (2006)

    3. Bakar, N., Belaton, B., Samsudin, A.: False positives reduction via intrusion alert quality framework. In: Joint IEEE Malaysia International Conference on Communications and IEEE International Conference on Networks, pp. 547-552 (2005)

    4. Baumann, R.: http://security.rbaumann.net/download/honeyd.pdf. Originally published as part of the GCIA practical

    5. Garcia-Teodoroa, P., Diaz-Verdejoa, J., Macia-Fernandeza, G., Vazquezb, E.: Anomaly-based network intrusion detection: Techniques, systems and challenges. Computer & Security 28(1 - 2), 18 - 28 (2009)

    6. Lu, C., Schwier, J.M., Craven, R.M., Yu, L., Brooks, R.R., Griffin, C.: A normalized statistical metric space for hidden markov models. IEEE transactions on cybernetics 43(3), 806-819 (2013)

    7. Mokube, I., Adams, M.: Honeypots: Concepts, approaches, and challenges. In: ACMSE 2007, pp. 321-325. Winston-Salem, NC (2007)

    8. Provos, N.: In: Proceedings of the 12th USENIX Security Symposium, pp. 1-14 (2004)

    9. Scarfone, K., Mell, P.: Guide to Intrusion Detection and Prevention Systems (IDPS). Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology, Gaithersburg, MD (2007). NIST special publication 800-94

    10. Spitzner, L.: Honeypots: Tracking Hackers. 1st edition. Addison-Wesley, Boston,MA (2002)

  • Metrics
    No metrics available
Share - Bookmark