Configuration of the detection function in a distributed IDS using game theory - Archive ouverte HAL
Communication Dans Un Congrès Année : 2020

Configuration of the detection function in a distributed IDS using game theory

Résumé

With the rise of the Internet-of-Things, networks are becoming abundant and diverse in nature. Classical solutions to defend such networks, such as firewalls or access control, cannot scale appropriately. The use of Intrusion Detection Systems, especially networked-based, is widespread as a means to compensate for these shortcomings. Yet, the resources to monitor each network individually, grows considerably with the number of networks and the number of different attacks. To solve this issue, we present a distributed network IDS composed of several probes that monitor the different networks. Each probe of the IDS has access to a large number of detection libraries for signature-based detection, as well as our own anomaly-based detection library. However using these detection mechanisms has a cost on each probe, the choice of network to monitor and of the libraries to use, is a complex one that depends on the attacker's strategies and the goals of the defender. To optimize the detection function at every step, this paper models the choices as a two-player nonzero-sum game between the attackers of the network and the IDS's configuration. There are several papers in the literature that use game theory to find optimal configurations of distributed IDS. Those works have been extended here and through a thorough analysis of our framework, we have established guidelines for IDSs.
Fichier non déposé

Dates et versions

hal-03119389 , version 1 (23-01-2021)

Identifiants

Citer

Clement Weill, Alexis Olivereau, Djamal Zeghlache. Configuration of the detection function in a distributed IDS using game theory. ICIN 2020: 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops, Feb 2020, Paris (online), France. pp.210-215, ⟨10.1109/ICIN48450.2020.9059373⟩. ⟨hal-03119389⟩
97 Consultations
0 Téléchargements

Altmetric

Partager

More