Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
survey

A Survey on Game-Theoretic Approaches for Intrusion Detection and Response Optimization

Published: 22 August 2018 Publication History
  • Get Citation Alerts
  • Abstract

    Intrusion Detection Systems (IDS) are key components for securing critical infrastructures, capable of detecting malicious activities on networks or hosts. However, the efficiency of an IDS depends primarily on both its configuration and its precision. The large amount of network traffic that needs to be analyzed, in addition to the increase in attacks’ sophistication, renders the optimization of intrusion detection an important requirement for infrastructure security, and a very active research subject. In the state of the art, a number of approaches have been proposed to improve the efficiency of intrusion detection and response systems. In this article, we review the works relying on decision-making techniques focused on game theory and Markov decision processes to analyze the interactions between the attacker and the defender, and classify them according to the type of the optimization problem they address. While these works provide valuable insights for decision-making, we discuss the limitations of these solutions as a whole, in particular regarding the hypotheses in the models and the validation methods. We also propose future research directions to improve the integration of game-theoretic approaches into IDS optimization techniques.

    References

    [1]
    A. Agah, S. K. Das, K. Basu, and M. Asadi. 2004. Intrusion detection in sensor networks: A non-cooperative game approach. In Proceedings of the 3rd IEEE International Symposium on Network Computing and Applications.
    [2]
    C. Alexander. 2009. Market Risk Analysis: Value-at-Risk Models. Vol. 4. Wiley.
    [3]
    T. Alpcan and T. Basar. 2003. A game theoretic approach to decision and analysis in network intrusion detection. In Proceedings of the 42nd IEEE Conference on Decision and Control.
    [4]
    T. Alpcan and T. Basar. 2006. An intrusion detection game with limited observations. In Proceedings of the 12th International Symposium on Dynamic Games and Applications.
    [5]
    T. Alpcan and T. Basar. 2010. Network Security: A Decision and Game-Theoretic Approach. Cambridge University Press.
    [6]
    E. Altman. 1999. Constrained Markov Decision Processes. CRC Press.
    [7]
    B. An, E. Shieh, R. Yang, M. Tambe, C. Baldwin, J. DiRenzo, B. Maule, and G. Meyer. 2012. PROTECT—A deployed game-theoretic system for strategic security allocation for the United States Coast Guard. AI Magazine 33 (2012), 96--110.
    [8]
    R. Aumann and A. Brandenburger. 1995. Epistemic conditions for Nash equilibrium. Econometrica 63, 5 (1995), 1161--1180.
    [9]
    R. J. Aumann. 1997. Rationality and Bounded Rationality. Springer, Berlin, 219--231.
    [10]
    S. Axelsson. 2000a. The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security 3, 3 (2000), 186--205.
    [11]
    S. Axelsson. 2000b. Intrusion Detection Systems: A Survey and Taxonomy. Technical Report 99-15, Department of Computer Engineering, Chalmers University of Technology, Sweden.
    [12]
    N. Bao and J. Musacchio. 2009. Optimizing the decision to expel attackers from an information system. In Proceedings of the 47th Annual Allerton Conference on Communication, Control, and Computing.
    [13]
    R. Bellman. 1957. A Markovian decision process. Journal of Mathematics and Mechanics 6 (1957), 679--684.
    [14]
    D. P. Bertsekas. 2000. Dynamic Programming and Optimal Control (2nd ed.). Athena Scientific.
    [15]
    A. L. Buczak and E. Guven. 2016. A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys Tutorials 18, 2 (2016), 1153--1176.
    [16]
    I. Butun, S. D. Morgera, and R. Sankar. 2014. A survey of intrusion detection systems in wireless sensor networks. IEEE Communications Surveys Tutorials 16, 1 (2014), 266--282.
    [17]
    C. A. Catania and C. G. Garino. 2012. Automatic network intrusion detection: Current techniques and open issues. Computers and Electrical Engineering 38, 5 (2012), 1062--1072.
    [18]
    L. Chen and J. Leneutre. 2009. A game theoretical framework on intrusion detection in heterogeneous networks. IEEE Transactions on Information Forensics and Security 4, 2 (2009), 165--178.
    [19]
    Y. Chen and R. Sion. 2011. To cloud or not to cloud?: Musings on costs and viability. In Proceedings of the 2nd ACM Symposium on Cloud Computing.
    [20]
    R. T. Clemen and R. L. Winkler. 1999. Combining probability distributions from experts in risk analysis. Risk Analysis 19, 2 (1999), 187--203.
    [21]
    H. Debar, M. Dacier, and A. Wespi. 1999. Towards a taxonomy of intrusion-detection systems. Computer Networks 31, 9 (1999), 805--822.
    [22]
    J. deMeer and A. Rennoch. 2011. The ETSI TVRA Security-Measurement Methodology by Means of TTCN-3 Notation. ETSI.
    [23]
    D. E. Denning. 1987. An intrusion-detection model. IEEE Transactions on Software Engineering 13, 2 (1987), 222--232.
    [24]
    C. T. Do, N. H. Tran, C. Hong, C. A. Kamhoua, K. A. Kwiat, E. Blasch, S. Ren, N. Pissinou, and S. S. Iyengar. 2017. Game theory for cyber security and privacy. ACM Computing Surveys 50, 2 (2017).
    [25]
    ETSI 2015. Information Security Indicators (ISI); Indicators (INC); Part 1: A Full Set of Operational Indicators for Organizations to Use to Benchmark Their Security Posture. ETSI.
    [26]
    A. H. Farooqi and F. A. Khan. 2009. Intrusion detection systems for wireless sensor networks: A survey. Communication and Networking. Springer, Berlin, 234--241.
    [27]
    F. M. Delle Fave, A. X. Jiang, Z. Yin, C. M. Zhang, M. Tambe, S. Kraus, and J. P. Sullivan. 2014. Game-theoretic security patrolling with dynamic execution uncertainty and a case study on a real transit system. Journal of Artificial Intelligence Research 50 (2014), 321--367.
    [28]
    T. Fawcett. 2006. An introduction to ROC analysis. Pattern Recognition Letters 27, 8 (2006), 861--874.
    [29]
    A. Fielder, E. Panaousis, P. Malacaria, C. Hankin, and F. Smeraldi. 2015. Comparing decision support approaches for cyber security investment. CoRR abs/1502.05532 (2015).
    [30]
    J. Filar and K. Vrieze. 1996. Competitive Markov Decision Processes. Springer-Verlag, New York.
    [31]
    FIRST 2015. Common Vulnerability Scoring System v3.0: Specification Document. FIRST.
    [32]
    G. S. Fishman. 2001. Discrete-Event Simulation. Springer-Verlag.
    [33]
    D. Fudenberg. 1998. The Theory of Learning in Games. MIT Press.
    [34]
    P. García-Teodoro, J. Díaz-Verdejo, G. Maciá-Fernández, and E. Vázquez. 2009. Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers and Security 28, 1--2 (2009), 18--28.
    [35]
    M. Ghorbani and M. R. Hashemi. 2015. Networked IDS configuration in heterogeneous networks—A game theory approach. In Proceedings of the 23rd Iranian Conference on Electrical Engineering.
    [36]
    G. Gonzalez Granadillo, H. Debar, G. Jacob, C. Gaber, and M. Achemlal. 2012. Individual countermeasure selection based on the return on response investment index. Computer Network Security. Springer, Berlin, 156--170.
    [37]
    R. Howard. 1960. Dynamic Programming and Markov Processes. MIT Press.
    [38]
    J. Huang, I. Liao, Y. Chung, and K. Chen. 2013. Shielding wireless sensor network using Markovian intrusion detection system with attack pattern mining. Information Sciences 231 (2013), 32--44.
    [39]
    Z. Inayat, A. Gani, N. B. Anuar, M. K. Khan, and S. Anwar. 2016. Intrusion response systems: Foundations, design, and challenges. Journal of Network and Computer Applications 62 (2016), 53--74.
    [40]
    Z. Ismail, C. Kiennert, J. Leneutre, and L. Chen. 2017. A game theoretical model for optimal distribution of network security resources. In Proceedings of the 8th Conference on Decision and Game Theory for Security (GameSec’17).
    [41]
    M. Jain, B. An, and M. Tambe. 2013. Security games applied to real-world: Research contributions and challenges. Moving Target Defense II.
    [42]
    I. Kantzavelou and S. Katsikas. 2010. A game-based intrusion detection mechanism to confront internal attackers. Computers 8 Security 29, 8 (2010), 859--874.
    [43]
    M. Kodialam and T. V. Lakshman. 2003. Detecting network intrusions via sampling: A game theoretic approach. In Proceedings of the 22nd Annual Joint Conference of the IEEE Computer and Communications (INFOCOM’03).
    [44]
    C. Kolias, G. Kambourakis, and M. Maragoudakis. 2011. Swarm intelligence in intrusion detection: A survey. Computers and Security 30, 8 (2011), 625--642.
    [45]
    Y. W. Law, T. Alpcan, and M. Palaniswami. 2015. Security games for risk minimization in automatic generation control. IEEE Transactions on Power Systems 30, 1 (2015), 223--232.
    [46]
    A. Lazarevic, V. Kumar, and J. Srivastava. 2005. Managing Cyber Threats: Issues, Approaches, and Challenges. Springer US, Chapter Intrusion Detection: A Survey, 19--78.
    [47]
    X. Liang and Y. Xiao. 2013. Game theory for network security. IEEE Communications Surveys Tutorials 15, 1 (2013), 472--486.
    [48]
    B. Liebald, D. Roth, N. Shah, and V. Srikumar. 2008. Proactive intrusion detection. In Proceedings of the 23rd National Conference on Artificial Intelligence.
    [49]
    R. P. Lippmann, D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. McClung, D. Weber, S. E. Webster, D. Wyschogrod, R. K. Cunningham, and M. A. Zissman. 2000. Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation. In Proceedings of the DARPA Information Survivability Conference and Exposition.
    [50]
    Y. Luo, F. Szidarovszky, Y. Al-Nashif, and S. Hariri. 2009. A game theory based risk and impact analysis method for intrusion defense systems. In Proceedings of the International Conference on Computer Systems and Applications.
    [51]
    Y. Luo, F. Szidarovszky, Y. Al-Nashif, and S. Hariri. 2014. A fictitious play-based response strategy for multistage intrusion defense systems. Security and Communication Networks 7, 3 (2014), 473--491.
    [52]
    K. Lye and M. J. Wing. 2005. Game strategies in network security. International Journal of Information Security 4, 1 (2005), 71--86.
    [53]
    M. H. Manshaei, Q. Zhu, T. Alpcan, T. Basar, and J. P. Hubaux. 2013. Game theory meets network security and privacy. ACM Computing Surveys 45, 3 (2013).
    [54]
    MATLAB. 2010. Version 7.10.0 (R2010a). The MathWorks Inc.
    [55]
    J. McHugh. 2000. Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln laboratory. ACM Transactions on Information and System Security 3, 4 (2000), 262--294.
    [56]
    R. D. McKelvey and T. R. Palfrey. 1995. Quantal response equilibria for normal form games. Games and Economic Behavior 10, 1 (1995), 6--38.
    [57]
    A. Milenkoski, M. Vieira, S. Kounev, A. Avritzer, and B. D. Payne. 2015. Evaluating computer intrusion detection systems: A survey of common practices. ACM Computing Surveys 48, 1 (2015).
    [58]
    R. A. Miura-Ko, B. Yolken, N. Bambos, and J. Mitchell. 2008. Security investment games of interdependent organizations. In Proceedings of the 46th Annual Allerton Conference on Communication, Control, and Computing.
    [59]
    H. Moosavi and F. M. Bui. 2014a. A discounted stochastic game approach to intrusion detection in wireless ad hoc networks. In Proceedings of the 5th International Conference on Communications and Electronics.
    [60]
    H. Moosavi and F. M. Bui. 2014b. A game-theoretic framework for robust optimal intrusion detection in wireless sensor networks. IEEE Transactions on Information Forensics and Security 9, 9 (2014), 1367--1379.
    [61]
    J. Nash. 1951. Non-cooperative games. Annals of Mathematics 54, 2 (1951), 286--295.
    [62]
    J. v Neumann. 1928. Zur theorie der gesellschaftsspiele. Mathematische Annalen 100, 1 (1928), 295--320.
    [63]
    K. C. Nguyen, T. Alpcan, and T. Basar. 2009. Stochastic games for security in networks with interdependent nodes. In Proceedings of the International Conference on Game Theory for Networks (GameNets’09).
    [64]
    M. J. Osborne and A. Rubinstein. 1994. A Course in Game Theory. MIT Press.
    [65]
    H. Otrok, M. Mehrandish, C. Assi, M. Debbabi, and P. Bhattacharya. 2008a. Game theoretic models for detecting network intrusions. Computer Communications 31, 10 (2008), 1934--1944.
    [66]
    H. Otrok, N. Mohammed, L. Wang, M. Debbabi, and P. Bhattacharya. 2008b. A Game-theoretic intrusion detection model for mobile ad hoc networks. Computer Communications 31, 4 (2008), 708--721.
    [67]
    B. Paramasivan and K. Mohaideen Pitchai. 2011. Comprehensive survey on game theory based intrusion detection system for mobile adhoc networks. IJCA Special Issue on Network Security and Cryptography NSC, 5 (2011), 23--29.
    [68]
    J. Pita, M. Jain, F. Ordóñez, C. Portway, M. Tambe, C. Western, P. Paruchuri, and S. Kraus. 2008. ARMOR security for Los Angeles International Airport. In Proceedings of the 23rd National Conference on Artificial Intelligence.
    [69]
    M. Roesch. 1999. Snort—Lightweight intrusion detection for networks. In Proceedings of the 13th USENIX Conference on System Administration.
    [70]
    J. Rosenhead, M. Elton, and S. K. Gupta. 1972. Robustness and optimality as criteria for strategic decisions. Operational Research Quarterly (1970--1977) 23, 4 (1972), 413--431.
    [71]
    S. Roy, C. Ellis, S. Shiva, D. Dasgupta, V. Shandilya, and Q. Wu. 2010. A survey of game theory as applied to network security. In Proceedings of the 43rd Hawaii International Conference on System Sciences.
    [72]
    A. Rubinstein. 1991. Comments on the interpretation of game theory. Econometrica 59, 4 (1991), 909--924.
    [73]
    K. Sallhammar, B. E. Helvik, and S. J. Knapskog. 2005. Incorporating attacker behavior in stochastic models of security. In Proceedings of the 2005 International Conference on Security and Management.
    [74]
    B. Schneier. 2000. Secrets 8 Lies: Digital Security in a Networked World (1st ed.). John Wiley 8 Sons, Inc.
    [75]
    A. Shameli-Sendi, M. Cheriet, and A. Hamou-Lhadj. 2014. Taxonomy of intrusion risk assessment and response system. Computers and Security 45 (2014), 1--16.
    [76]
    D. Shen, G. Chen, J. B. Cruz, Jr., L. Haynes, M. Kruger, and E. Blasch. 2007. A Markov game theoretic data fusion approach for cyber situational awareness. In Proceedings of SPIE, Vol. 6571.
    [77]
    S. Shen, R. Han, L. Guo, W. Li, and Q. Cao. 2012. Survivability evaluation towards attacked WSNs based on stochastic game and continuous-time Markov chain. Applied Soft Computing 12, 5 (2012), 1467--1476.
    [78]
    S. Shen, G. Yue, Q. Cao, and F. Yu. 2011. A survey of game theory in wireless sensor networks security. Journal of Networks 6, 3 (2011).
    [79]
    W. Sonnenreich, J. Albanese, and B. Stout. 2006. Return on security investment (ROSI): A practical quantitative model. Journal of Research and Practice in Information Technology 38, 1 (2006), 45--56.
    [80]
    M. T. J. Spaan. 2012. Partially Observable Markov Decision Processes. Springer, Berlin, 387--414.
    [81]
    V. Srinivasan, P. Nuggehalli, C. F. Chiasserini, and R. R. Rao. 2003. Cooperation in wireless ad hoc networks. In Proceedings of the 22nd Annual Joint Conference of the IEEE Computer and Communications (INFOCOM’03).
    [82]
    N. Stakhanova, S. Basu, and J. Wong. 2007. A taxonomy of intrusion response systems. International Journal of Information and Computer Security 1, 1/2 (2007), 169--184.
    [83]
    T. Toth and C. Kruegel. 2002. Evaluating the impact of automated intrusion response mechanisms. In Proceedings of the 18th Annual Computer Security Applications Conference.
    [84]
    M. Willem. 1996. Minimax Theorems. Birkhäuser.
    [85]
    R. L. Winkler. 1981. Combining probability distributions from dependent information sources. Management Science 27, 4 (1981), 479--488.
    [86]
    Q. Zhu and T. Basar. 2009. Dynamic policy-based IDS configuration. In Proceedings of the 48th IEEE Conference on Decision and Control.
    [87]
    Q. Zhu, C. Fung, R. Boutaba, and T. Basar. 2009. A game-theoretical approach to incentive design in collaborative intrusion detection networks. In Proceedings of the International Conference on Game Theory for Networks (GameNets’09).
    [88]
    Q. Zhu, H. Tembine, and T. Basar. 2010. Network security configurations: A nonzero-sum stochastic game approach. In Proceedings of the 2010 American Control Conference.
    [89]
    S. A. Zonouz, H. Khurana, W. H. Sanders, and T. M. Yardley. 2014. RRE: A game-theoretic intrusion response and recovery engine. IEEE Transactions on Parallel and Distributed Systems 25, 2 (2014), 395--406.

    Cited By

    View all
    • (2024)Reinforcement learning and game theory based cyber-physical security framework for the humans interacting over societal control systemsFrontiers in Energy Research10.3389/fenrg.2024.141357612Online publication date: 8-Aug-2024
    • (2024)A Survey on Cyber-Resilience Approaches for Cyber-Physical SystemsACM Computing Surveys10.1145/365295356:8(1-37)Online publication date: 26-Apr-2024
    • (2024)Industrial Internet of Things Ecosystems Security and Digital Forensics: Achievements, Open Challenges, and Future DirectionsACM Computing Surveys10.1145/363503056:5(1-37)Online publication date: 12-Jan-2024
    • Show More Cited By

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Computing Surveys
    ACM Computing Surveys  Volume 51, Issue 5
    September 2019
    791 pages
    ISSN:0360-0300
    EISSN:1557-7341
    DOI:10.1145/3271482
    • Editor:
    • Sartaj Sahni
    Issue’s Table of Contents
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 22 August 2018
    Accepted: 01 June 2018
    Revised: 01 May 2018
    Received: 01 December 2016
    Published in CSUR Volume 51, Issue 5

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. IDS
    2. Intrusion detection and response
    3. MDP
    4. game theory
    5. optimization

    Qualifiers

    • Survey
    • Research
    • Refereed

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)104
    • Downloads (Last 6 weeks)9
    Reflects downloads up to 11 Aug 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Reinforcement learning and game theory based cyber-physical security framework for the humans interacting over societal control systemsFrontiers in Energy Research10.3389/fenrg.2024.141357612Online publication date: 8-Aug-2024
    • (2024)A Survey on Cyber-Resilience Approaches for Cyber-Physical SystemsACM Computing Surveys10.1145/365295356:8(1-37)Online publication date: 26-Apr-2024
    • (2024)Industrial Internet of Things Ecosystems Security and Digital Forensics: Achievements, Open Challenges, and Future DirectionsACM Computing Surveys10.1145/363503056:5(1-37)Online publication date: 12-Jan-2024
    • (2024)A Systematic Mapping Study on Intrusion Response SystemsIEEE Access10.1109/ACCESS.2024.338199812(46524-46550)Online publication date: 2024
    • (2023)Impulsive Artificial Defense Against Advanced Persistent ThreatIEEE Transactions on Information Forensics and Security10.1109/TIFS.2023.328456418(3506-3516)Online publication date: 1-Jan-2023
    • (2023)An Overview of Game Theory Approaches for Mobile Ad-Hoc Network’s SecurityIEEE Access10.1109/ACCESS.2023.332108211(107581-107604)Online publication date: 2023
    • (2023)A method for analyzing Stackelberg attack–defense game model in 5G by tCPSO▪Expert Systems with Applications: An International Journal10.1016/j.eswa.2023.120386228:COnline publication date: 15-Oct-2023
    • (2023)Intrusion response systems for cyber-physical systemsComputers and Security10.1016/j.cose.2022.102984124:COnline publication date: 1-Jan-2023
    • (2023)A Systematic Review on Intrusion Detection System in Wireless Networks: Variants, Attacks, and ApplicationsWireless Personal Communications: An International Journal10.1007/s11277-023-10773-x133:1(395-452)Online publication date: 23-Dec-2023
    • (2023)A parallel game model‐based intrusion response system for cross‐layer security in industrial internet of thingsConcurrency and Computation: Practice and Experience10.1002/cpe.782635:28Online publication date: 31-May-2023
    • Show More Cited By

    View Options

    Get Access

    Login options

    Full Access

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    HTML Format

    View this article in HTML Format.

    HTML Format

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media