ACTIDS: an active strategy for detecting and localizing network attacks
Proceedings of the 2013 ACM workshop on Artificial intelligence and security
| Hi-index | 0.00 |
Achieving cost-effective systems for network performance monitoring has been the subject of many research works over the last few years. Most of them adopt a two-step approach. The first step assigns optimal locations to monitors, whereas the second step selects a minimal set of paths to be monitored. However, such an approach does not consider the trade-off between the optimization objectives of each step, and hence may lead to sub-optimal usage of network resources and biased measurements. In this paper, we propose to evaluate and reduce this trade-off. Toward this end, we come up with two ILP formulations for a novel monitoring cost model that apply for both passive and active monitoring. The aim is to jointly minimize the monitor location cost and the anomaly detection cost, thereby obtaining a monitoring solution that minimizes the total monitoring cost. Simulation results illustrate the interplay between the optimization objectives and evaluate the quality of the obtained monitoring solution.