A malware detector placement game for intrusion detection

Authors:
Stephan Schmidt;Tansu Alpcan;Şahin Albayrak;Tamer Başar;Achim Mueller
Affiliations:
DAI-Labor, TU Berlin, Germany;Deutsche Telekom Laboratories, TU Berlin, Germany;DAI-Labor, TU Berlin, Germany;Coordinated Science Laboratory, U. of Illinois, Urbana;Deutsche Telekom Laboratories, TU Berlin, Germany
Venue:
CRITIS'07 Proceedings of the Second international conference on Critical Information Infrastructures Security
Year:
2007

Citing 4
Cited 3

Agent-based telematic services and telecom applications

Communications of the ACM
Dynamic Programming and Optimal Control

Dynamic Programming and Optimal Control
On the number of distributed measurement points for network tomography

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Building a better NetFlow

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications

Application-level simulation for network security

Proceedings of the 1st international conference on Simulation tools and techniques for communications, networks and systems & workshops
Application-level Simulation for Network Security

Simulation
A probabilistic diffusion scheme for anomaly detection on smartphones

WISTP'10 Proceedings of the 4th IFIP WG 11.2 international conference on Information Security Theory and Practices: security and Privacy of Pervasive Systems and Smart Devices

Quantified Score

Hi-index	0.00

Visualization

Abstract

We propose and investigate a game-theoretic approach to the malware filtering and detector placement problem which arises in network security. Our main objective is to develop optimal detector algorithms taking into account attacker strategies and actions. Assuming rational and intelligent attackers, we present a two-person zero-sum non-cooperative Markov security game framework as a basis for modeling the interaction between the attackers who generate malware traffic on a network and a corresponding intrusion detection system (IDS). Thus, we establish a formal model of the detector placement problem based on game theory and derive optimal strategies for both players. In addition, we test the strategies obtained in a realistic agent-based network simulation environment and compare the results of static and dynamic placement scenarios. The obtained IDS strategies and the corresponding simulation results provide interesting insights into how to optimally deploy malware detectors in a network environment.