Dynamic policy-based IDS configuration

Zhu, Quanyan; Başar, Tamer

doi:10.1109/cdc.2009.5399894

Cited by 68 publications

(49 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As shown in [11] for general Markov games and in [12] for zero-sum games, there is indeed convergence under certain conditions on the learning rate β t :…”

Section: Q-learningmentioning

confidence: 75%

“…Q-learning in games, on the other hand, has been introduced by Littman in [11] and more thoroughly discussed in [13]. In [12], convergence results are obtained for zero sum games by applying results from Littman and Szepesvari [13], an approach we take in our framework as well.…”

Section: Q-learningmentioning

confidence: 99%

“…Indeed, organizations are riddled with missing information about their processes, and it is often costly to obtain this information in one place. Motivated by this scenario, we apply current results in Q-learning [11], [12] to the zero-sum Markov game defined. Hence, the attacker and defender are modeled as agents who learn from their actions and get a more accurate understanding of the game they are playing as time progresses.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Security Risk Management via Dynamic Games with Learning

Bommannavar

Alpcan

Bambos

2011

2011 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Abstract-This paper presents a game theoretic and learning approach to security risk management based on a model that captures the diffusion of risk in an organization with multiple technical and business processes. Of particular interest is the way the interdependencies between processes affect the evolution of the organization's risk profile as time progresses, which is first developed as a probabilistic risk framework and then studied within a discrete Markov model. Using zero-sum dynamic Markov games, we analyze the interaction between a malicious adversary whose actions increases the risk level of the organization and a defender agent, e.g. security and risk management division of the organization, which aims to mitigate risks. We derive min-max (saddle point) solutions of this game to obtain the optimal risk management strategies for the organization to achieve a certain level of performance. This methodology also applies to worstcase scenario analysis where the adversary can be interpreted as a nature player in the game. In practice, the parameters of the Markov game may not be known due to the costly nature of collecting and processing information about the adversary as well an organization with many components itself. In this case, we apply ideas from Q-learning to analyze the behavior of the agents when little information is known about the environment in which the attacker and defender interact. The framework developed and results obtained are illustrated with a small example scenario and numerical analysis.

show abstract

“…As shown in [11] for general Markov games and in [12] for zero-sum games, there is indeed convergence under certain conditions on the learning rate β t :…”

Section: Q-learningmentioning

confidence: 75%

Section: Q-learningmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Security Risk Management via Dynamic Games with Learning

Bommannavar

Alpcan

Bambos

2011

2011 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

show abstract

“…An example is Stuxnet, a Windows-based worm that was recently discovered to target industrial software and equipment [10]. An administrator can enforce the security by dynamically updating the security policy of control systems [11], [12]. Once an attack occurs, the administrator can restore the system to normal operation.…”

Section: A Control Frameworkmentioning

confidence: 99%

Robust and resilient control design for cyber-physical systems with an application to power systems

Zhu

Başar

2011

IEEE Conference on Decision and Control and European Control Conference

Self Cite

161

View full text Add to dashboard Cite

Abstract-The tradeoff between robustness and resilience is a pivotal design issue for modern industrial control systems. The trend of integrating information technologies into control system infrastructure has made resilience an important dimension of the critical infrastructure protection mission. It is desirable that systems support state awareness of threats and anomalies, and maintain acceptable levels of operation or service in the face of unanticipated or unprecedented incidents. In this paper, we propose a hybrid theoretical framework for robust and resilient control design in which the stochastic switching between structure states models unanticipated events and deterministic uncertainties in each structure represent the known range of disturbances. We propose a set of coupled optimality criteria for a holistic robust and resilient design for cyber-physical systems. We apply this method to a voltage regulator design problem for a synchronous machine with infinite bus and illustrate the solution methodology with numerical examples.

show abstract

“…The survey [6] provides a selected set of works that use game-theoretic approaches in computer networks security and privacy problems. Zhu et al define a zero-sum stochastic game for the design of an Intrusion Detection System (IDS) and provide the stationary optimal strategy [7]. Robust algorithms against well-defined uncertainties are presented in [8].…”

Section: Introductionmentioning

confidence: 99%

Stochastic game approach for replay attack detection

Miao

Pajić

Pappas

2013

52nd IEEE Conference on Decision and Control

108

View full text Add to dashboard Cite

Abstract-The existing tradeoff between control system performance and the detection rate for replay attacks highlights the need to provide an optimal control policy that balances the security overhead with control cost. We employ a finite horizon, zero-sum, nonstationary stochastic game approach to minimize the worst-case control and detection cost, and obtain an optimal control policy for switching between controlcost optimal (but nonsecure) and secure (but cost-suboptimal) controllers in presence of replay attacks. To formulate the game, we quantify game parameters using knowledge of the system dynamics, controller design and utilized statistical detector. We show that the optimal strategy for the system exists, and present a suboptimal algorithm used to calculate the system's strategy by combining robust game techniques and a finite horizon stationary stochastic game algorithm. Our approach can be generalized for any system with multiple finite cost, time-invariant linear controllers/estimators/intrusion detectors.

show abstract

Dynamic policy-based IDS configuration

Cited by 68 publications

References 13 publications

Security Risk Management via Dynamic Games with Learning

Security Risk Management via Dynamic Games with Learning

Robust and resilient control design for cyber-physical systems with an application to power systems

Stochastic game approach for replay attack detection

Contact Info

Product

Resources

About