Optimal Thresholds for Anomaly-Based Intrusion Detection in Dynamical Environments

Abstract

Abstract. In cyber-physical systems, malicious and resourceful attackers could penetrate a system through cyber means and cause significant physical damage. Consequently, early detection of such attacks becomes integral towards making these systems resilient to attacks. To achieve this objective, intrusion detection systems (IDS) that are able to detect malicious behavior early enough can be deployed. However, practical IDS are imperfect and sometimes they may produce false alarms even for normal system behavior. Since alarms need to be investigated for any potential damage, a large number of false alarms may increase the operational costs significantly. Thus, IDS need to be configured properly, as oversensitive IDS could detect attacks very early but at the cost of a higher number of false alarms. Similarly, IDS with very low sensitivity could reduce the false alarms while increasing the time to detect the attacks. The configuration of IDS to strike the right balance between time to detecting attacks and the rate of false positives is a challenging task, especially in dynamic environments, in which the damage caused by a successful attack is time-varying. In this paper, using a game-theoretic setup, we study the problem of finding optimal detection thresholds for anomaly-based detectors implemented in dynamical systems in the face of strategic attacks. We formulate the problem as an attacker-defender security game, and determine thresholds for the detector to achieve an optimal trade-off between the detection delay and the false positive rates. In this direction, we first provide an algorithm that computes an optimal fixed threshold that remains fixed throughout. Second, we allow the detector's threshold to change with time to further minimize the defender's loss, and we provide a polynomial-time algorithm to compute time-varying thresholds, which we call adaptive thresholds. Finally, we numerically evaluate our results using a water-distribution network as a case study.

Cyberattack Detection Using Deep Generative Models with Variational Inference

“…A simple way to combat the difficulty of threshold setting is by using multiple thresholds, representing varying degrees of confidence. Advanced threshold setting models such as Laszka et al (2016) and Ghafouri et al (2016) can be coupled with the proposed VAE model in future studies for optimal threshold setting. Ghafouri et al (2016) used a game-theoretic setup to solve the problem of finding time-varying optimal detection thresholds in dynamical environments, with a numerical demonstration on water distribution systems.…”

“…Advanced threshold setting models such as Laszka et al (2016) and Ghafouri et al (2016) can be coupled with the proposed VAE model in future studies for optimal threshold setting. Ghafouri et al (2016) used a game-theoretic setup to solve the problem of finding time-varying optimal detection thresholds in dynamical environments, with a numerical demonstration on water distribution systems. The new mechanism can also use a secondary set of data (e.g., the BATADAL Training Dataset #2, which is found in Taormina et al 2018) for evaluation and adjustment of the optimal thresholds found.…”

Optimal detection of faulty traffic sensors used in route planning

“…e paper shows that computing optimal a acks and defenses is computationally expensive, and proposes heuristic algorithms for computing near-optimal strategies. Further, the work in [6] studies the problem of nding optimal thresholds for anomaly-based detectors implemented in dynamical systems in the face of strategic a acks. e paper provides algorithms to compute optimal thresholds that minimize losses considering best-response a acks.…”

Security-Aware Design of Cyber-Physical Systems for Control Applications

“…In (Ghafouri et al, 2016), the authors find the optimal threshold, using an exhaustive search, for anomaly-based intrusion detection in dynamical environments, but this is done based on the strong assumption that the expected damage incurred by a system from an undetected attack at any instant in time is known. This is a common problem with binary intrusion detection approaches.…”