Stochastic Tools for Network Intrusion Detection

Abstract

With the rapid development of Internet and the sharp increase of network crime, network security has become very important and received a lot of attention. We model security issues as stochastic systems. This allows us to find weaknesses in existing security systems and propose new solutions. Exploring the vulnerabilities of existing security tools can prevent cyber-attacks from taking advantages of the system weaknesses. We propose a hybrid network security scheme including intrusion detection systems (IDSs) and honeypots scattered throughout the network. This combines the advantages of two security technologies. A honeypot is an activity-based network security system, which could be the logical supplement of the passive detection policies used by IDSs. This integration forces us to balance security performance versus cost by scheduling device activities for the proposed system. By formulating the scheduling problem as a decentralized partially observable Markov decision process (DEC-POMDP), decisions are made in a distributed manner at each device without requiring centralized control. The partially observable Markov decision process (POMDP) is a useful choice for controlling stochastic systems. As a combination of two Markov models, POMDPs combine the strength of hidden Markov Model (HMM) (capturing dynamics that depend on unobserved states) and that of Markov decision process (MDP) (taking the decision aspect into account). Decision making under uncertainty is used in many parts of business and science. We use here for security tools. We adopt a high-quality approximation solution for finite-space POMDPs with the average cost criterion, and their extension to DEC-POMDPs. We show how this tool could be used to design a network security framework.

Deceptive Kernel Function on Observations of Discrete POMDP

“…From defender's perspective, Miehling et al in [10] have adopted POMDP to optimally interfere the attacker's progression; Hu et al in [7] have also modeled the defense problem with POMDP and proposed online algorithm for adaptive defense measure. Yu and Brooks [22] have applied POMDP and its approximation solution as a stochastic tool for network intrusion detection. On the other hand, Sarraute et al [17] in an attacker's view have introduced POMDP in attack planning issue of penetration testing.…”