Game Theoretical Model for Adaptive Intrusion Detection System

Abstract

We present a self-adaptation mechanism for network intrusion detection system based on the use of game-theoretical formalism. The key innovation of our method is a secure runtime definition and solution of the game and real-time use of game solutions for immediate system reconfiguration. Our approach is suited for realistic environments where we typically lack any ground truth information regarding traffic legitimacy/maliciousness and where the significant portion of system inputs may be shaped by the attacker in order to render the system ineffective. Therefore, we rely on the concept of challenge insertion: we inject a small sample of simulated attacks into the unknown traffic and use the system response to these attacks to define the game structure and utility functions. This approach is also advantageous from the security perspective, as the manipulation of the adaptive process by the attacker is far more difficult.

A CAMNEP

In order to evaluate the theoretical model in a production environment, we have used presented mechanism as a component of the CAMNEP network intrusion detection system [18], which is used to detect the attacks against computer networks by means of Network Behavior Analysis (NBA) techniques. This system processes NetFlow/IPFIX data provided by routers or other network equipment and uses this information to identify malicious traffic by means of collaborative, multi-algorithm anomaly detection. The system uses the multi-algorithm and multi-stage approach to optimize the error rate, while not compromising the performance of the system. The system contains two principal classes of classifying agents, which are able to evaluate the received traffic:

1.1 A.1 Detection Agents

Detection agents analyze raw network flows by their anomaly detection algorithms, exchange the anomalies between them and use the aggregated anomalies to build and update the long-term anomaly associated with the abstract traffic classes built by each agent. Each detection agent uses its own anomaly detection method, each works with a different traffic model based on a specific combination of aggregate traffic features. All detection agents map the same flows, together with the shared evaluation of these events, the aggregated immediate anomaly of these events determined by their anomaly detection algorithms, into the traffic clusters built using different features/metrics, thus building the aggregate anomaly hypothesis based on different premises. The aggregated anomalies associated with the individual traffic classes are built and maintained using the classic trust modeling techniques (not to be confused with the way trust is used in this work). The detection agents evaluate the anomaly of each network flow on the whole [0,1] interval, and the output of the detection agents is integrated by the aggregation agents.

1.2 A.2 Aggregation Agents

Aggregation agents $\alpha _{i}$ from the set $A = \{\alpha _{1},\dots ,\alpha _{g}\}$ represent the various aggregation operators used to build the joint conclusion regarding the normality/anomaly of the flows from the individual opinions provided by the detection agents. Each agent uses a distinct averaging operator (based on order-weighted averaging or simple weighted averaging) to perform the $R^{g_{det}}\rightarrow R$ transformation from the $g_{det}$-dimensional space to a single real value, thus defining one composite system output that integrates the results of several detection agents. The aggregation agents also dynamically determine the threshold values used to transform the continuous aggregated anomaly value in the $[0,1]$ interval into the crisp normal/anomalous assessment for each flow. The value of the threshold is either relative (i.e. leftmost part of the distribution) or absolute, based on the evaluation of the agent’s response to challenges.

The detection and aggregation agents annotate the individual flows $\varphi$ with a continuous anomaly/normality value in the $[0,1]$ interval, with the value 1 corresponding to perfectly normal events and the value 0 to completely anomalous ones. This continuous anomaly value describes an agent’s opinion regarding the anomaly of the event, and the agents apply adaptive or predefined thresholds to split the $[0,1]$ interval into the normal and anomalous classes. The threshold used by the aggregation agents divides the flows into two classes: normal and anomalous. The anomalous flows are those whose anomaly falls below the threshold, while the normal flows are those whose anomaly is above the threshold. This distinction allows us to introduce the components of the error rate. False Positives (FP) are the legitimate flows classified as anomalous, while the False Negatives (FN) are the malicious flows classified as normal.