Summary
|
For Full-Text PDF, please login, if you are a member of IEICE, or go to Pay Per View on menu list, if you are a nonmember of IEICE. |
|
Constructing a Multilayered Boundary to Defend against Intrusive Anomalies Zonghua ZHANG Hong SHEN Publication IEICE TRANSACTIONS on Information and Systems Vol.E90-D No.2 pp.490-499 Publication Date: 2007/02/01 Online ISSN: 1745-1361 DOI: 10.1093/ietisy/e90-d.2.490 Print ISSN: 0916-8532 Type of Manuscript: PAPER Category: Application Information Security Keyword: intrusion detection, anomaly detection, information security, POMDP, Full Text: PDF(403.8KB)>>
Summary: We propose a model for constructing a multilayered boundary in an information system to defend against intrusive anomalies by correlating a number of parametric anomaly detectors. The model formulation is based on two observations. First, anomaly detectors differ in their detection coverage or blind spots. Second, operating environments of the anomaly detectors reveal different information about system anomalies. The correlation among observation-specific anomaly detectors is first formulated as a Partially Observable Markov Decision Process, and then a policy-gradient reinforcement learning algorithm is developed for an optimal cooperation search, with the practical objectives being broader overall detection coverage and fewer false alerts. A host-based experimental scenario is developed to illustrate the principle of the model and to demonstrate its performance. | ||||||||||
| ||||||||||
