Dynamic probing for intrusion detection under resource constraints

We consider a large-scale cyber network with N components. Each component is either in a healthy state or an abnormal state. To model scenarios where attacks to the network may not follow a stochastic process and the attackers may adapt to the actions of the intrusion detection system (IDS) in an ar...

Full description

Saved in:
Bibliographic Details
Main Authors: Keqin Liu, Qing Zhao, Swami, Ananthram
Format: Conference Proceeding
Language:English
Subjects:
dynamic probing
Dynamic scheduling
Intrusion detection
Monitoring
non-stochastic multi-armed bandit
Probes
regret
Stochastic processes
Switches
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:We consider a large-scale cyber network with N components. Each component is either in a healthy state or an abnormal state. To model scenarios where attacks to the network may not follow a stochastic process and the attackers may adapt to the actions of the intrusion detection system (IDS) in an arbitrary and unknown way, we adopt a non-stochastic model in which the attack process at each component can be any unknown deterministic sequence. Due to resource constraints, the IDS can only choose K (K
ISSN:1550-3607
1938-1883
DOI:10.1109/ICC.2013.6654814