动态环境中基于异常的入侵检测最优阈值研究
Optimal Thresholds for Anomaly-Based Intrusion Detection in Dynamical Environments
AI总结：
本文研究动态系统中基于异常的入侵检测器最优阈值配置，通过攻击者-防御者安全博弈模型，提出固定和自适应阈值算法以平衡检测延迟与误报率。
摘要：
在物理- cyber系统中，恶意攻击者可能通过网络手段入侵系统并造成严重物理损害。为此，部署能够检测恶意行为的入侵检测系统（IDS）至关重要。然而，实际IDS存在缺陷，可能产生大量误报，增加运营成本。因此，需合理配置IDS以在检测时间和误报率之间取得平衡，尤其是在动态环境中，攻击造成的损害随时间变化。本文研究在战略攻击下动态系统中基于异常的入侵检测器最优阈值问题，将其建模为攻击者-防御者安全博弈，确定检测延迟与误报率的最优权衡。首先，提供计算固定阈值的算法；其次，允许阈值随时间变化以进一步减少防御损失，并提供计算时变阈值的算法，称为自适应阈值。最后，通过水分布网络案例研究验证结果。
英文摘要：
In cyber-physical systems, malicious and resourceful attackers could penetrate the system through cyber means and cause significant physical damage. Consequently, detection of such attacks becomes integral towards making these systems resilient to attacks. To achieve this objective, intrusion detection systems (IDS) that are able to detect malicious behavior can be deployed. However, practical IDS are imperfect and sometimes they may produce false alarms for a normal system behavior. Since alarms need to be investigated for any potential damage, a large number of false alarms may increase the operational costs significantly. Thus, IDS need to be configured properly, as oversensitive IDS could detect attacks early but at the cost of a higher number of false alarms. Similarly, IDS with low sensitivity could reduce the false alarms while increasing the time to detect the attacks. The configuration of IDS to strike the right balance between time to detecting attacks and the rate of false positives is a challenging task, especially in dynamic environments, in which the damage incurred by a successful attack is time-varying. In this paper, we study the problem of finding optimal detection thresholds for anomaly-based detectors implemented in dynamical systems in the face of strategic attacks. We formulate the problem as an attacker-defender security game, and determine thresholds for the detector to achieve an optimal trade-off between the detection delay and the false positive rates. In this direction, first, we provide an algorithm that computes optimal fixed threshold that remains fixed throughout. Second, we allow detector's threshold to change with time to further minimize the defender's loss and provide an algorithm to compute time-varying thresholds, which we call adaptive thresholds. Finally, we numerically evaluate our results using a water distribution network as a case-study.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
