NDLI: M-AID: An adaptive middleware built upon anomaly detectors for intrusion detection and rational response

Please wait, while we are loading the content...

M-AID: An adaptive middleware built upon anomaly detectors for intrusion detection and rational response

Content Provider	ACM Digital Library
Author	Zhang, Zonghua Shen, Hong
Copyright Year	2009
Abstract	Anomaly-based intrusion detection is about the discrimination of malicious and legitimate behaviors on the basis of the characterization of system normality in terms of particular observable subjects. As the system normality is constructed solely from an observed sample of normally occurring patterns, anomaly detectors always suffer excessive false alerts. Adaptability is therefore a desirable feature that enables an anomaly detector to alleviate, if not eliminate, such annoyance. To achieve that, we either design self-learning anomaly detectors to capture the drifts of system normality or develop postprocessing mechanisms to deal with the outputs. As the former methodology is usually scenario- and application-specific, in this article, we focus on the latter one. In particular, our design starts from three key observations: (1) most of anomaly detectors are threshold based and parametric, that is, configurable by a set of parameters; (2) anomaly detectors differ in operational environment and operational capability in terms of detection coverage and blind spots; (3) an intrusive anomaly may leave traces across multiple system layers, incurring different observable events of interest. Firstly, we present a statistical framework to formally characterize and analyze the basic behaviors of anomaly detectors by examining the properties of their operational environments. The framework then serves as a theoretical basis for developing an adaptive middleware, which is called M-AID, to optimally integrate a number of observation-specific parameterizable anomaly detectors. Specifically, M-AID treats these fine-grained anomaly detectors as a whole and casts their collective behaviors in a framework which is formulated as a Multiagent Partially Observable Markov Decision Process (MPO-MDP). The generic anomaly detection models of M-AID are thus automatically inferred via a reinforcement learning algorithm which dynamically adjusts the behaviors of anomaly detectors in accordance with a reward signal that is defined and quantified by a suit of evaluation metrics. Fundamentally, the distributed and autonomous architecture enables M-AID to be scalable, dependable, and adaptable, and the reward signal allows security administrators to specify cost factors and take into account the operational context for taking rational response. Finally, a host-based prototype of M-AID is developed, along with comprehensive experimental evaluation and comparative studies.
Starting Page	1
Ending Page	35
Page Count	35
File Format	PDF
ISSN	15564665
e-ISSN	15564703
DOI	10.1145/1636665.1636670
Volume Number	4
Issue Number	4
Journal	ACM Transactions on Autonomous and Adaptive Systems (TAAS)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2009-11-30
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Anomaly detection POMDP Intrusion detection Network security Security metrics Security policy
Content Type	Text
Resource Type	Article
Subject	Control and Systems Engineering Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Network intrusion detection through Adaptive Sub-Eigenspace Modeling in multiagent systems

An adaptive automatically tuning intrusion detection system

Network Immunity: What can we learn from nature for network protection?

NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems

Design and Analysis of Multimodel-Based Anomaly Intrusion Detection Systems in Industrial Process Automation

Evaluation of control flow traces in software applications for intrusion detection

Distributed Agent Architecture for Intrusion Detection Based on New Metrics

Adaptive cyberdefense for survival and intrusion tolerance

Online Adaptive Anomaly Detection for Augmented Network Flows

M-AID: An adaptive middleware built upon anomaly detectors for intrusion detection and rational response

Similar Documents

Network intrusion detection through Adaptive Sub-Eigenspace Modeling in multiagent systems

An adaptive automatically tuning intrusion detection system

Network Immunity: What can we learn from nature for network protection?

NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems

Design and Analysis of Multimodel-Based Anomaly Intrusion Detection Systems in Industrial Process Automation

Evaluation of control flow traces in software applications for intrusion detection

Distributed Agent Architecture for Intrusion Detection Based on New Metrics

Adaptive cyberdefense for survival and intrusion tolerance

Online Adaptive Anomaly Detection for Augmented Network Flows

M-AID: An adaptive middleware built upon anomaly detectors for intrusion detection and rational response