Toward cost-sensitive modeling for intrusion detection and response

Abstract

Intrusion detection systems (IDSs) must maximize the realization of security goals while minimizing costs. In this paper, we study the problem of building cost-sensitive intrusion detection models. We examine the major cost factors associated with an IDS, which include development cost, operational cost, damage cost due to successful intrusions, and the cost of manual and automated response to intrusions.These cost factors can be qualified according to a defined attack taxonomy and site-specific security policies and priorities. We define cost models to formulate the total expected cost of an IDS, and present cost-sensitive machine learning techniques that can produce detection models that are optimized for user-defined cost metrics. Empirical experiments show that our cost-sensitive modeling and deployment techniques are effective in reducing the overall cost of intrusion detection.

Autonomous decision on intrusion detection with trained BDI agents

“…Lee [10] pointed out that a natural tendency in developing an intrusion detection system (IDS) is trying to maximize its technical effectiveness while neglecting the cost-benefit trade-off. An IDS needs to be cost-effective because it should cost no more than the expected level of loss from intrusions.…”

“…With respect to the response function, decision analysis [7,8] and cost-benefit modelling [9][10][11][12] are the most promising approaches. The former has been used to model the decision making process of taking actions against suspicious events and to evaluate IDS effectiveness.…”

A Network-Based Response Framework and Implementation

“…All sensor configurations are then tested to determine the global sensor configuration that satisfies all detection thresholds but has the lowest impact on resources. For the purposes of this implementation, resource impact is assessed by the sum of all resource costs of sensor configurations into a single value, which could be enhanced with a more thorough cost model [22] or use of the more advanced metrics previously discussed in Subsection 2.3. If a new sensor configuration is found, the IDS profile representing the new configuration is sent to the affected host-based agents.…”

“…These rules modify the overall SAV of a state based on the presence or absence of particular event instances, and can be synergistic (i.e., two event instances result in a net SAV greater than their sum) or dyssynergistic (i.e., two event instances result in a net SAV less than their sum). Cost models based on risk analysis [22] can also be adapted to determine these values.…”

Analysis of Data Dependency Based Intrusion Detection System

“…He found that in most cases such a rate is unattainable. Following that, researchers in [13] developed the techniques for building an intrusion detection system on the basis of cost-sensitive models. The first comprehensive study on the cost effectiveness of intrusion detection systems appeared in [5], which addresses the problem of finding the optimal configuration of a single intrusion detection system, and various combinations of multiple intrusion detection systems.…”