RRE: A game-theoretic intrusion response and recovery engine

Saman A. Zonouz, Himanshu Khurana, William H. Sanders, Timothy M. Yardley

Research output: Contribution to journalArticle

61 Scopus citations

Abstract

Preserving the availability and integrity of networked computing systems in the face of fast-spreading intrusions requires advances not only in detection algorithms, but also in automated response techniques. In this paper, we propose a new approach to automated response called the response and recovery engine (RRE). Our engine employs a game-theoretic response strategy against adversaries modeled as opponents in a two-player Stackelberg stochastic game. The RRE applies attack-response trees (ART) to analyze undesired system-level security events within host computers and their countermeasures using Boolean logic to combine lower level attack consequences. In addition, the RRE accounts for uncertainties in intrusion detection alert notifications. The RRE then chooses optimal response actions by solving a partially observable competitive Markov decision process that is automatically derived from attack-response trees. To support network-level multiobjective response selection and consider possibly conflicting network security properties, we employ fuzzy logic theory to calculate the network-level security metric values, i.e., security levels of the system's current and potentially future states in each stage of the game. In particular, inputs to the network-level game-theoretic response selection engine, are first fed into the fuzzy system that is in charge of a nonlinear inference and quantitative ranking of the possible actions using its previously defined fuzzy rule set. Consequently, the optimal network-level response actions are chosen through a game-theoretic optimization process. Experimental results show that the RRE, using Snort's alerts, can protect large networks for which attack-response trees have more than 500 nodes.

Original languageEnglish
Article number6583161
Pages (from-to)395-406
Number of pages12
JournalIEEE Transactions on Parallel and Distributed Systems
Volume25
Issue number2
DOIs
StatePublished - Feb 1 2014

    Fingerprint

Keywords

  • and fuzzy logic and control
  • Intrusion response systems
  • Markov decision processes
  • network state estimation
  • stochastic games

ASJC Scopus subject areas

  • Hardware and Architecture
  • Signal Processing
  • Computational Theory and Mathematics

Cite this

Zonouz, S. A., Khurana, H., Sanders, W. H., & Yardley, T. M. (2014). RRE: A game-theoretic intrusion response and recovery engine. IEEE Transactions on Parallel and Distributed Systems, 25(2), 395-406. [6583161]. https://doi.org/10.1109/TPDS.2013.211