Paper Info
Title
Towards an information-theoretic framework of intrusion detection for composed systems and robustness analyses
Abstract
Network-based Intrusion Detection Systems (NIDSs) are an important mechanism to identify malicious behaviour or policy violations within a network. Such detection systems typically face several challenges, among which are the base-rate fallacy and the resilience against adaptive adversaries. These challenges are often countered in modern NIDSs by combining multiple detection systems to diversify the used feature levels or utilize the advantages of multiple detection methods. However, currently there exists no suitable framework for a detailed analysis of such composed systems. Therefore, the contribution of this work is an evaluation framework for composed systems, which builds on previous information-theoretic approaches and highlights the utility of information-theoretic redundancies for robustness evaluations. This framework enables an attribution of the overall system performance to its individual components, to fine-tune parameters and to study the dynamics between classifiers. The versatility of the framework is demonstrated by designing and evaluating a composed NIDS example based on systems described in the literature and using an open data set. Studying the impact of an evasion attempt with adversarial examples on this system highlighted the importance of robustness against false-alarms as well as detection evasion. Moreover, the framework enables general insights on how to improve the design of composed NIDSs: based on the dynamics between classifiers, it can be shown that optimizing the operation point of each component individually does not necessarily maximize the overall system performance from an information-theoretic perspective. Additionally, it can be shown that existing classification redundancies might not be fully utilized during an attack on the NIDS components, due to a static system design. (c) 2022 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/ )
Year
DOI
Venue
2022
10.1016/j.cose.2022.102633
COMPUTERS & SECURITY
Keywords
DocType
Volume
Network intrusion detection, Adversarial robustness, Data-driven evaluation approaches, Performance evaluation metrics, Information theoretic framework, Composed detection systems
Journal
116
ISSN
Citations 
PageRank 
0167-4048
0
0.34
References 
Authors
0
3
Name
Order
Citations
PageRank
Tobias Mages100.34
Magnus Almgren227039.17
Christian Rohner316526.20