Constructing a Multilayered Boundary to Defend against Intrusive Anomalies

Zonghua ZHANG  Hong SHEN  

IEICE TRANSACTIONS on Information and Systems   Vol.E90-D   No.2   pp.490-499
Publication Date: 2007/02/01
Online ISSN: 1745-1361
DOI: 10.1093/ietisy/e90-d.2.490
Print ISSN: 0916-8532
Type of Manuscript: PAPER
Category: Application Information Security
intrusion detection,  anomaly detection,  information security,  POMDP,  

Full Text: PDF>>
Buy this Article

We propose a model for constructing a multilayered boundary in an information system to defend against intrusive anomalies by correlating a number of parametric anomaly detectors. The model formulation is based on two observations. First, anomaly detectors differ in their detection coverage or blind spots. Second, operating environments of the anomaly detectors reveal different information about system anomalies. The correlation among observation-specific anomaly detectors is first formulated as a Partially Observable Markov Decision Process, and then a policy-gradient reinforcement learning algorithm is developed for an optimal cooperation search, with the practical objectives being broader overall detection coverage and fewer false alerts. A host-based experimental scenario is developed to illustrate the principle of the model and to demonstrate its performance.