Growth and Sustainability of Managed Security Services Networks: An Economic Perspective

The original dataset consists of data on over four million connections each described by 42 attributes (e.g., duration, protocol, etc.) and identified either as normal traffic or one of 24 attack types. Our simulation is designed as follows: 1. A total of 20,000 connections were randomly selected from the original dataset to form the simulation training set; 16 attack types were represented in the simulation set. 2. The simulation training set was duplicated to represent the simulation test set with the same distribution of attacks as in the training set. 3. The 20,000 connections in the training set were randomly split into 20 groups of 1,000. These groups represent firms. It is assumed that each firm can independently observe 1,000 connections. 4. One firm was chosen to start the network (network size = 1, pool of connections = 1,000). 5. The proportion of attack connections in the connection pool was computed and provided the probability of attack, Pa. 6. Based on the pool of connections, the decision tree was built to classify the attacks using the C4.5 algorithm (Quinlan 1993). 7. The output of C4.5 algorithm was tested against a random subset of attacks from the testing set. The testing subset is half the size of the training subset. The proportion of misclassified attacks in the testing subset was computed and provided the probability of attack success, Ps (on the assumption that if the attack was not identified correctly, then no appropriate defense would be activated). 8. Network size was incremented by 1 (until it reached 20; for example, after first iteration, network size = 2, pool of connections = 2,000). Return to step 5.