Playing with enemies – a game theoretic analysis on intrusion detection in heterogenous networks Jouer avec l’ennemi – une analyse de la détection d’intrusion dans les réseaux hétérogènes basée sur la théorie des jeux

Due to the dynamic, distributed and heterogenous nature of today’s networks, intrusion detection systems (IDSs) have become a necessary addition to the security infrastructure and are widely deployed as a complementary line of defense to the classical security approaches. In this paper, we address the intrusion detection problem in heterogenous networks consisting of nodes with different security assets. In our study, two crucial questions are: What are the expected behaviors of rational attackers? What is the optimal strategy of the defenders (IDSs)? We answer the questions by formulating the network intrusion detection as a non-cooperative game and performing an indepth analysis on the Nash equilibrium and the engineering implications behind. Based on our game theoretical analysis, we derive the expected behaviors of rational attackers, the minimum monitor resource requirement and the optimal strategy of the defenders. We then provide the guidelines for IDS design and deployment. Finally, we illustrate the application of our results to design efficient defense system in two typical scenarios. The numerical results show both the correctness of the analytical results and the effectiveness of the proposed guidelines.