Please use this identifier to cite or link to this item:
https://hdl.handle.net/20.500.11851/6923
Title: | Intrusion-Detection Policies for It Security Breaches | Authors: | Ögüt, Hulisi Çavuşoğlu, Hüseyin Raghunathan, Şrinivaşan |
Keywords: | IT security dynamic programming stochastic model applications decision analysis |
Publisher: | Informs | Source: | Workshop on Informational Technology and Systems (WITS 2003) -- 2003 -- Seattle, WA | Abstract: | Intrusion-detection systems (IDSs) form an important component of IT security architectures, but the low proportion of hackers in the user population severely limits the usefulness of IDSs. Thus, even when the IDS is good, an intrusion signal may not imply that the user is more likely to be a hacker than a normal user. Ignoring the low base rate for the proportion of hackers results in acting on every intrusion signal, which is costly because of the high rate of false alarms. This problem is known as the base-rate fallacy in IDSs. On the other hand, ignoring intrusion signals renders IDSs useless. We propose and analyze waiting-time policies, which specify a response to signals from IDSs. We formulate the problem as a stochastic dynamic programming model and derive the optimal waiting time before acting upon an intrusion signal. Because the optimal policy is difficult to implement in many situations, we also derive and theoretically analyze a myopic policy. Our simulations suggest that the behavior of the myopic policy is qualitatively similar to that of the optimal policy. Further, the myopic policy performs better than other policies often used in practice, such as the Bayes policy and m-strike policies. The myopic policy can be implemented easily in a decision support system that supplements an IDS to mitigate the base-rate fallacy and to improve the value of the IDS. | URI: | https://doi.org/10.1287/ijoc.1070.0222 https://hdl.handle.net/20.500.11851/6923 |
ISSN: | 1091-9856 1526-5528 |
Appears in Collections: | İşletme Bölümü / Department of Management Scopus İndeksli Yayınlar Koleksiyonu / Scopus Indexed Publications Collection WoS İndeksli Yayınlar Koleksiyonu / WoS Indexed Publications Collection |
Show full item record
CORE Recommender
SCOPUSTM
Citations
13
checked on Dec 21, 2024
WEB OF SCIENCETM
Citations
10
checked on Oct 5, 2024
Page view(s)
88
checked on Dec 16, 2024
Google ScholarTM
Check
Altmetric
Items in GCRIS Repository are protected by copyright, with all rights reserved, unless otherwise indicated.