A Game Theoretic Framework for Multi-agent Deployment in Intrusion Detection Systems

Abstract

Due to cost considerations there must exist in intrusion detection system, a trade-off between the user’s ease of access and capability of detecting attacks. The proposed framework applies two game theoretic models for economic deployment of intrusion detection agent. The first scheme models and analyzes the interaction behaviors between an attacker and intrusion detection agent within a non-cooperative game, and then the security risk value is derived from the mixed strategy Nash equilibrium. The second scheme uses the security risk value to compute the Shapley value of intrusion detection agent while considering the various threat levels. Therefore, the efficient agent allocation creates a minimum set of deployment costs. The experimental results show that with the proposed two-stage game theoretic model, the network administrator can quantitatively evaluate the security risk of each IDS agent and easily select the most critical and effective IDS agent deployment to meet the various threat levels to the network.