Graduate School and Research Center In communication systems

Computing the nash equilibria of intruder classification games

Dritsoula, Lemonia; Loiseau, Patrick; Musacchio, John

GAMESEC 2012, 3rd Conference on Decision and Game Theory for Security, November 2012, Budapest, Hungary / Also published in LNCS, Volume 7638/2012

We investigate the problem of classifying an intruder of two different types (spy or spammer). The classification is based on the number of file server and mail server attacks a network defender observes during a fixed window. The spammer naively attacks (with a known distribution) his main target: the mail server. The spy strategically selects the number of attacks on his main target: the file server. The defender strategically selects his classification policy: a threshold on the number of file server attacks. We first develop parameterized families of payoff functions for both players and analyze the Nash equilibria of the non-cooperative nonzero-sum game. We analyze the strategic interactions of the two players and the tradeoffs each one of them faces: The defender chooses a classification threshold that balances the cost of missed detections and false alarms while the spy seeks to hit the file server as much as possible while still evading detection. We give a characterization of the Nash equilibria in mixed strategies, and demonstrate how the Nash equilibria can be computed in polynomial time. We give two examples of the general model, one that involves forensics on the side of the defender and one that does not. Finally, we evaluate how investments in forensics and data logging could improve the Nash equilibrium payoff of the defender.

Document Doi Bibtex

Keywords:Nash equilibria, intruder classification, polynomial complexity
Type:Conference
Language:English
City:Budapest
Country:HUNGARY
Date:
Department:Networking and Security
Eurecom ref:3815
Copyright: © Springer. Personal use of this material is permitted. The definitive version of this paper was published in GAMESEC 2012, 3rd Conference on Decision and Game Theory for Security, November 2012, Budapest, Hungary / Also published in LNCS, Volume 7638/2012 and is available at : http://dx.doi.org/10.1007/978-3-642-34266-0_5
Bibtex: @inproceedings{EURECOM+3815, doi = {http://dx.doi.org/10.1007/978-3-642-34266-0_5}, year = {2012}, title = {{C}omputing the nash equilibria of intruder classification games }, author = {{D}ritsoula, {L}emonia and {L}oiseau, {P}atrick and {M}usacchio, {J}ohn}, booktitle = {{GAMESEC} 2012, 3rd {C}onference on {D}ecision and {G}ame {T}heory for {S}ecurity, {N}ovember 2012, {B}udapest, {H}ungary / {A}lso published in {LNCS}, {V}olume 7638/2012}, address = {{B}udapest, {HUNGARY}}, month = {11}, url = {http://www.eurecom.fr/publication/3815} }
See also: