Zhang Nan, Yu Wei, Fu Xinwen, Das Sajal K
Department of Computer Science, George Washington University, Washington, DC 20052, USA.
IEEE Trans Syst Man Cybern B Cybern. 2010 Jun;40(3):597-611. doi: 10.1109/TSMCB.2009.2033564. Epub 2009 Nov 24.
We address issues related to establishing a defender's reputation in anomaly detection against two types of attackers: 1) smart insiders, who learn from historic attacks and adapt their strategies to avoid detection/punishment, and 2) naïve attackers, who blindly launch their attacks without knowledge of the history. In this paper, we propose two novel algorithms for reputation establishment--one for systems solely consisting of smart insiders and the other for systems in which both smart insiders and naïve attackers are present. The theoretical analysis and performance evaluation show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.
1）聪明的内部人员，他们从历史攻击中学习并调整策略以避免被检测/惩罚；2）天真的攻击者，他们在不了解历史的情况下盲目发动攻击。在本文中，我们提出了两种用于建立声誉的新颖算法——一种用于仅由聪明的内部人员组成的系统，另一种用于同时存在聪明的内部人员和天真的攻击者的系统。理论分析和性能评估表明，我们的声誉建立算法在检测与误报之间的权衡方面，可以显著提高针对内部攻击的异常检测性能。
