An Intrusion Detection System Based On Game Theory

Since the problem of network security is more and more severe today, how to detect and act the intrusion quickly and precisely through the intrusion detection system is very important to the network security. However, most existing intrusion detection systems and intrusion detection models all have their deficiencies, especially have deficiencies in detection algorithm and decision mechanism. Thus how to establish an efficient intrusion detection system to win the counterwork between the network attacker and defender is put in an urgent need.Due to the existing intrusion detection systems most need human intervention both in detection and decision making, an intrusion detection system is put forward in this paper. This system assesses and weighs with the results from the detector and make the precise decision to act the intrusion based on the game between the network attacker and defender after automatically label the data sets using the outlier detection algorithm.In the part of detection algorithm, an outlier detection algorithm based on distance (DBOM algorithm) is designed in this paper and the algorithm overcomes the deficiency of the traditional algorithm in time complexity. This algorithm reduces the executing time greatly and thus improves the intrusion detection efficiency by using the selection of active data with high weights and reading in block technologies.In the part of decision and control mechanism, a quantitative decision and control framework is established based on game theory in this paper. The framework simulates the process of the network attacking, assesses the cost caused by the intrusion, weighs with the two kinds of the false alarms and the limited network resources and acts the intrusion more precisely. Thus it improves the efficiency of the intrusion detection system.In all, the emulation and experiment results shows that the intrusion detection system based on game theory improves the efficiency of the intrusion detection system both in detection and decision making mechanism.