Application of adversarial risk testing to anomaly-based network intrusion detection systems

This paper explores the decision-making process in the attacker-defender problem. First the hypothesis testing with Bayesian techniques with a game theoretical approach is presented. The result is improved through adversarial hypothesis testing, which incorporates the responses of attacker and defender in their decision-making processes. In this way it is possible to model in an accurate way how both agents decide their actions taking into account their assumptions on the behavior and mental processes of the other part. Then it presents an application in the field of information security to anomaly-based network intrusion systems. These systems monitor network or system activities for malicious activities or policy violations and produce reports in order to prevent subsequent attacks and help to identify where potential repairs are needed. Currently their algorithms are based on statistical tools with the aim of reducing errors taking into account the trade-off between the alpha and beta errors entailed by these detection systems. We claim the combination of agent-based models and adversarial hypotheses testing has the ability of improving these systems and helps in developing more efficient tools that take into account the rational and adaptive role of attackers.