Constructing multi-layered boundary to defend against intrusive anomalies: an autonomic detection coordinator

Simple item page
dc.contributor.authorZhang, Z.
dc.contributor.authorShen, H.
dc.contributor.conferenceInternational Conference on Dependable Systems and Networks (2005 : Yokohama-shi, Japan)
dc.date.issued2005
dc.description© 2005 IEEE.
dc.description.abstractAn autonomic detection coordinator is developed in this paper, which constructs a multi-layered boundary to defend against host-based intrusive anomalies by correlating several observation-specific anomaly detectors. Two key observations facilitate the model formulation: First, different anomaly detectors have different detection coverage and blind spots; Second, diverse operating environments provide different kinds of information to reveal anomalies. After formulating the cooperation between basic detectors as a partially observable Markov decision process, a policy-gradient reinforcement learning algorithm is applied to search in an optimal cooperation manner, with the objective to achieve broader detection coverage and fewer false alerts. Furthermore, the coordinator’s behavior can be adjusted easily by setting a reward signal to meet the diverse demands of changing system situations. A preliminary experiment is implemented, together with some comparative studies, to demonstrate the coordinator’s performance in terms of admitted criteria.
dc.description.statementofresponsibilityZonghua Zhang, Hong Shen
dc.identifier.citation2005 International Conference on Dependable Systems and Networks, 28 June-1 July 2005, Yokohama, Japan : proceedings / sponsored by IEEE Computer Society Technical Committee on Fault-Tolerant Computing, IFIP WG 10.4 on Dependable Computing and Fault Tolerance, IEICE Technical Group on Dependable Computing ; in cooperation with University of Tokyo, Japan ... [et al.], pp. 118-127
dc.identifier.doi10.1109/DSN.2005.30
dc.identifier.isbn0769522823
dc.identifier.orcidShen, H. [0000-0002-3663-6591] [0000-0003-0649-0648]
dc.identifier.urihttp://hdl.handle.net/2440/36929
dc.language.isoen
dc.publisherIEEE Computer Society
dc.publisher.placeOnline
dc.source.urihttp://dx.doi.org/10.1109/dsn.2005.30
dc.titleConstructing multi-layered boundary to defend against intrusive anomalies: an autonomic detection coordinator
dc.typeConference paper
pubs.publication-statusPublished

Files

Original bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
hdl36929.pdf
Size:
349.74 KB
Format:
Adobe Portable Document Format
Download

Collections

Computer Science publications