Using Bayesian Game Model for Intrusion Detection in Wireless Ad Hoc Networks

Transcription

1 Int J Communcatons, Network an ystem cences, 21, 3, o:14236/jcns21378 Publshe Onlne July 21 ( Usng Bayesan Game Moel for Intruson Detecton n Wreless A Hoc Networks Abstract Hua We, Hao un Department of Apple Mathematcs, Northwestern Polytechncal Unversty, X'an, Chna E-mal: wh86127@163com, hsun@nwpueucn Receve Aprl 12, 21; revse May 15, 21; accepte June 22, 21 Wreless a hoc network s becomng a new research fronter, n whch securty s an mportant ssue Usually some noes act malcously an they are able to o fferent kns of Denal of ervce (Dos) Because of the lmte resource, ntruson etecton system (ID) runs all the tme to etect ntruson of the attacker whch s a costly overhea We use game theory to moel the nteractons between the ntruson etecton system an the attacker, an a realstc moel s gven by usng Bayesan game We solve the game by fnng the Bayesan Nash equlbrum The results of our analyss show that the ID coul work ntermttently wthout compromsng ts effectveness At the en of ths paper, we prove an experment to verfy the ratonalty an effectveness of the propose moel Keywors: Wreless A Hoc Networks, Game Theory, Intruson Detecton ystem, Bayesan Nash Equlbrum 1 Introucton A wreless a hoc network (WANET) s a collecton of moble noes n whch the noes communcate wth each other wthout the help of any fxe nfrastructure [1] Noes wthn each other's rao range communcate rectly va wreless lnks, whle those that are far apart use other noes as relays Because of the lmte resource, some noes may act selfshness A hoc network msbehavor maybe nflcte by malcous noes, each of whch ams at harmng the network operaton; consequently, mechansms that enforce securty present a partcular challenge In orer to avo the harm of malcous noes, one way s the use of an ntruson etecton system, whch watches out for any ntruson an sets out an alarm when an ntruson s etecte The ntruson etecton an response mechansm s escrbe n [2] In recent years, we have seen researchers usng game theory n the area of a hoc networks It s a powerful tool n that t can be use to moel any system whch exhbts the characterstcs of a game In WANET, moble noes typcally have selfsh motvatons, lack of cooperaton among themselves, an have conflctng nterests wth each other These characterstcs make game theory (GT) a promsng tool to moel, analyze, an esgn varous aspects of WANET We have gven a two-player game to moel the nteractons between an ntruson etecton system an an attacker n wreless a hoc network Each efener s equppe wth an ntruson etecton system (ID) n orer to montor the actveness of an attacker The rest of the paper s organze as follows ecton 2 scusses relate work ecton 3 escrbes the one-stage game an mult-stage game, an Bayesan Nash equlbrum solutons are nvestgate ecton 4 presents numercal examples to verfy the effectveness of the propose game The concluson of the paper s n secton 5 2 Relate Work Game theory has been successfully apple to many scplnes nclung economcs, poltcal scence, an computer scence Game theory usually consers a multplayer ecson problem where multple players wth fferent objectves can compete an nteract wth each other In the context of ntruson etecton, several game theoretc approaches have been propose to wre networks, sensor networks, an a hoc networks Yenumula B Rey [3] scuss currently avalable ntruson etecton technques, attack moels usng game theory, an then propose a new framework to etect malcous noes n wreless sensor networks usng zero sum game approach for noes n the forwar ata path The frst part of the research proves the game moel wth probablty of energy requre for transferrng the ata packets The secon part erves the moel to etect the malcous noes usng probablty of acknowlegement at source Yuhan Moon, Volet R yrotuk [4] present CCM-MAC, a cooperatve CDMA-base mult-channel Copyrght 21 cres IJCN

2 H WEI ET AL 63 meum access control (MAC) protocol for moble a hoc networks (MANET) n whch each noe has one half- uplex transcever They prove an analyss of the maxmum throughput of CCM-MAC an valate t through smulaton n MATLAB, an also compare the throughput t acheves to IEEE 8211, a mult-channel MAC protocol, an a CDMA-base MAC protocol In [4] Ha Otrok et al aress the problem of ncreasng the effectveness of an ntruson etecton system (ID) for a cluster of noes n a hoc networks, an formulate a zero-sum non-cooperatve game between the leaer an ntruer They solve the game by fnng the Bayesan Nash equlbrum where the leaer s optmal etecton strategy s etermne Fnally, emprcal results are prove to support ther solutons Yu Lu, Crstna Comancu an Hong Man [5] have use statc Bayesan game an ynamc Bayesan game to moel the nteractons between attacker an efener n a hoc networks They have shown that the statc game leas to a mxe-strategy Bayesan nash equlbrum when the efener s belef of the attacker beng malcous s hgh, an the ynamc game has a mxestrategy Perfect bayesan equlbrum In [6], they have use game theory for evelopng effcent efense strateges for a network wth multple IDs They have formulate a non-zero-sum, noncooperatve attacker/efener game where the payoffs of players are non-strctly compettve They have showe that the game acheves at least a Nash equlbrum that leas to a efense strategy for the efener A two-player, non-cooperatve, non-zero-sum game has also been stue by Agah et al [7] an Alpan an Basar [8] to aress attack-efense problems n sensor networks In ther moels, each player s optmal strategy epens only on the payoff functon of the opponent an the game s assume to have complete nformaton [9-11] have gven the smlar moel, but the game s assume to have ncomplete nformaton Our moel s smlar to the ones mentone n the aforementone works n that t s a two-player, nonzero-sum an noncooperatve game However, our work s not ame at gvng the best strategy of the efener In ths paper, we have gven a one-stage game an mult-stage game In the propose works, the ID of efener runs all the tme, whch s a costly overhea for a battery-powere moble evce snce noes have lmte resource The results of our moel show that the ID coul work ntermttently 3 Bayesan Game 31 Game Moel In ths secton we present our game moel An ID attempts to etect ntruson from an attacker Hence, we may look at ths as a game between two players, the ID an the attacker The attacker s enote by an ID s enote by j The player s ntent s to attack the network wthout gettng caught, whereas that of the player j s to etect ntruson when the attacker attacks There s no cooperaton whatsoever between the two players Player has two types, regular that s enote by an malcous s enote by 1 Noe s type s hs prvate nformaton an ID s uncertan about ts opponent s type ID has only one type, that s regular or j an t s common knowlege for both players To present our moel, we make the followng assumptons An ID nees not be runnng all the tme urng whch the wreless a hoc network s up The pure strategy space of ths player s enote by = (Montor t of The frst strategy of player j epcts the stuaton when the ID s actve for some percentage (enote by t ) For example, f the ID etects by montorng the traffc, the ID perocally montors the traffc an the rest of the tme, t sts le Lkewse, an attacker nee not be tryng to attack the tme, Not montor), t, 1 1% of the tme The malcous type of player has two pure strateges: Attack s of the tme an Not attack, s, 1 The regular type of player has one pure strategy: Not attack The two players choose ther strateges smultaneously at the begnnng of the game, assumng common knowlege about the game (costs an belefs) We frst conser the scenaro of the ID Tables 1-2 llustrate the payoff matrx of the game n strategc form In the matrx, a represents the etecton rate of the ID, b represents the false alarm rate of the ID, an ab,,1 In the Table 1(a), the payoff matrx for the Table 1 The type of player (a) Payoff matrx of ID j s malcous \ j (2a1) tsm(1 t) sl tc sl btn tc (b) Payoff matrx of attacker \ j (1 2 atsm ) (1 tsl ) sca sl sca Table 2 The type of player s regular \ j (, btn tc ) (, ) Copyrght 21 cres IJCN

3 64 H WEI ET AL player j when player s malcous s gven m enotes the overall gan of the player for etectng the attack, an l s the overall loss for not etectng the attack urng the whole lfetme Costs of attackng an montorng are enote by an urng the whole pero In our moel, we assume that m l an l c a, c s reasonable snce otherwse the player oes not have ncentve to attack an the player j oes not have ncentve to montor The player j montors t of the tme, the player attacks s of the tme The probablty of the player j montorng when the attack s on s ts, urng whch the player j gets a gan of tsm mlarly, the probablty of the player j not montorng when the attack occurs s because of whch the player j loses an amount of (1 tsl ) tc s the cost ncurre ue to montorng The expecte payoff of etectng the attack epens on the value of a, whch s (2a1) tsm(1 t) sltc When the player j s not actve an there s an attack, so the payoff of the player j s sl The entry at poston (row 2, column 1) s c a c (1 t) s btn tc n s the overall loss ncurre by the player j for the false etecton The rest of the entry of the matrx s zero as the player plays Not attack The payoff matrx for the player when the player s malcous s efne as shown n Table 1(b) In contrast, the gan of player s the loss of player j, whch s (1 2a)tsm + (1 t)sl The entry at (row 1 column 2) s the same as n prevous scenaro For the other entres, when the player plays (Not attack), hs payoff s always The payoff matrx for the player when t s regular s gven n Table 2 The player has only one strategy when t s regular The payoff of player s always If player eces not to montor, hs payoff s ; f he eces to play j, he has the montorng cost tc an an expecte loss btn ue to the false alarm, so hs payoff s btn tc 32 One-tage Game The ntent of both players s to maxmze ther own payoff Ths mples that we assume that both players are ratonal uppose player j assgns a pror probablty to player s malcous In the followng, we use Bayesan Nash equlbrum (BNE) to analyze the game moel, base on the assumpton that s a common pror If player plays hs pure strategy par (Attack s of the tme f malcous, Not attack f regular), then the expecte payoff of player j s Ej ( j) ( atsm(1 a) tsm(1 t) sl tc) (1 )( btn tc ) E ( ( 2)) sl j j bn c o f, Ej( j) Ej( j), 2asm sm sl bn then the best strategy of player j s to play Montor t of the tme However, f player j plays ths strategy, Attack s of the tme wll not be the best strategy f player s malcous, an he wll transfer to play Not attack nstea Hence, ((Attack s of the tme f malcous, Not attack f regular), Montor t of the tme, ) s not a bn c BNE If, ((Attack s of the tme 2asm sm sl bn f malcous, Not attack f regular), Not montor, ) s a BNE mlarly, ((Not attack s of the tme f malcous, Not attack f regular), Not montor, ) s not a BNE THEOREM 1: In the escrbe game-theoretc moel, there s no pure-strategy BNE when satsfes the nequalty bn c 2asm sm sl bn We prevously showe that no pure-strategy BNE exsts for the game when bn c But 2asm sm sl bn there s a mxe-strategy BNE Let p be the probablty wth whch the player plays ts frst strategy Hence, (1 p) s the probablty wth whch t plays the secon strategy mlarly, let q be the probablty wth whch the player j plays ts frst strategy Hence, (1 q) s the probablty wth whch t plays the secon strategy Then the expecte payoff of player j s E j ( j) p ( atsm (1 a) tsm (1 t) sl tc) (1 p) ( btn tc) (1 )( btn tc) Ej( j( 2)) psl From Ej( j) E j ( j ), we get that the malcous type of player s equlbrum strategy s to play frst strategy wth probablty * bn c p (2asm ) sm sl bn an the expecte payoff of player s E( ) q( atsm (1 a) tsm (1 t) sl tca) (1 q)( slsc a ) E( ) Copyrght 21 cres IJCN

4 H WEI ET AL 65 From E( ) E( ), we get that the equlbrum strategy of player j s to play frst strategy wth probablty * l c q a 2atm tm tl THEOREM 2: In the escrbe game-theoretc moel, the strategy par ((Attack s of the tme wth probablty * p f malcous, Not attack f regular), Montor t of * the tme wth probablty q, ) s a mxe-strategy BNE The above escrbe game s a statc game, for whch the players maxmze ther utltes base on the payoff matrx for the game Due to the ffculty of assgnng accurate pror probabltes for player s type, we exten the statc to ynamc game, where the player j can upate hs belefs accorng to the Bayes rule 33 Mult-tage Game The aforesa one-stage game s statc Bayesan game, for whch the player j maxmzes hs payoff base on a fxe pror about the malcousness of hs opponent The lfetme of the network coul be broken own nto ntervals of the tme an our game coul be use as a repeate game over these ntervals o, we exten the one-stage game to mult-stage game We assume that the one-stage game s repeately playe n each tme pero t k, where k =, 1, An nterval of T secons maybe selecte for each stage game In orer to get a smple moel, we assume that T = 1 The payoffs of the players n each stage game are the same as n the proceeng one-stage game, an we assume that there s no scount factor wth respect to the payoffs of the players The extensve form of each stage game can be represente n a smlar manner as for the statc one-stage game In our moel, the player j 's type s known to all the player whle the player 's type s selecte from the type set ={malcous, regular} Knowng that the player 's type s a prvate nformaton Bayesan equlbrum [12] ctates that the player 's acton epens on hs type By observng the behavor of the player, the player j can calculate the posteror belef evaluaton functon ( ( )) t k 1 a t k usng the followng Bayes' rule t ( ( )) ( ( ) ) k a tk P a tk t ( ( )) k a t k t ( ( )) ( ( ) k a tk P a t k ) tk k where ( a ( t )) an Pa ( ( t) ) s the probablty that strategy a ( t ) k k s observe at ths stage of the game gven the type of the player From the assumpton of escrbe game, we know that P( a ( t ) Attack 1) ap b( 1 p) k P( a( tk) Not Attack 1) (1 a) p (1 b)(1 p ) Pa ( ( t) Attack ) a k P( a( tk) Not Attack ) 1 b LEMMA 1: the mult-stage game satsfes the four Bayesan contons -(4) 1) Posteror belefs are nepenent, an all types of player j have the same belefs, an even unexpecte events wll not change the nepenence assumpton for the type of the opponents 2) Bayes rule s use to upate belefs from t ( ( ) k a tk ) to t ( ( 1 1) k a t k ) whenever possble 3) The players o not sgnal what they o not know 4) All players must have the same belef about the type of another player Proof: conton s trvally satsfe because player j has only one type We can see that the multstage game satsfes from Equaton In our multstage game context, player 's sgnal s part of attack actons, thus (3) s satsfe Because there are only two players n the game at any stage, the conton (4) s satsfe THEOREM 3: The mult-stage game has a perfect Bayesan equlbrum (PBE) At stage game t k, uo to the upate belef (), the probablty p s also upate contnuously From the prevous analyss of secton 32, the malcous type of player 's equlbrum strategy s to play hs frst strategy wth probablty bn c p ()(2 asm sm sl bn) the equlbrum strategy of player j s to play hs frst strategy wth probablty l c q a (3) 2atm tm tl o the PBE of the game s gven as ( p, q, ()), wth ( p, q, ()) gven by Equatons -(3) 4 Example For each experment, we assume that m l 1, n 1 Fgures 1 an 2 assume s 85, t 85, c 5, Fgure 3 assumes t 85, c 5, a 9, b 2, an Fgure 4 assumes s 9, t 9, a 95, b 14 Fgure 5 assumes s 9, t 5, Copyrght 21 cres IJCN

5 66 H WEI ET AL a 95, b 2, c 5 For all four scenaros player j 's pror probablty 5 From Fgure 1, we see that the hgher a s, the faster posteror belef converges to 1 By contrast, Fgure 2 shows that the lower b s, the faster posteror belef converges to 1 In other wors, the etecton accuracy of the ID affects the convergence spee of player j 's posteror belef From Fgure 3, we see that the lower tme of attackng, the faster posteror belef converges to 1 From Fgure 4, we see that the hgher c, the faster the convergence spee of player j 's posteror belef wll be Fgure 5 shows the posteror belef of the player j for these two scenaros The belef for the frst scenaro Fgure 3 Convergence of player j s posteror belefs gven the observatons of a sequence of a sequence of consecutve Attack actons uner varous s Fgure 1 Convergence of player j s posteror belefs gven the observatons of a sequence of a sequence of consecutve Attack actons uner varous a Fgure 4 Convergence of player j s posteror belefs gven the observatons of a sequence of a sequence of consecutve Attack actons uner varous c converges to 1 faster than the secon scenaro Ths s because n the frst scenaro the player starts to attack earler compare to the secon scenaro Once the belef reaches 1, t oes not go own even f the player s not attackng snce the type has alreay been entfe 5 Conclusons Fgure 2 Convergence of player j s posteror belefs gven the observatons of a sequence of a sequence of consecutve Attack actons uner varous b In ths paper, our goal s to etermne whether t s essental to always keep the ID runnng wthout compromsng on ts effectveness Frst of all, we assume that the ID works ntermttently Then, we moel the nteracton between ntruson etecton system an an attacker as a one-stage game, an show that ths game has two Bayes an Nash equlbrums econ, we moel ths game as a mult-stage game, where ID oes not have fxe pror Copyrght 21 cres IJCN

6 H WEI ET AL 67 Fgure 5 Posteror belef probabltes about the type of ts opponent an can upate ts belef at the en of each stage of the game, an show that ths game has a mxe-strategy perfect Bayesan equlbrum The results of the propose two games show that ID coul work ntermttently whle gettng the same effectveness 6 Acknowlegements The paper s supporte by the Natonal Natural cence Founaton of Chna uner Grant Nos an References [1] R Ramanathan an J Re, A Bref Overvew of A Hoc Networks: Challenges an Drectons, IEEE Communcatons Magzne, Vol 4, No 5, 22, pp 2-22 [2] Y G Zhang an W Lee, Intruson Detecton n Wreless A-Hoc Networks, Proceengs of the 6 th Annual Internatonal Conference on Moble Computng an Networkng, Boston, 2, pp [3] Y B Rey, A Game Theory Approach to Detecton Mmalcous Noes n Wreless ensor Networks, Proceengs of the 29 Thr Internatonal Conference on ensor Technologes an Applcatons, Athens, June 18-23, 29, pp [4] H Otrok, N Mohamme, L Y Wang, M Debbab an P Bhattacharya, A Game-Theoretcal Intruson Detecton Moel for Moble A Hoc Networks, Computer Communcatons, Vol 31, No 4, 28, pp [5] Y Lu, C Comancu an H Man, A Bayesan Game Approach for Intruson Deteton n Wreless A Hoc Networks, Proceengs from the 26 Workshop on Game Theory for Communcatons an Networks, Psa, Italy, October 14, 26, pp 1-12 [6] Y Lu, H Man an C Comancu, A Game Theoretc Approach to Effcent Mxe trateges for Intruson Detecton, IEEE Internatonal Conference on Communcatons, Istanbul, 26, pp [7] A Agah, K Das, K Basu an M Asa, Intruson Detecton n ensor Networks: A Non-Cooperatve Game Approach, Proceengs of the Thr IEEE Internatonal ymposum on Network Computng an Applcatons, Boston, August-eptember 24, pp [8] T Alpcan an T Basar, A Game Theoretc Approach to Decson an Analyss n Network Intruson Detecton, Proceengs of the 42n IEEE Conference on Decson an Control, Mau, Hawa, December 23, pp [9] N Marchang an R Trpath, A Game Theoretcal Approach for Effcent Deployment of Intruson Detecton ystem n Moble A Hoc Networks, Proceengs of the 15th Internatonal Conference on Avance Computng an Communcatons, Guwahat, 27, pp [1] T Poongotha an K Jayara, A Noncooperatve Game Approach for Intruson Detecton n Moble A Hoc Networks, Proceengs of the 28 Internatonal Conference on Computng Communcaton an Networkng, t Thomas, VI, December 18-2, 28, pp 1-4 [11] A Patcha an J-M Park, A Game Theoretc Approach to Moelng Intruson Detecton n Moble A Hoc Networks, Proceengs of the 24 IEEE Workshop on Informaton Assurance an ecurty, Unte tates Mltary Acaemy, West Pont, NY, June 1-11, 24, pp 3-34 [12] M Wllem, Mnmax Theorem, Brkhauser, Boston, 1996 Copyrght 21 cres IJCN