Optimizing Operating Cost of an Intrusion Detection System
- 1 Department of Computer Science, College of Engineering Roorkee, Roorkee, India
- 2 Department of Information and Communication Technologies, Atal Bihari Vajpayee-Indian Institute of Information Technology & Management, Gwalior, India
Abstract
Very often it so happens that the cost of operating an Intrusion Detection System (IDS) exceeds the cost of purchasing the IDS itself. In such cases, regular operation and maintenance of the system becomes expensive. Thus, it becomes essential to reduce the operating cost of the IDS without compromising on the performance and reliability of the IDS. Apart from the initial cost of procuring the IDS, other costs include cost of accessories required and cost of administration etc. In this paper we calculate the cost benefit tradeoffs of an IDS. We propose a method to determine the optimum operating point of the IDS. In an effort to solve the problems of the previously proposed metrics, we propose a decision tree based approach to calculate the cost of operating an IDS in a mobile ad hoc network. Mathematically and programmatically we deduce the minimum operating point of operation of an IDS and generate the receiver operating characteristic curve of the IDS. To further ascertain this, we use available network packet capture data and calculate the minimum operating cost of an IDS. The main motive behind this paper is to show that the cost of operating an IDS in a MANET can be minimized and hence the effectiveness and performance of the IDS can be maximized.
- R. Rachwald, “Advanced Persistent Threat (APT) Meets Industrialization—Imperva Data Security Blog,” 2010. http://blog.imperva.com/2010/11/trend-1-advancedpersistentthreat-apt-meets-industrialization.html
- “TrendLabs 2010 Annual Report.” http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/reports/rpt_threat-trnds-1h2010.pdf
- R. Lippmann, D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. McClung, D. Weber, S. H. Webster, D. Wyschograd, R. K. Cunningham and M. A. Zissman, “Evaluating Intrusion Detection Systems: The 1998 DARPA Off-Line Intrusion Detection Evaluation,” Proceedings of DARPA Information Survivability Conference and Exposition, Hilton Head, 25-27 January 2000, pp. 12-26.
- R. Durst, T. Champion, B. Witten, E. Miller and L. Spagnuolo, “Testing and Evaluating Computer Intrusion Detection Systems,” ACM, Vol. 42, No. 7, 1999, pp. 53-61. doi:10.1145/306549.306571
- J. McHugh, A. Christie and J. Allen, “Defending Yourself: The Role of Intrusion Detection Systems,” IEEE Software, Vol. 17, No. 5, 2000, pp. 42-51. doi:10.1109/52.877859
- S. Stolfo, W. Fan, W. Lee, A. Prodromidis and P. Chan, “Costbased Modeling for Fraud and Intrusion Detection: Results from the JAM Project,” Proceedings of DARPA Information Survivability Conference and Exposition, Los Alamitos, Vol. 2, 2000, pp. 130-144.
- A. Karygiannis, E. Antonakakis and A. Apostolopoulos, “Detecting Critical Nodes for MANET Intrusion Detection Systems,” Proceedings of 2nd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing, Spain, June 2006, pp. 7-15.
- T. Holz, “Security Measurements and Metrics for Networks,” Lecture Notes in Computer Science, Vol. 4909, 2008, pp. 157-165.
- I. Graf, R. Lippmann, R. Cunningham, D. Fried, K. Kendall, S. Webster and M. Zissman, “Results of DARPA 1998 Offline Intrusion Detection Evaluation,” Proceedings of the Workshop on Recent Advances in Intrusion Detection (RAID-1999), West Layefette, September 1999, pp. 7-9.
- W. Lee and S. Stolfo, “A Framework for Constructing Features and Models for Intrusion Detection Systems,” ACM Transactions on Information and System Security, Vol. 3, No. 4, 2000, pp. 227-261. doi:10.1145/382912.382914
- J. Gaffney and J. Ulvila, “Evaluation of Intrusion Detectors: A Decision Theory Approach,” Proceedings of 2001 IEEE Symposium on Security and Privacy, Oakland, 14-16 May 2001, pp. 50-61.