论文标题
游戏理论Neyman-Pearson检测以战斗战略逃避
Game-Theoretic Neyman-Pearson Detection to Combat Strategic Evasion
论文作者
论文摘要
网络系统中的安全性在很大程度上取决于识别和识别对抗性行为。传统的检测方法着眼于特定类别的攻击，并且由于旨在绕开战略性绕过检测而越来越隐秘和欺骗性攻击变得不足。这项工作旨在发展一个整体理论，以对抗这种回避攻击。我们专注于扩展基于Neyman-Pearson（NP）假设测试公式的基于统计的检测方法。我们提出了游戏理论框架，以捕获战略性回避攻击者与逃避意识的NP检测器之间的冲突关系。通过分析攻击者和NP检测器的平衡行为，我们使用平衡接收器 - 手术特征（EROC）曲线来表征它们的性能。我们表明，逃避意识的NP检测器的表现优于被动的，前者可以战略性地对抗攻击者的行为，并根据收到的消息自适应修改其决策规则。此外，我们将框架扩展到一个顺序设置，用户发送相同分布的消息。我们通过对异常检测的案例研究来证实分析结果。
The security in networked systems depends greatly on recognizing and identifying adversarial behaviors. Traditional detection methods focus on specific categories of attacks and have become inadequate for increasingly stealthy and deceptive attacks that are designed to bypass detection strategically. This work aims to develop a holistic theory to countermeasure such evasive attacks. We focus on extending a fundamental class of statistical-based detection methods based on Neyman-Pearson's (NP) hypothesis testing formulation. We propose game-theoretic frameworks to capture the conflicting relationship between a strategic evasive attacker and an evasion-aware NP detector. By analyzing both the equilibrium behaviors of the attacker and the NP detector, we characterize their performance using Equilibrium Receiver-Operational-Characteristic (EROC) curves. We show that the evasion-aware NP detectors outperform the passive ones in the way that the former can act strategically against the attacker's behavior and adaptively modify their decision rules based on the received messages. In addition, we extend our framework to a sequential setting where the user sends out identically distributed messages. We corroborate the analytical results with a case study of anomaly detection.
