title: Maintaining defender's reputation in anomaly detection against insider attacks.
abstract: We address issues related to establishing a defender's reputation in anomaly detection against two types of attackers: 1) smart insiders, who learn from historic attacks and adapt their strategies to avoid detection/punishment, and 2) naïve attackers, who blindly launch their attacks without knowledge of the history. In this paper, we propose two novel algorithms for reputation establishment--one for systems solely consisting of smart insiders and the other for systems in which both smart insiders and naïve attackers are present. The theoretical analysis and performance evaluation show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.
authors.affiliation: Department of Computer Science, George Washington University, Washington, DC 20052, USA. nzhang10@gwu.edu
authors.forename: Nan
authors.initials: N
authors.lastname: Zhang
authors.forename: Wei
authors.initials: W
authors.lastname: Yu
authors.forename: Xinwen
authors.initials: X
authors.lastname: Fu
authors.forename: Sajal K
authors.initials: SK
authors.lastname: Das
mesh_terms: D000465:Algorithms; D016494:Computer Security; D003661:Decision Support Techniques; D005607:Fraud / Q000517:prevention & control*; D005716:Game Theory; D008962:Models, Theoretical