Intrusion Detection Systems (IDSs) are becoming essential to protecting modern information infrastructures. The effectiveness of an IDS is directly related to the computational resources at its disposal. However, it is difficult to guarantee especially with an increasing demand of network capacity and rapid proliferation of attacks. On the other hand, modern intrusions often come as sequences of attacks to reach some predefined goals. It is therefore critical to identify the best default IDS configuration to attain the highest possible overall protection within a given resource budget. This paper proposes a game theory based solution to the problem of optimal signature-based IDS configuration under resource constraints. We apply the concepts of indices of power, namely, Shapley value and Banzhaf-Coleman index, from cooperative game theory to quantify the influence or contribution of libraries in an IDS with respect to given attack graphs. Such valuations take into consideration the knowledge on common attack graphs and experienced system attacks and are used to configure an IDS optimally at its default state by solving a knapsack optimization problem.
To identify important factors for the performance of an IDS is another crucial investigation. In @cite_15 , observe several architectural and system parameters that contribute to the effectiveness of an IDS, such as operating system structure, main memory bandwidth and latency as well as the processor micro-architecture. Memory bandwidth and latency are identified as the most significant contributors to sustainable throughput. CPU power is important as well; however, it has been overlooked in the experiments due to the existence of other closely related architectural parameters, such as deep pipelining, level of parallelism, and caching.
@cite_15
1574450869
Due to the increasing gap between processor speed and memory access time, a large fraction of a program's execution time is spent in accesses to the various levels in the memory hierarchy. Hence, cache-aware programming is of prime importance. For efficiently utilizing the memory subsystem, many architecture-specific characteristics must be taken into account: cache size, replacement strategy, access latency, number of memory levels, etc.In this paper, we present a simulator for the accurate performance prediction of sequential and parallel programs on shared memory systems. It assists the programmer in locating the critical parts of the code that have the greatest impact on the overall performance. Our simulator is based on the Latency-of-Data-Access Model, that focuses on the modeling of the access times to different memory levels.We describe the design of our simulator, its configuration and its usage in an example application.