Game Theory Model for Intrusion Prevention in Computer Networks
No system is completely secure, but it’s possible to analyze system vulnerabilities, take security measures and thus reduce the likelihood of system intrusions. One tool to reduce this probability of intrusion is to implement intrusion prevention systems, which analyze network traffic to determine anomalous behavior and take security measures with the agents that exhibit these behaviors. This document proposes a game theory model based in an evaluation of works related in the area that could be the basis of an algorithm for the prevention of intrusions in networks.
A Hybrid Intrusion Detection by Game Theory Approaches in MANET
In general, mobile ad hoc networks (MANET) are formed dynamically by an autonomous system of mobile nodes that are connected via wireless links without using an existing network infrastructure or centralized administration. The hosts establish infrastructure and cooperate to forward data in a multi-hop fashion. Due to their communication type and resources constraint, MANETs are vulnerable to diverse types of attacks and intrusions. In this paper, we proposed a method for prevention internal intruder and detection external intruder by using game theory in mobile ad hoc network. One optimal solution for reducing the resource consumption of detection external intruder is to elect a cluster head for each cluster to provide intrusion service to other nodes in the its cluster, we call this mode, normal mode. Normal mode is only suitable when the probability of attack is low. Once the probability of attack is high, victim nodes should launch their own IDS to detect and thwart intrusions and we call perfect mode. In this paper cluster head should not be malicious or selfish node and must detect external intrusion in its cluster with enough resource and honest behavior. Our hybrid method has three phases: the first phase building trust relationship between nodes and estimation trust value for each node to prevent internal intrusion. In the second phase we propose an optimal method for cluster head election by using trust value; and in the third phase, finding the threshold value for notifying the victim node to launch its IDS once the probability of attack exceeds that value. In first and third phase we apply Bayesian game. Our hybrid method due to using game theory, trust value and honest cluster head election algorithm can effectively improve the network security, performance and reduce resource consumption.
Thwarting attacks on ZigBee - Removal of the KillerBee stinger
Wireless Sensor Networks (WSNs) have recently emerged as an important research topic. Due to the enormous number of sensor nodes and the constrained resources, specific research challenges can be identified with respect to security. Almost all available commercial and research sensor nodes are equipped with ZigBee transceiver chips, and thus making ZigBee the de-facto standard in WSN communication. Since Joshua Wright's KillerBee Framework was released with its focus on exploring and exploiting the security of ZigBee networks, non security-hardened WSNs increase the risk of being vulnerable against certain attacks such as simple association flooding and packet replay attacks. We propose an anomaly-based approach intrusion detection system (IDS) optimized for ZigBee-based WSN to protect ZigBee-based WSN nodes against KillerBee supported attacks. We describe the KillerBee attack procedure and propose an approach of guarding a ZigBee transceiver. Based on an extended sensor node/network simulation and analysis framework, we demonstrate furthermore how our anomaly-based detection engine can thwart attacks on a ZigBee transceiver.