Towards an Information-Theoretic Framework for Analyzing Intrusion Detection Systems

IDS research still needs to strengthen mathematical foundations and theoretic guidelines. In this paper, we build a formal framework, based on information theory, for analyzing and quantifying the effectiveness of an IDS. We firstly present a formal IDS model, then analyze it following an informationtheoretic approach. Thus, we propose a set of information-theoretic metrics that can quantitatively measure the effectiveness of an IDS in terms of feature representation capability, classification information loss, and overall intrusion detection capability. We establish a link to relate these metrics, and prove a fundamental upper bound on the intrusion detection capability of an IDS. Our framework is a practical theory which is data trace driven and evaluation oriented in this area. In addition to grounding IDS research on a mathematical theory for formal study, this framework provides practical guidelines for IDS fine-tuning, evaluation and design, that is, the provided set of metrics g...

• Type: Conference
• Year: 2006
• Where: ESORICS
• Authors: Guofei Gu, Prahlad Fogla, David Dagon, Wenke Lee, Boris Skoric
• Keywords: ESORICS 2006, Formal Ids Model, IDS Research, Intrusion Detection Capability, Security Privacy