On The Establishment of Defender’s Reputation Against Insider Attacks

Report Number:  TR-GWU-CS-2009-002
Submit Date:  2009-09-22
Author:  Nan Zhang, Wei Yu, Xinwen Fu, Sajal K. Das

We address issues related to establishing a defender’s reputation in anomaly detection against two types of attackers: (i) smart insiders, who learn from historic attacks and adapt their strategies to avoid detection/punishment, and (ii) naive attackers, who blindly launch their attacks without knowledge of the history. In this paper, we propose two novel algorithms for reputation establishment - one for systems solely consisting of smart insiders, and the other for systems in which both smart insiders and naive attackers are present. Theoretical analysis and performance evaluation show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.