Data fusion strategies for mobile threats detection

Mobile equipments are an attractive target for network threats, due to their wide connectivity that expose them to various kinds of attacks. Besides specific security applications like mobile antiviruses installed into the devices, countermeasures can also be taken at the network operator side, where much larger computational power as well as management information are available. We dwell on possible improvements of systems for threats detection which may result from integrating several pieces of information, collected in different zones, in order to reduce the false alarm and the miss detection rates with respect to a single detector. In our proposal, each node involved in the system implements a threat detection based on the information it collects. Therefore the local decisions are gathered by a Fusion Center in charge of the final decision. Three different fusion strategies are compared, both in case of uncorrelated and correlated local detectors: (i) an optimal one based on the MAP rule, (ii) a majority voting rule having the merit of simplicity and turning out to achieve reasonable performances in the special case of independent detectors with comparable accuracies, (iii) an adaptive linear combiner followed by an hard limiter.