Analysis of a Markov decision process model for intrusion tolerance

We consider a simplest Markov decision process model for intrusion tolerance, assuming that (i) each attack proceeds through one or more steps before the system´s security fails and (ii) defensive responses targeting these intermediate steps may only sometimes thwart the attack. Our analysis shows that, even in the ideal case of perfect detectors, it can be sub-optimal in the long run to employ defensive responses while under attack; that is, depending on attack dynamics and response effectiveness, the total overhead of ongoing defensive countermeasures can exceed the total risk of intermittent security failures. Simulation experiments reveal that a tradeoff between these two types of costs persists in the realistic case of imperfect detectors. These experiments also shed light on (i) the extent to which increasing sensor uncertainty monotonically degrades achievable performance and (ii) the loss from optimum performance of two popular rule-based policies for response selection.