Game Theoretic Framework for Reputation-Based Distributed Intrusion Detection

Host-Based Intrusion Detection Systems (HIDS)have been widely used to detect malicious behaviors of nodes in heterogenous networks. Collaborative intrusion detection can be more secure with a framework using reputation aggregation as an incentive. The problem of incentives and efficiency are well known problems that can be addressed in such collaborative environment. In this paper, we propose to use game theory to improve detection and optimize intrusion detection systems used in collaboration. The main contribution of this paper is that the reputation of HIDS is evaluated before modeling the game between the HIDS and attackers. Our proposal has three phases: the first phase builds reputation evaluation between HIDS and estimates the reputation for each one. In the second phase, a proposed algorithm elects a leader using reputation value to make decisions. In the last phase, using game theory the leader decides to activate or not the HIDS for optimization reasons.