{"type":"ScholarlyArticle","title":"Don't Bury your Head in Warnings: A Game-Theoretic Approach for Intelligent Allocation of Cyber-security Alerts","authors":[{"name":"Aaron Schlenker","slug":"aaron-schlenker","given":"Aaron","family":"Schlenker","affiliation":"University of Southern California , Los Angeles , CA 90089"},{"name":"Haifeng Xu","slug":"haifeng-xu","given":"Haifeng","family":"Xu","affiliation":"University of Southern California , Los Angeles , CA 90089"},{"name":"Mina Guirguis","slug":"mina-guirguis","given":"Mina","family":"Guirguis","affiliation":"Texas State University , San Marcos , Texas 78666"},{"name":"Christopher Kiekintveld","slug":"christopher-kiekintveld","given":"Christopher","family":"Kiekintveld","affiliation":"University of Texas at El Paso , El Paso , TX 79968"},{"name":"Arunesh Sinha","slug":"arunesh-sinha","given":"Arunesh","family":"Sinha","affiliation":"University of Michigan , Ann Arbor , MI 48109"},{"name":"Milind Tambe","slug":"milind-tambe","given":"Milind","family":"Tambe","affiliation":"University of Southern California , Los Angeles , CA 90089"},{"name":"Solomon Sonya","slug":"solomon-sonya","given":"Solomon","family":"Sonya","affiliation":"United States Air Force Academy , USA"},{"name":"Darryl Balderas","slug":"darryl-balderas","given":"Darryl","family":"Balderas","affiliation":"Texas State University , San Marcos , Texas 78666"},{"name":"Noah Dunstatter","slug":"noah-dunstatter","given":"Noah","family":"Dunstatter","affiliation":"Texas State University , San Marcos , Texas 78666; Academy , CO 80840"}],"abstract":"In recent years, there have been a number of successful cyber attacks on enterprise networks by malicious actors which have caused severe damage. These networks have Intrusion Detection and Prevention Systems in place to protect them, but they are notorious for producing a high volume of alerts. These alerts must be investigated by cyber analysts to determine whether they are an attack or benign. Unfortunately, there are magnitude more alerts generated than there are cyber analysts to investigate them. This trend is expected to continue into the future creating a need for tools which find optimal assignments of the incoming alerts to analysts in the presence of a strategic adversary. We address this challenge with the four following contributions: (1) a cyber screening game (CSG) model for the cyber network protection domain, (2) an NP-hardness proof for computing the optimal strategy for the defender, (3) an algorithm that finds the optimal allocation of experts to alerts in the CSG, and (4) heuristic improvements for computing allocations in CSGs that accomplishes significant scale-up which we show empirically to closely match the solution quality of the optimal algorithm.","doi":"10.24963/ijcai.2017/54","url":"https://ijcai.org/proceedings/2017/54","pdf":"https://ijcai.org/proceedings/2017/0054.pdf","markdown":"https://ijcai.org/proceedings/2017/54.md","bibtex":"https://ijcai.org/proceedings/2017/bibtex/54","volume":{"slug":"2017","title":"Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2017","url":"https://ijcai.org/proceedings/2017/","year":2017,"location":"Melbourne, Australia","dates":"19-25 August 2017","editors":"Carles Sierra","isbn":"978-0-9992411-0-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2017"},"section":"Agent-based and Multi-agent Systems","track":"Main track","number":54,"pages":{"first":381,"last":387},"keywords":["Agent-based and Multi-agent Systems: Noncooperative Games","Agent-based and Multi-agent Systems: Agent Theories and Models"],"videos":[],"references":[{"position":1,"raw":"[afc, 2017] 24th Air Force -AFCYBER, 2017. http://www.24af.af.mil. [aft, 2016] 688th Cyberspace Wing, 2016. http://www.24af.af.mil/Units/688th-Cyberspace-Wing. [Balas, 1985] Egon Balas. Disjunctive programming and a hierarchy of relaxations for discrete optimization prob- lems. SIAM Journal on Algebraic Discrete Methods, 6(3):466-486, 1985.","title":"Disjunctive programming and a hierarchy of relaxations for discrete optimization problems","authors":"Egon Balas","year":"1985","venue":"24th Air Force -AFCYBER","doi":null,"url":"http://www.24af.af.mil/Units/688th-Cyberspace-Wing","internal_url":null},{"position":2,"raw":"[Barbara and Jajodia, 2002] Daniel Barbara and Sushil Jajo- dia. Applications of data mining in computer security, vol- ume 6. Springer Science & Business Media, 2002.","title":"Applications of data mining in computer security","authors":"Jajodia Barbara","year":"2002","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Brown et al., 2016] Matthew Brown, Arunesh Sinha, Aaron Schlenker, and Milind Tambe. One size does not fit all: A game-theoretic approach for dynamically and effectively screening for threats. In AAAI conference on Artificial In- telligence (AAAI), 2016.","title":"One size does not fit all: A game-theoretic approach for dynamically and effectively screening for threats","authors":"Matthew Brown, Arunesh Sinha, Aaron Schlenker, Milind Tambe","year":"2016","venue":"AAAI conference on Artificial Intelligence (AAAI)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Budish et al., 2013] Eric Budish, Yeon-Koo Che, Fuhito Kojima, and Paul Milgrom. Designing random allocation mechanisms: Theory and applications. The American Eco- nomic Review, 103(2):585-623, 2013.","title":"Designing random allocation mechanisms: Theory and applications","authors":"Eric Budish, Yeon-Koo Che, Fuhito Kojima, Paul Milgrom","year":"2013","venue":"The American Economic Review","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[DAmico and Whitley, 2008] Anita DAmico and Kirsten Whitley. The real work of computer network defense ana- lysts. In VizSEC 2007, pages 19-37. Springer, 2008.","title":"The real work of computer network defense analysts","authors":"Anita Damico, Kirsten Whitley","year":"2008","venue":"VizSEC 2007","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Durkota et al., 2015] Karel Durkota, Viliam Lisỳ, Branislav Bošanskỳ, and Christopher Kiekintveld. Approximate so- lutions for attack graph games with imperfect information. In GameSec, pages 228-249. Springer, 2015.","title":"Approximate solutions for attack graph games with imperfect information","authors":"Durkota","year":"2015","venue":"GameSec","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Ganesan et al., 2016] Rajesh Ganesan, Sushil Jajodia, Ankit Shah, and Hasan Cam. Dynamic scheduling of cybersecurity analysts for minimizing risk using rein- forcement learning. ACM Transactions on Intelligent Systems and Technology (TIST), 8(1):4, 2016.","title":"Dynamic scheduling of cybersecurity analysts for minimizing risk using reinforcement learning","authors":"Rajesh Ganesan, Sushil Jajodia, Ankit Shah, Hasan Cam","year":"2016","venue":"ACM Transactions on Intelligent Systems and Technology (TIST)","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Hofmeyr and Forrest, 1999] Steven Andrew Hofmeyr and Stephanie Forrest. An immunological model of distributed detection and its application to computer security. PhD thesis, Citeseer, 1999.","title":"An immunological model of distributed detection and its application to computer security","authors":"Forrest ; Hofmeyr, Andrew Steven, Stephanie Hofmeyr, Forrest","year":"1999","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Hu et al., 2003] Wenjie Hu, Yihua Liao, and V Rao Vemuri. Robust anomaly detection using support vector machines. In Proceedings of the international conference on machine learning, pages 282-289, 2003.","title":"Robust anomaly detection using support vector machines","authors":"Wenjie Hu, Yihua Liao, V Rao Vemuri","year":"2003","venue":"Proceedings of the international conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Jain et al., 2010a] Manish Jain, Erim Kardes, Christopher Kiekintveld, Fernando Ordónez, and Milind Tambe. Se- curity games with arbitrary schedules: A branch and price approach. In AAAI, 2010.","title":"Security games with arbitrary schedules: A branch and price approach","authors":"Jain","year":"2010","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Jain et al., 2010b] Manish Jain, Jason Tsai, James Pita, Christopher Kiekintveld, Shyamsunder Rathi, Milind Tambe, and Fernando Ordóñez. Software assistants for randomized patrol planning for the lax airport police and the federal air marshal service. Interfaces, 40(4):267-290, 2010.","title":"Software assistants for randomized patrol planning for the lax airport police and the federal air marshal service","authors":"Jain","year":"2010","venue":"Interfaces","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kiekintveld et al., 2009] Christopher Kiekintveld, Manish Jain, Jason Tsai, James Pita, Fernando Ordóñez, and Milind Tambe. Computing optimal randomized resource allocations for massive security games. AAMAS, 2009.","title":"Computing optimal randomized resource allocations for massive security games","authors":"Christopher Kiekintveld, Manish Jain, Jason Tsai, James Pita, Fernando Ordóñez, Milind Tambe","year":"2009","venue":"AAMAS","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Korzhyk et al., 2010] Dmytro Korzhyk, Vincent Conitzer, and Ronald Parr. Complexity of computing optimal stack- elberg strategies in security resource allocation games. In AAAI, 2010.","title":"Complexity of computing optimal stackelberg strategies in security resource allocation games","authors":"Korzhyk","year":"2010","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Laszka et al., 2016] Aron Laszka, Jian Lou, and Yevgeniy Vorobeychik. Multi-defender strategic filtering against spear-phishing attacks. In AAAI, 2016.","title":"Multi-defender strategic filtering against spear-phishing attacks","authors":"Aron Laszka, Jian Lou, Yevgeniy Vorobeychik","year":"2016","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Letchford and Conitzer, 2013] Joshua Letchford and Vin- cent Conitzer. Solving security games on graphs via marginal probabilities. In AAAI, 2013.","title":"Joshua Letchford and Vincent Conitzer. Solving security games on graphs via marginal probabilities","authors":"Conitzer Letchford","year":"2013","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Patton et al., 2011] Robert M Patton, Justin M Beaver, Chad A Steed, Thomas E Potok, and Jim N Treadwell. Hierarchical clustering and visualization of aggregate cy- ber data. In 2011 7th International Wireless Communi- cations and Mobile Computing Conference, pages 1287- 1291. IEEE, 2011.","title":"Hierarchical clustering and visualization of aggregate cyber data","authors":"Justin M Robert M Patton, Chad A Beaver, Thomas E Steed, Jim N Potok, Treadwell","year":"2011","venue":"2011 7th International Wireless Communications and Mobile Computing Conference","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Riley et al., 2014] Michael Riley, Ben Elgin, Dune Lawrence, and Carol Matlock. Missed alarms and 40 million stolen credit card numbers: How target blew it. http://www.zdnet.com/article/anatomy-of-the-target-data- breach-missed-opportunities-and-lessons-learned/, 2014. Accessed: 2016-11-10.","title":"Missed alarms and 40 million stolen credit card numbers: How target blew it","authors":"Michael Riley, Ben Elgin, Dune Lawrence, Carol Matlock","year":"2016","venue":null,"doi":null,"url":"http://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/,2014","internal_url":null},{"position":18,"raw":"[Sommer and Paxson, 2010] Robin Sommer and Vern Pax- son. Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE symposium on security and privacy, pages 305-316. IEEE, 2010.","title":"Outside the closed world: On using machine learning for network intrusion detection","authors":"Paxson Sommer, Robin Sommer, Vern Paxson","year":"2010","venue":"IEEE symposium on security and privacy","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Spathoulas and Katsikas, 2013] Georgios Spathoulas and Sokratis Katsikas. Methods for post-processing of alerts in intrusion detection: A survey. 2013.","title":"Methods for post-processing of alerts in intrusion detection: A survey","authors":"Katsikas Spathoulas, Georgios Spathoulas, Sokratis Katsikas","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Tambe, 2011] Milind Tambe. Security and game theory: al- gorithms, deployed systems, lessons learned. Cambridge University Press, 2011.","title":"Security and game theory: algorithms, deployed systems, lessons learned","authors":"Milind Tambe","year":"2011","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Wu et al., 2015] Jianfa Wu, Dahao Peng, Zhuping Li, Li Zhao, and Huanzhang Ling. Network intrusion de- tection based on a general regression neural network op- timized by an improved artificial immune algorithm. PloS one, 10(3):e0120976, 2015.","title":"Network intrusion detection based on a general regression neural network optimized by an improved artificial immune algorithm","authors":"Wu","year":"2015","venue":"PloS one","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Yin et al., 2010] Zhengyu Yin, Dmytro Korzhyk, Christo- pher Kiekintveld, Vincent Conitzer, and Milind Tambe. Stackelberg vs. nash in security games: Interchangeabil- ity, equivalence, and uniqueness. In AAMAS, pages 1139- 1146. International Foundation for Autonomous Agents and Multiagent Systems, 2010.","title":"Stackelberg vs. nash in security games: Interchangeability, equivalence, and uniqueness","authors":"Dmytro Zhengyu Yin, Christopher Korzhyk, Vincent Kiekintveld, Milind Conitzer, Tambe","year":"2010","venue":"AAMAS","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Zimmerman, 2014] Carson Zimmerman. Ten strategies of a world-class cybersecurity operations center. MITRE cor- porate communications and public affairs. Appendices, 2014.","title":"Ten strategies of a world-class cybersecurity operations center. MITRE corporate communications and public affairs","authors":"Carson Zimmerman","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}