A Learning-based approach to reactive security

IEEE Transactions on Dependable and Secure Computing

Volumn 9, Issue 4, 2012, Pages 482-493

  Barth, Adam ^a   Rubinstein, Benjamin I P ^b   Sundararajan, Mukund ^a   Mitchell, John C ^c   Song, Dawn ^d   Bartlett, Peter L ^d  

^a GOOGLE INC   (United States)

^b MICROSOFT RESEARCH   (United States)

^c Stanford University   (United States)

^d UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

adversarial learning; attack graphs; game theory.; online learning; Reactive security; risk management

Indexed keywords

GAME THEORY; NETWORK SECURITY; RISK MANAGEMENT;

ADVERSARIAL LEARNING; ATTACK GRAPH; COMPETITIVE RATIO; GAME-THEORETIC MODEL; LEARNING-BASED APPROACH; ONLINE LEARNING; PROACTIVE SECURITY; REACTIVE SECURITY;

E-LEARNING;

EID: 84861164054     PISSN: 15455971     EISSN: None     Source Type: Journal    
DOI: 10.1109/TDSC.2011.42     Document Type: Article

References (33)

1. J.P. Pironti, "Key Elements of an Information Security Program," Information Systems Control J., vol. 1, 2005.
2. K. Kark, J. Penn, and A. Dill, "2008 CISO Priorities: The Right Objectives but the Wrong Focus," Le Magazine de la Sécurité Informatique, Apr. 2009.
3. C. Beard, "Introducing Test Pilot," http://labs.mozilla.com/ 2008/03/introducing-test-pilot/, Mar. 2008.
4. M. Cremonini, "Evaluating Information Security Investments from Attackers Perspective: The Return-On-Attack (ROA)," Proc. Fourth Workshop the Economics of Information Security, 2005.
5. A. Barth, B.I.P. Rubinstein, M. Sundararajan, J.C. Mitchell, D. Song, and P.L. Bartlett, "A Learning-Based Approach to Reactive Security," Proc. 14th Int'l Conf. Financial Cryptography and Data Security (FC '10), pp 192-206, 2010.
6. D. Fisher, "Multi-Process Architecture," http://dev.chromium. org/developers/design-documents/multi-process-architecture, July 2008.
7. J. Friedberg, "Internet Fraud Battlefield," http://www.ftc.gov/bcp/workshops/proofpositive/Battlefield-Overview.pdf, Apr. 2007.
8. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G.M. Voelker, V. Paxson, and S. Savage, "Spamalytics: An Empirical Analysis of Spam Marketing Conversion," Proc. ACM Conf. Computer and Comm. Security, pp. 3-14, 2008.
9. B. Warner, "Home PCs Rented Out in Sabotage-for-Hire Racket," Reuters, July 2004.
10. J. Franklin, V. Paxson, A. Perrig, and S. Savage, "An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants," Proc. ACM Conf. Computer and Comm. Security, pp. 375-388, 2007.
11. M. Howard, "Attack Surface: Mitigate Security Risks by Minimizing the Code You Expose to Untrusted Users," MSDN Magazine, http://msdn.microsoft.com/en-us/magazine/cc163882.aspx, Nov. 2004.
12. E. Rescorla, "Is Finding Security Holes a Good Idea?," IEEE Security and Privacy, vol. 3, no. 1, pp. 14-19, Jan./Feb. 2005. (Pubitemid 40325577)
13. D. Chakrabarty, A. Mehta, and V.V. Vazirani, "Design is As Easy As Optimization," Proc. 33rd Int'l Colloquium Automata, Languages and Programming (ICALP), pp. 477-488, 2006. (Pubitemid 44113322)
14. E. Ordentlich and T.M. Cover, "The Cost of Achieving the Best Portfolio in Hindsight," Math. of Operations Research, vol. 23, no. 4, pp. 960-982, 1998. (Pubitemid 128508566)
15. Y. Freund and R.E. Schapire, "Adaptive Game Playing Using Multiplicative Weights," Games and Economic Behavior, vol. 29, pp. 79-103, 1999.
16. Y. Freund and R. Schapire, "A Short Introduction to Boosting," J. Japanese Soc. for Artificial Intelligence, vol. 14, no. 5, pp. 771-780, 1999.
17. N. Cesa-Bianchi, Y. Freund, D. Haussler, D.P. Helmbold, R.E. Schapire, and M.K. Warmuth, "How to Use Expert Advice," J. Assoc. for Computing Machinery, vol. 44, no. 3, pp. 427-485, May 1997. (Pubitemid 127634586)
18. N. Cesa-Bianchi, Y. Freund, D.P. Helmbold, D. Haussler, R.E. Schapire, and M.K. Warmuth, "How to Use Expert Advice," Proc. 25th Ann. ACM Symp. Theory of Computing, pp. 382-391, 1993. (Pubitemid 23668758)
19. X. Ou, W.F. Boyer, and M.A. McQueen, "A Scalable Approach to Attack Graph Generation," Proc. 13th ACM Conf. Computer and Comm. Security, pp. 336-345, 2006. (Pubitemid 47131381)
20. M. Herbster and M.K. Warmuth, "Tracking the Best Expert," Machine Learning, vol. 32, no. 2, pp. 151-178, 1998. (Pubitemid 40626079)
21. R. Anderson, "Why Information Security Is Hard-An Economic Perspective," Proc. 17th Ann. Computer Security Applications Conf., pp. 358-365, 2001.
22. H.R. Varian, "Managing Online Security Risks," New York Times, June 1 2000.
23. T. August and T.I. Tunca, "Network Software Security and User Incentives," Management Science, vol. 52, no. 11, pp. 1703-1720, 2006. (Pubitemid 44706077)
24. L.A. Gordon and M.P. Loeb, "The Economics of Information Security Investment," ACM Trans. Information and System Security, vol. 5, no. 4, pp. 438-457, 2002.
25. K. Hausken, "Returns to Information Security Investment: The Effect of Alternative Information Security Breach Functions on Optimal Investment and Sensitivity to Vulnerability," Information Systems Frontiers, vol. 8, no. 5, pp. 338-349, 2006. (Pubitemid 46088508)
26. H. Varian, "System Reliability and Free Riding," Economics of Information Security, vol. 12, pp. 1-16, 2001.
27. J. Grossklags, N. Christin, and J. Chuang, "Secure or Insure?: A Game-Theoretic Analysis of Information Security Games," Proc. 17th Int'l Conf. World Wide Web, pp. 209-218, 2008.
28. R.A. Miura-Ko, B. Yolken, J. Mitchell, and N. Bambos, "Security Decision-Making among Interdependent Organizations," Proc. 21st IEEE Computer Security Foundations Symp., pp. 66-80, 2008.
29. R. Miura-Ko and N. Bambos, "SecureRank: A Risk-Based Vulnerability Management Scheme for Computing Infrastructures," Proc. IEEE Int'l Conf. Comm., pp. 1455-1460, June 2007. (Pubitemid 351145740)
30. V. Kumar, R. Telang, and T. Mukhopadhyay, "Optimal Information Security Architecture for the Enterprise," http://ssrn.com/abstract= 1086690, 2011.
31. N. Fultz and J. Grossklags, "Blue Versus Red: Towards a Model of Distributed Security Attacks," Proc. 13th Int'l Conf. Financial Cryptography and Data Security, 2009.
32. H. Cavusoglu, S. Raghunathan, and W. Yue, "Decision-Theoretic and Game-Theoretic Approaches to IT Security Investment," J. Management Information Systems, vol. 25, no. 2, pp. 281-304, 2008.
33. K.-w. Lye and J.M. Wing, "Game Strategies in Network Security," Proc. Foundations of Computer Security Workshop, pp. 13-22, 2002.