Optimal Thresholds for Anomaly-Based Intrusion Detection in Dynamical Environments

  • Amin GhafouriEmail author
  • Waseem Abbas
  • Aron Laszka
  • Yevgeniy Vorobeychik
  • Xenofon Koutsoukos
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9996)


In cyber-physical systems, malicious and resourceful attackers could penetrate a system through cyber means and cause significant physical damage. Consequently, early detection of such attacks becomes integral towards making these systems resilient to attacks. To achieve this objective, intrusion detection systems (IDS) that are able to detect malicious behavior early enough can be deployed. However, practical IDS are imperfect and sometimes they may produce false alarms even for normal system behavior. Since alarms need to be investigated for any potential damage, a large number of false alarms may increase the operational costs significantly. Thus, IDS need to be configured properly, as oversensitive IDS could detect attacks very early but at the cost of a higher number of false alarms. Similarly, IDS with very low sensitivity could reduce the false alarms while increasing the time to detect the attacks. The configuration of IDS to strike the right balance between time to detecting attacks and the rate of false positives is a challenging task, especially in dynamic environments, in which the damage caused by a successful attack is time-varying.

In this paper, using a game-theoretic setup, we study the problem of finding optimal detection thresholds for anomaly-based detectors implemented in dynamical systems in the face of strategic attacks. We formulate the problem as an attacker-defender security game, and determine thresholds for the detector to achieve an optimal trade-off between the detection delay and the false positive rates. In this direction, we first provide an algorithm that computes an optimal fixed threshold that remains fixed throughout. Second, we allow the detector’s threshold to change with time to further minimize the defender’s loss, and we provide a polynomial-time algorithm to compute time-varying thresholds, which we call adaptive thresholds. Finally, we numerically evaluate our results using a water-distribution network as a case study.


Cyber-physical systems Security Game theory Intrusion detection system 



This work is supported in part by the the National Science Foundation (CNS-1238959), Air Force Research Laboratory (FA 8750-14-2-0180), National Institute of Standards and Technology (70NANB15H263), Office of Naval Research (N00014-15-1-2621), and by Army Research Office (W911NF-16-1-0069).


  1. 1.
    Abrams, M., Weiss, J.: Malicious control system cyber security attack case study - Maroochy Water Services, Australia, July 2008.
  2. 2.
    Alippi, C., Roveri, M.: An adaptive CUSUM-based test for signal change detection. In: Proceedings of the 2006 IEEE International Symposium on Circuits and Systems (ISCAS), pp. 5752–5755. IEEE (2006)Google Scholar
  3. 3.
    Alpcan, T., Basar, T.: A game theoretic approach to decision and analysis in network intrusion detection. In: Proceedings of the 42nd IEEE Conference on Decision and Control (CDC), vol. 3, pp. 2595–2600. IEEE (2003)Google Scholar
  4. 4.
    Alpcan, T., Başar, T.: A game theoretic analysis of intrusion detection in access control systems. In: Proceedings of the 43rd IEEE Conference on Decision and Control (CDC), vol. 2, pp. 1568–1573. IEEE (2004)Google Scholar
  5. 5.
    Amin, S., Schwartz, G.A., Hussain, A.: In quest of benchmarking security risks to cyber-physical systems. IEEE Netw. 27(1), 19–24 (2013)CrossRefGoogle Scholar
  6. 6.
    Basseville, M., Nikiforov, I.V., et al.: Detection of Abrupt Changes: Theory and Application, vol. 104. Prentice Hall, Englewood Cliffs (1993)Google Scholar
  7. 7.
    Cárdenas, A.A., Amin, S., Lin, Z.-S., Huang, Y.-L., Huang, C.-Y., Sastry, S.: Attacks against process control systems: risk assessment, detection, and response. In: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security (ASIACCS), pp. 355–366. ACM (2011)Google Scholar
  8. 8.
    Casey, W., Morales, J.A., Nguyen, T., Spring, J., Weaver, R., Wright, E., Metcalf, L., Mishra, B.: Cyber security via signaling games: toward a science of cyber security. In: Natarajan, R. (ed.) ICDCIT 2014. LNCS, vol. 8337, pp. 34–42. Springer, Heidelberg (2014). doi: 10.1007/978-3-319-04483-5_4 CrossRefGoogle Scholar
  9. 9.
    Durin, B., Margeta, J.: Analysis of the possible use of solar photovoltaic energy in urban water supply systems. Water 6(6), 1546–1561 (2014)CrossRefGoogle Scholar
  10. 10.
    Estiri, M., Khademzadeh, A.: A theoretical signaling game model for intrusion detection in wireless sensor networks. In: Proceedings of the 14th International Telecommunications Network Strategy and Planning Symposium (NETWORKS), pp. 1–6. IEEE (2010)Google Scholar
  11. 11.
    Kailath, T., Poor, H.V.: Detection of stochastic processes. IEEE Trans. Inf. Theor. 44(6), 2230–2231 (1998)MathSciNetCrossRefzbMATHGoogle Scholar
  12. 12.
    Korzhyk, D., Yin, Z., Kiekintveld, C., Conitzer, V., Tambe, M.: Stackelberg vs. Nash in security games: an extended investigation of interchangeability, equivalence, and uniqueness. J. Artif. Intell. Res. 41, 297–327 (2011)MathSciNetzbMATHGoogle Scholar
  13. 13.
    Kushner, D.: The real story of stuxnet. IEEE Spectr. 50(3), 48–53 (2013)MathSciNetCrossRefGoogle Scholar
  14. 14.
    Laszka, A., Abbas, W., Sastry, S.S., Vorobeychik, Y., Koutsoukos, X.: Optimal thresholds for intrusion detection systems. In: Proceedings of the 3rd Annual Symposium and Bootcamp on the Science of Security (HotSoS), pp. 72–81 (2016)Google Scholar
  15. 15.
    Laszka, A., Horvath, G., Felegyhazi, M., Buttyan, L., FlipThem: modeling targeted attacks with FlipIt for multiple resources. In: Proceedings of the 5th Conference on Decision and Game Theory for Security (GameSec), pp. 175–194, November 2014Google Scholar
  16. 16.
    Laszka, A., Johnson, B., Grossklags, J.: Mitigating covert compromises. In: Chen, Y., Immorlica, N. (eds.) WINE 2013. LNCS, vol. 8289, pp. 319–332. Springer, Heidelberg (2013). doi: 10.1007/978-3-642-45046-4_26 CrossRefGoogle Scholar
  17. 17.
    Lee, R.M., Assante, M.J., Conway, T.: German steel mill cyber attack. Technical report, SANS Industrial Control Systems (2014)Google Scholar
  18. 18.
    Pasqualetti, F., Dorfler, F., Bullo, F.: Attack detection and identification in cyber-physical systems. IEEE Trans. Autom. Control 58(11), 2715–2729 (2013)MathSciNetCrossRefGoogle Scholar
  19. 19.
    Pawlick, J., Farhang, S., Zhu, Q.: Flip the cloud: cyber-physical signaling games in the presence of advanced persistent threats. In: Khouzani, M.H.R., Panaousis, E., Theodorakopoulos, G. (eds.) GameSec 2015. LNCS, vol. 9406, pp. 289–308. Springer, Heidelberg (2015). doi: 10.1007/978-3-319-25594-1_16 CrossRefGoogle Scholar
  20. 20.
    Shen, S., Li, Y., Xu, H., Cao, Q.: Signaling game based strategy of intrusion detection in wireless sensor networks. Comput. Math. Appl. 62(6), 2404–2416 (2011)MathSciNetCrossRefzbMATHGoogle Scholar
  21. 21.
    Shiryaev, A.: The problem of the most rapid detection of a disturbance in a stationary process. Soviet Math. Dokl 2, 795–799 (1961)zbMATHGoogle Scholar
  22. 22.
    Srivastava, M., Wu, Y.: Comparison of EWMA, CUSUM and Shiryayev-Roberts procedures for detecting a shift in the mean. Ann. Stat. 21, 645–670 (1993)MathSciNetCrossRefzbMATHGoogle Scholar
  23. 23.
    Tantawy, A.M.: Model-based detection in cyber-physical systems. Ph.D. thesis, Vanderbilt University (2011)Google Scholar
  24. 24.
    Van Dijk, M., Juels, A., Oprea, A., Rivest, R.L.: FlipIt: the game of stealthy takeover. J. Cryptol. 26(4), 655–713 (2013)MathSciNetCrossRefzbMATHGoogle Scholar
  25. 25.
    Verdier, G., Hilgert, N., Vila, J.-P.: Adaptive threshold computation for cusum-type procedures in change detection and isolation problems. Comput. Stat. Data Anal. 52(9), 4161–4174 (2008)MathSciNetCrossRefzbMATHGoogle Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  • Amin Ghafouri
    • 1
    Email author
  • Waseem Abbas
    • 1
  • Aron Laszka
    • 2
  • Yevgeniy Vorobeychik
    • 1
  • Xenofon Koutsoukos
    • 1
  1. 1.Institute for Software Integrated SystemsVanderbilt UniversityNashvilleUSA
  2. 2.Department of Electrical Engineering and Computer SciencesUniversity of CaliforniaBerkeleyUSA

Personalised recommendations