Near-optimal blacklisting. Issue 64 (January 2017)

• Record Type: Journal Article
• Authors: Dimitrakakis, Christos; Mitrokotsa, Aikaterini
• Is Part Of: Computers & security. Issue 64(2017)
• Page Start: 110
• Page End: 121
• Publication Date: 2017-01
• Subjects: Decision theory -- Blacklisting -- Markov decision process -- Optimal stopping -- Expected loss -- Network management; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2015.06.010
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Many applications involve agents sharing a resource, such as networks or services. When agents are honest, the system functions well and there is a net profit. Unfortunately, some agents may be malicious, but it may be hard to detect them. We consider the decision making problem of how to permanently blacklist agents, in order to maximise expected profit. The problem of efficiently deciding which nodes to permanently blacklist has various applications ranging from efficient intrusion response, network management, shutting down malware infected hosts in an internal network and efficient distribution of services in a network. In this paper, we propose an approach to efficiently perform this blacklisting while minimising the cost of the service provider. Although our approach is quite general and could be applied to all the previously mentioned applications, to ease understanding we consider the problem in which an Internet service provider (ISP) needs to decide whether or not to blacklist a possibly misbehaving node. This is not trivial, as blacklisting may erroneously expel honest nodes (agents). Conversely, while we gain information by allowing a node to remain, we may incur a cost due to malicious behaviour. We present an efficient algorithm (Hi PER) for making near-optimal decisions for this problem. Additionally, we derive three algorithms by reducing the problem to a Markov decision process (MDP). Theoretically, we show that Hi PER is near-optimal. Experimentally, its performance is close to that of the full MDP solution, when the (stronger) requirements of the latter are met.