Collaborative IDS Configuration: A Two-Layer Game-Theoretic Approach

To cope with the increasingly sophisticated intrusions, collaborative intrusion detection systems (CIDSs) are proposed in the literature. In particular, intrusion detection systems (IDSs) in collaboration can dynamically share available computational resources among themselves to enhance the overall detection performance. However, due to resource limitation, it is infeasible for the IDSs to respond to all the intrusion detection requests from their collaborative peers. In the meantime, obtaining the optimal IDS configuration in CIDSs is far from trivial. With such consideration, the collaborative IDS configuration problem is formulated as a two-layer stochastic game (SG). To solve this two-layer SG, a centralized Vickrey–Clarke–Groves auction based collaboration scheme and a distributed game-theoretic incentive mechanism are proposed in this paper. The effectiveness of the proposed schemes is validated through both analysis and numerical experiments. The proposed approach can be applied to more general collaborative settings.