用户权限对入侵检测系统配置策略的影响  

Effects of user rights on configuration strategies for intrusion detection system

作　　者：蔡传晰[1] 梅姝娥[1] 仲伟俊[1] Cai Chuanxi;Mei Shue;Zhong Weijun(School of Economics and Management, Southeast University, Nanjing 211189, China)

机构地区：[1]东南大学经济管理学院,南京211189

出　　处：《东南大学学报（自然科学版）》2019年第1期186-194,共9页Journal of Southeast University：Natural Science Edition

基　　金：国家自然科学基金资助项目(71071033)

摘　　要：为了讨论用户权限的经济价值,在企业和合法用户与企业和非法用户之间分别构建了入侵检测系统的博弈模型,采用博弈论研究了合法用户权限对入侵检测系统配置策略的影响.结果发现,企业只配置检测率较高的入侵检测系统,且对合法用户配置的最优入侵检测系统的检测率低于对非法用户配置的最优入侵检测系统的检测率.通过提高合法用户的权限,企业可以降低对入侵检测系统的投入.随着合法用户权限的提高,虽然企业的人工调查概率和合法用户的攻击概率都降低,但企业的总体期望收益增加.因此,建议企业适当提高合法用户的权限,同时加大对相应攻击行为的惩罚力度,让更多的工作由合法用户自助完成.To discuss the economic value of user rights, a game model of intrusion detection systems (IDS) between enterprise and legal users and the one between enterprise and illegal users were developed, respectively. The effects of the legal users rights on the configuration strategies for IDS were studied by the game theory. The results show that enterprise only configures the IDS with high probability of getting an alarm from IDS for legal users intrusion, and the optimal probability of getting an alarm from IDS for legal users intrusion is lower than that for illegal users intrusion. In addition, enterprise can decrease the investment in IDS by improving the legal users rights. With the increase of the legal users rights, both the enterprise s investigation rate and the legal users hacking probability decrease, but the enterprise s expected benefits increase. Therefore, it is suggested that enterprises should appropriately improve the legal users rights, and increase the punishment for corresponding attacks, so that more work can be done by legal users themselves.

关 键 词：入侵检测系统 用户权限 博弈论 配置策略 信息安全经济学 

分 类 号：C931[经济管理—管理学]