Cost Analysis for Classification-based Autonomous Response Systems

Recently, cost-based Autonomous Response System (ARS) proposals are based on intrusion detection analysis. However, the implementation of the analysis in multiclass classification-based ARS potentially leads to a wrong response action set decision. This is because the analysis may produces irrelevant response value, as it is not considering the false possibility in a true positive condition. In this paper, we introduce ARS based on cost analysis from a multi-class classification output. The analysis is not only considering the possibility of a right response, but also the possibility of a wrong response from false classification prediction. The response value and expected lost rate are introduced to quantitatively estimate the best response action set. Our simulation for Denial of Service (DoS) attack cases, confirmed the capability of response action set decision algorithm. Our proposed system provides more accurate estimation of response value which leads to lower expected lost rate.