在現代網路快速的發展下，不僅頻寬流量急速倍增，相關的安全問題也成為一個重要的議題。在面對不同種類的網路攻擊，有許多的防禦措施。其中，我們將以現今企業組織通用的入侵偵測系統來作研究的目標。

我們試圖提出一個不同的觀點，來分析網路中攻擊與防禦角色間的互動及決策。並提出了網路管理者如何在有限的資源下佈署入侵偵測系統，能夠有最好的效率及偵測率。並設想了不同的場景，推演出在不同場景下網路管理者所應採取的策略，使整體系統能夠抵抗外來的攻擊。

而對於分析的工具，我們選擇了經濟學中常用的賽局理論來作為依據，並以數學推演及實例驗證結果的正確性。我們期望在這樣的分析結果下，能夠得到一個系統化的分析過程及佈置方法，並討論其改進的空間。

In modern days, network grows up rapidly and exhibits a large the bandwidth. The network security problem becomes an important issue. There are many ways to defend different kinds of network attack. We will use intrusion detection systems which many organization common uses as our research target.

We try to analyze what actions attacker and defender should take in a different point of view. Furthermore, we propose a method to deploy intrusion detection systems in the network with limited resources, and showed this method efficiently and has optimal detection probability. We also set up different scenarios, and deduce what strategy network manager should take to defend threats.

We choose game theory to analyze our system, and verify its correctness with mathematics and examples. We hope that we can get systematic analysis and deployment strategies, and improve our research.

[1]局論，伏洛波夫(N.N. Vorob’ev)原著，徐載華譯，桂冠出版社，1990

[2]賽局理論與訊息經濟，Eric Rasmusen原著，楊家彥、張建一、吳麗真合譯，五南圖書出版股份有限公司，2004二版

[3]網路安全實務，網路應用與服務教學推動中心主編，教育部顧問室補助，2006

[4]Murali Kodialam, T. V. Lakshman, “Detecting Network Intrusions via Sampling：A Game Theoretic Approach”, IEEE INFOCOM 2003.

[5]Jing WANG, Naoya NITTA, Hiroyuki SEKI, “An Efficient Method for Optimal Probe Deployment of Distributed IDS”, IEICE Transactions on Information and Systems archive Volume E88-D, Issue 8, 2005.

[6]Afrand Agah, Kalyan Basu, Sajal K. Das, “Preventing DoS attack in Sensor Networks：A Game Theoretic Approach”, IEEE International Conference on Communications, Volume 5, page 3218-3222, 2005.

[7]Animesh Patcha, Jung-Min Park, “A Game Theoretic Approach to Modeling Intrusion Detection in Mobile Ad Hoc Networks”, Proceedings of 2004 IEEE Workshop on Information Assurance and Security, 2004.

[8]Cliff Changchun Zou, Weibo Gong, Don Towsley, “Code Red Worm Propagation Modeling and Analysis”, ACM on Computer and Communications Security, 2002.

[9]Peter Mell, Mark McLarnon, “Mobile Agent Attack Resistant Distributed Hierarchical Intrusion Detection Systems”, Proceedings of the Second International workshop on Recent Advances in Intrusion Detection, 1999.

[10]Terence K.T. Law, John C.S. Lui, David K.Y. Yau, “You Can Run, But You Can’t Hide：An Effective Statistical Methodology to Trace Back DDoS Attackers”, IEEE Transactions on Parallel and Distributed Systems, Volume 16, No.9, 2005.

[11]Chunsheng Li, Qingfeng Song, Chengqi Zhang, “MA-IDS Architecture for Distributed Intrusion Detection using Mobile Agents”, Proceedings of the Second International Conference on Information Technology for Application, 2004.

[12]C. Onwubiko, A. P. Lenaghan, L. Hebbes, “An Improved Worm Mitigation Model for Evaluating the Spread of Aggressive Network Worms”, EUROCON, 2005.

[13]Dorothy E. Denning, “An Intrusion-Detection Model”, IEEE Transactions on Software Engineering, 1987.

[14] http://www.securityfocus.com/infocus/1647

[15] http://www.microsoft.com/taiwan/athome/security/viruses/virus101.mspx

[16] http://gost.isi.edu/cidf

[17] http://insecure.org/nmap/

[18] http://www.nessus.org/

[19]Avinash Dixit, Susan Skeath, “Games of Strategy”, W. W. Norton & Company ,second edition, 2004