Abstract
This paper describes novel market-based technologies for systematic, quantifiable and predictable protection of information systems against attacks. MarketNet establishes a financial market to regulate and protect access resource access and to account for their use. A domain offers access to its resources to cIients who can pay with its currency. It controls its exposure to attacks by pricing critical resources high and by limiting the currency available to potential attackers. The ability of an attacker is limited by its budget, and is depleted as this budget is used to pursue attack actions. Currency flows provide a resource-independent instrumentation to monitor and correlate access patterns and to detect intrusion attacks through automated, uniform statistical analysis of anomalies. Currency, furthermore, carries unique identifiers enabling a domain to pinpoint the sources of attacks. These mechanisms are resource-independent, and admit unlimited scalability for very large federated networks operated by mutually distrustful administrators. They uniquely establish quantifiable and adjustable limits on the power of attackers; enable verifiable accountability for malicious attacks; and admit systematic, uniform monitoring and detection of attacks.