Although some existing collaborative intrusion detection schemes can increase the detection performance by dynamically allocating detection resources in smart grids, these related works fail to consider the optimization of resource allocation between IDSs under the condition of resource restriction. In this paper, considering the effect of resource restriction, we propose a resource allocation scheme for two-layer collaborative IDSs based on sharing strategies in smart grids. In the first layer of our scheme, we model the interaction between the IDSs and the attackers through a stochastic game based on sharing strategies, where we provide each IDS with two different options for its strategy updating at each stage in the stochastic game. Then the resource updating strategies of the IDSs are obtained through this proposed model. Further, in the second layer we quantify the effect of detection resource restriction, and we propose a resource allocation method under the condition of detection resource restriction, where each IDS can obtain its detection resources according to the results generated by our proposed stochastic game. Based on our experimental analysis, compared with other resource allocation schemes, our proposed scheme can more quickly achieve the Nash equilibrium between the IDSs and the attackers to make the IDSs obtain more rewards, and then can more rationally promote the IDSs to update their detection resources so that the IDSs obtain the optimal detection strategies under the condition of resource restriction. Our proposed scheme can achieve effective detection resource allocation between IDSs for the security of neighborhood area network in smart grids.

尽管一些现有的协作入侵检测方案可以通过在智能电网中动态分配检测资源来提高检测性能，但是这些相关工作未能在资源受限的情况下考虑IDS之间资源分配的优化。考虑到资源限制的影响，本文提出了一种基于智能电网共享策略的两层协同IDS资源分配方案。在方案的第一层中，我们通过基于共享策略的随机博弈对IDS与攻击者之间的交互进行建模，在此过程中，我们为每个IDS在随机博弈的每个阶段提供两种不同的策略更新选项。然后通过该模型获得了入侵检测系统的资源更新策略。进一步，在第二层中，我们对检测资源限制的效果进行了量化，并提出了一种在检测资源限制的条件下的资源分配方法，其中每个IDS都可以根据我们提出的随机博弈产生的结果获得其检测资源。根据我们的实验分析，与其他资源分配方案相比，该方案可以更快地实现入侵检测系统与攻击者之间的纳什均衡，使入侵检测系统获得更多的回报，进而可以更合理地促进入侵检测系统更新其检测资源。使IDS在资源受限的情况下获得最优的检测策略。我们提出的方案可以实现IDS之间的有效检测资源分配，以实现智能电网中邻域网络的安全。