Intrusion detection using continuous time Bayesian networks
From MaRDI portal
Abstract: Intrusion detection systems (IDSs) fall into two high-level categories: network-based systems (NIDS) that monitor network behaviors, and host-based systems (HIDS) that monitor system calls. In this work, we present a general technique for both systems. We use anomaly detection, which identifies patterns not conforming to a historic norm. In both types of systems, the rates of change vary dramatically over time (due to burstiness) and over components (due to service difference). To efficiently model such systems, we use continuous time Bayesian networks (CTBNs) and avoid specifying a fixed update interval common to discrete-time models. We build generative models from the normal training data, and abnormal behaviors are flagged based on their likelihood under this norm. For NIDS, we construct a hierarchical CTBN model for the network packet traces and use Rao-Blackwellized particle filtering to learn the parameters. We illustrate the power of our method through experiments on detecting real worms and identifying hosts on two publicly available network traces, the MAWI dataset and the LBNL dataset. For HIDS, we develop a novel learning method to deal with the finite resolution of system log file time stamps, without losing the benefits of our continuous time model. We demonstrate the method by detecting intrusions in the DARPA 1998 BSM dataset.
Recommendations
- A Bayesian classification model for real-time intrusion detection
- A Bayesian paradigm for designing intrusion detection systems
- Host-based intrusion detection using dynamic and static behavioral models
- Real time learning of non-stationary processes with dynamic Bayesian networks
- Intrusion detection based on system calls and homogeneous Markov chains
Cited in
(12)- Factored performance functions and decision making in continuous time Bayesian networks
- Sensitivity analysis of continuous time Bayesian network reliability models
- Bayesian Network-Based Approaches for Severe Attack Prediction and Handling IDSs’ Reliability
- IDS False Alarm Reduction Using Continuous and Discontinuous Patterns
- Efficient Parameter Sampling for Markov Jump Processes
- Real time learning of non-stationary processes with dynamic Bayesian networks
- A Bayesian classification model for real-time intrusion detection
- Uncertain and negative evidence in continuous time Bayesian networks
- Bayesian Models Applied to Cyber Security Anomaly Detection Problems
- Constraint-based and hybrid structure learning of multidimensional continuous-time Bayesian network classifiers
- Anomaly detection in dynamic networks: a survey
- A Bayesian paradigm for designing intrusion detection systems
This page was built for publication: Intrusion detection using continuous time Bayesian networks
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q3068938)
