When gossip is good: distributed probabilistic inference for detection of slow network intrusions

摘要: Intrusion attempts due to self-propagating code are becoming an increasingly urgent problem, in part the homogeneous makeup of internet. Recent advances anomaly-based intrusion detection systems (IDSs) have made use quickly spreading nature these attacks identify them with high sensitivity and at low false positive (FP) rates. However, slowly propagating much more difficult detect because they cloaked under veil normal network traffic, yet can be just as dangerous their exponential spread pattern. We extend idea using collaborative IDSs corroborate likelihood attack by imbuing end hosts probabilistic graphical models random messaging gossip state among peer detectors. show that such a system is able boost weak anomaly detector D order-of-magnitude slower worm, rates less than few per week, would possible alone end-host or on aggregation point. this general architecture scalable sense fixed absolute rate achieved size grows, spreads communication bandwidth uniformly throughout network, makes increased computation power distributed system. argue provides robust detections previous counting schemes allows account for heterogeneous detectors principled fashion.