A continuous time bayesian network approach for intrusion detection

摘要: Network attacks on computers have become a fact of life for network administrators. Detecting accurately is important to limit their scope and destruction. Intrusion detection systems (IDSs) fall into two high-level categories: network-based (NIDS) that monitor behaviors, host-based (HIDS) system calls. In this work, we present general technique both systems. We consider the problem detecting intrusions host level. We use anomaly detection, which identifies patterns not conforming historic norm. Our approach does require expensive labeling or prior exposure attack type. types systems, rates change vary dramatically over time (due burstiness) components service difference). To efficiently model such continuous Bayesian networks (CTBNs) avoid specifying fixed interval. build generative models from non-attack data, flag future event sequences whose likelihood under norm below threshold. As NIDS, our method differs previous approaches in explicitly modeling temporal dependencies traffic. are therefore more sensitive subtle variations events. first construct factored CTBN packet traces. simple extensions CTBNs allow instantaneous events do result state changes, simultaneous transitions variables. then extend connected one. it hierarchical way Rao-Blackwellized particle filtering inference. illustrate power through experiments real worms identifying hosts publicly available traces, MAWI dataset LBNL dataset. For HIDS, develop novel learning deal with finite resolution log file stamps, without losing benefits model. demonstrate by DARPA 1998 BSM dataset.