Bayesian Network-Based Approaches for Severe Attack Prediction and Handling IDSs' Reliability

摘要: Probabilistic graphical models are very powerful modeling and reasoning tools. In this paper, we propose efficient Bayesian network-based approaches for two major problems in alert correlation which plays an important role nowadays computer security infrastructures. While the use of multiple intrusion detection systems (IDSs) complementary is highly recommended to improve overall rates, inevitably rises huge amounts alerts most redundant false alarms. The aim work twofold: Firstly, approach based on multi-nets allow take advantage local influence relationships order prediction severe attacks. Secondly, handle reliability IDSs by considering uncertainty relative triggered alerts. Experimental studies carried out real recent IDMEF produced de facto IDS Snort shows significant improvements with respect standard approaches. More particularly, handling IDSs’ significantly reduces alarm rate represents a crucial issue development.