Intrusion Detection using Continuous Time Bayesian Networks

8 years 2 months ago
Intrusion Detection using Continuous Time Bayesian Networks
Intrusion detection systems (IDSs) fall into two high-level categories: network-based systems (NIDS) that monitor network behaviors, and host-based systems (HIDS) that monitor system calls. In this work, we present a general technique for both systems. We use anomaly detection, which identifies patterns not conforming to a historic norm. In both types of systems, the rates of change vary dramatically over time (due to burstiness) and over components (due to service difference). To efficiently model such systems, we use continuous time Bayesian networks (CTBNs) and avoid specifying a fixed update interval common to discrete-time models. We build generative models from the normal training data, and abnormal behaviors are flagged based on their likelihood under this norm. For NIDS, we construct a hierarchical CTBN model for the network packet traces and use Rao-Blackwellized particle filtering to learn the parameters. We illustrate the power of our method through experiments on detecting...
Jing Xu, Christian R. Shelton
Added 19 May 2011
Updated 19 May 2011
Type Journal
Year 2010
Where JAIR
Authors Jing Xu, Christian R. Shelton
Comments (0)