Bayesian Event Classification for Intrusion Detection

• Authors: Christopher Kruegel;Darren Mutz;William Robertson;Fredrik Valeur
• Venue: ACSAC '03 Proceedings of the 19th Annual Computer Security Applications Conference
• Year: 2003

Intrusion detection systems (IDSs) attempt to identify attacksby comparing collected data to predefined signaturesknown to be malicious (misuse-based IDSs) or to a modelof legal behavior (anomaly-based IDSs). Anomaly-basedapproaches have the advantage of being able to detect previouslyunknown attacks, but they suffer from the difficultyof building robust models of acceptable behavior which mayresult in a large number of false alarms. Almost all currentanomaly-based intrusion detection systems classify an inputevent as normal or anomalous by analyzing its features,utilizing a number of different models. A decision for an inputevent is made by aggregating the results of all employedmodels.We have identified two reasons for the large number offalse alarms, caused by incorrect classification of events incurrent systems. One is the simplistic aggregation of modeloutputs in the decision phase. Often, only the sum of themodel results is calculated and compared to a threshold.The other reason is the lack of integration of additionalinformation into the decision process. This additional informationcan be related to the models, such as the confidencein a model's output, or can be extracted from externalsources. To mitigate these shortcomings, we proposean event classification scheme that is based on Bayesiannetworks. Bayesian networks improve the aggregation ofdifferent model outputs and allow one to seamlessly incorporateadditional information. Experimental results showthat the accuracy of the event classification process is significantlyimproved using our proposed approach.