Combining a bayesian classifier with visualisation: understanding the IDS

Authors:
Stefan Axelsson
Affiliations:
Chalmers University of Technology
Venue:
Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
Year:
2004

Citing 5
Cited 4

The visual display of quantitative information

The visual display of quantitative information
The base-rate fallacy and the difficulty of intrusion detection

ACM Transactions on Information and System Security (TISSEC)
Self-Organizing Maps

Self-Organizing Maps
A Visual Approach for Monitoring Logs

LISA '98 Proceedings of the 12th Conference on Systems Administration
Information-Theoretic Measures for Anomaly Detection

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy

InetVis, a visual tool for network telescope traffic analysis

AFRIGRAPH '06 Proceedings of the 4th international conference on Computer graphics, virtual reality, visualisation and interaction in Africa
Hierarchical Visualization of Network Intrusion Detection Data

IEEE Computer Graphics and Applications
Using Time Series 3D AlertGraph and False Alert Classification to Analyse Snort Alerts

VizSec '08 Proceedings of the 5th international workshop on Visualization for Computer Security
Using an Evolutionary Neural Network for web intrusion detection

AIA '08 Proceedings of the 26th IASTED International Conference on Artificial Intelligence and Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Despite several years of intensive study, intrusion detection systems still suffer from two key deficiencies: Low detection rates and a high rate of false alarms. To counteract these drawbacks an interactive detection system based on simple Bayesian statistics combined with a visualisation component is proposed, in the hope that this lets the operator better understand how exactly the intrusion detection system is operating. The resulting system is applied to the log of a webserver. The combination proved to be effective. The Bayesian classifier was reasonably effective in learning to differentiate between benign and malicious accesses, and the visualisation component enabled the operator to discern when the intrusion detection system was correct in its output and when it was not, and to take corrective action, re-training the system interactively, until the desired level of performance was reached.