Continuous Time Bayesian Networks for Host Level Network Intrusion Detection (2008)

by Jing Xu and Christian R. Shelton

Abstract: We consider the problem of detecting host-level attacks in network traffic using unsupervised learning. We model the normal behavior of a host's traffic from its signature logs, and flag suspicious traces differing from this norm. In particular, we use continuous time Bayesian networks learned from historic non-attack data and flag future event sequences whose likelihood under this normal model is below a threshold. Our method differs from previous approaches in explicitly modeling temporal dependencies in the network traffic. Our model is therefore more sensitive to subtle variations in the sequences of network events. We present two simple extensions that allow for instantaneous events that do not result in state changes, and simultaneous transitions of two variables. Our approach does not require expensive labeling or prior exposure to the attack type. We illustrate the power of our method in detecting attacks with comparisons to other methods on real network traces.

Download Information

Jing Xu and Christian R. Shelton (2008). "Continuous Time Bayesian Networks for Host Level Network Intrusion Detection." Machine Learning and Knowledge Discovery in Databases (ECML/PKDD) (LNAI, vol 5212) (pp. 613-627). © Springer-Verlag.

Bibtex citation

@inproceedings{XuShe08,
   author = "Jing Xu and Christian R. Shelton",
   title = "Continuous Time {B}ayesian Networks for Host Level Network Intrusion Detection",
   booktitle = "Machine Learning and Knowledge Discovery in Databases (ECML/PKDD)",
   booktitleabbr = "ECML/PKDD",
   series = "LNAI",
   volume = 5212,
   pages = "613--627",
   year = 2008,
}

---

full list