Authors:
Salem Benferhat
and
Karim Tabia
Affiliation:
CRIL - CNRS UMR8188, Universite´ d’Artois, France
Keyword(s):
Anomaly intrusion detection, anomaly scoring and aggregating, thresholding, Bayesian networks.
Related
Ontology
Subjects/Areas/Topics:
Enterprise Information Systems
;
Formal Methods
;
Information and Systems Security
;
Information Systems Analysis and Specification
;
Intrusion Detection & Prevention
;
Methodologies and Technologies
;
Operational Research
;
Security
;
Security in Information Systems
;
Security Metrics and Measurement
;
Simulation and Modeling
Abstract:
Anomaly-based approaches often require multiple profiles and models in order to characterize different aspects
of normal behaviors. In particular, anomaly scores of audit events are obtained by aggregating several local anomaly scores. Remarkably, most works focus on profile/model definition while critical issues of anomaly measuring, aggregating and thresholding are dealt with ”simplistically”. This paper addresses the issue of anomaly scoring and aggregating which is a recurring problem in anomaly-based approaches. We propose a Bayesian-based scheme for aggregating anomaly scores in a multi-model approach and propose a two-stage thresholding scheme in order to meet real-time detection requirements. The basic idea of our scheme is the fact that anomalous behaviors induce either intra-model anomalies or inter-model anomalies. Our experimental studies, carried out on recent and real htt p traffic, show for instance that most attacks induce only intra-model anomalies and can be effect
ively detected in real-time.
(More)