![](bg8.png)
It is important to note that this evaluation is carried
ou
t in off-line mode. Results of Table 3 clearly show
that when ranked according to anomaly scores, most
anomalous events are actually attacks. For instance,
when anomaly threshold is set to 0.1% of analyzed
events, then all the triggered alerts are actually caused
by attacks. Setting the anomaly threshold to greater
values causes true positive rate to decrease slightly
while false alarm rate proportionally increases. Note
that most false alarms correspond to new and unusual
audit events. Given that security administrators can
only check small amounts of alerts, then ranking-
based thresholding is an interesting scheme since it
focuses on most anomalous events.
5 CONCLUSIONS
The main objective of this paper is to address anomaly
thresholding and aggregating issues in multi-model
anomaly detection approaches. We proposed a two-
stage thresholding scheme suitable for detecting in
real-time intra-model and inter-model anomalies. In
order to cope with large numbers of alerts charac-
terizing most anomaly-based IDSs, we proposed a
ranking-based thresholding method allowing to limit
the alert quantities while focusing on most anoma-
lous events. As for anomaly score aggregation, we
proposed to use a Bayesian network whose struc-
ture can be fixed by the expert or extracted auto-
matically from attack-free training data. Experimen-
tal studies carried out on real and recent http traffic
showed that most Web-related attacks induce intra-
model anomalies and can be detected in real-time us-
ing local thresholding scheme. Future works will ex-
plore the application of our schemes in order to detect
anomalies and attacks when input data relative to au-
dit event is uncertain or missing.
ACKNOWLEDGEMENTS
This work is supported by a French national project
entitled DADDi.
REFERENCES
Angiulli, F., Basta, S., and Pizzuti, C. (2006). Distance-
based detection and prediction of outliers. IEEE
Trans. on Knowl. and Data Eng., 18(2):145–160.
Axelsson, S. (2000). Intrusion detection systems: A sur-
vey and taxonomy. Technical Report 99-15, Chalmers
Univ.
Benferhat, S. and Tabia, K. (2008). Classification features
for detecting server-side and client-side web attacks.
In 23rd International Security Conference, Italy.
Denning, D. E. (1987). An intrusion-detection model. IEEE
Trans. Softw. Eng., 13(2):222–232.
Ertz, L., Eilertson, E., Lazarevic, A., Tan, P.-N., Kumar,
V., Srivastava, J., and Dokas, P. Minds - minnesota
intrusion detection system.
Gerhard Mnz, S. L. and Carle, G. (2007). Traffic anomaly
detection using k-means clustering.
Gowadia, V., Farkas, C., and Valtorta, M. (2005). Paid: A
probabilistic agent-based intrusion detection system.
Computers & Security, 24(7):529–545.
Heckerman, D., Geiger, D., and Chickering, D. M. (1995).
Learning bayesian networks: The combination of
knowledge and statistical data. Machine Learning,
20(3):197–243.
Ingham, K. L. and Inoue, H. (2007). Comparing anomaly
detection techniques for http. In RAID, pages 42–62.
Javits and Valdes (1993). The NIDES statistical component:
Description and justification.
Jensen, F. V. (1996). An Introduction to Bayesian Networks.
UCL press.
Kruegel, C., Mutz, D., Robertson, W., and Valeur, F. (2003).
Bayesian event classification for intrusion detection.
In Proceedings of the 19th Annual Computer Security
Applications Conference, page 14, USA.
Kruegel, C. and Vigna, G. (2003). Anomaly detection of
web-based attacks. In CCS ’03: Proceedings of the
10th ACM conference on Computer and communica-
tions security, pages 251–261, New York, NY, USA.
Kruegel, C., Vigna, G., and Robertson, W. (2005). A multi-
model approach to the detection of web-based attacks.
volume 48, pages 717–738.
Krugel, C., Toth, T., and Kirda, E. (2002). Service specific
anomaly detection for network intrusion detection. In
Proceedings of the 2002 ACM symposium on Applied
computing, pages 201–208, USA.
Lee, W. and Xiang, D. (2001). Information-theoretic mea-
sures for anomaly detection. In Proceedings of the
IEEE Symposium on Security and Privacy, USA.
Neumann, P. G. and Porras, P. A. (1999). Experience with
EMERALD to date. In First USENIX Workshop on
Intrusion Detection and Network Monitoring, pages
73–80, Santa Clara, California.
Snort (2002). Snort: The open source network intrusion
detection system. http://www.snort.org.
Staniford, S., Hoagland, J. A., and McAlerney, J. M. (2002).
Practical automated detection of stealthy portscans. J.
Comput. Secur., 10(1-2):105–136.
Tombini, E., Debar, H., Me, L., and Ducasse, M. (2004).
A serial combination of anomaly and misuse idses
applied to http traffic. In Proceedings of the 20th
Annual Computer Security Applications Conference,
pages 428–437.
Valdes, A. and Skinner, K. (2000). Adaptive, model-based
monitoring for cyber attack detection. In Proceed-
ings of the Third International Workshop on Recent
Advances in Intrusion Detection, pages 80–92, UK.
SECRYPT 2008 - International Conference on Security and Cryptography
28