Authors:
Pablo Garcia Bringas
1
;
Yoseba K. Penya
1
;
Stefano Paraboschi
2
and
Paolo Salvaneschi
2
Affiliations:
1
University of Deusto, Faculty of Engineering - ESIDE, Spain
;
2
University of Bergamo, Faculty of Engineering, Italy
Keyword(s):
Intrusion Detection, Intrusion Prevention, Misuse Detection, Anomaly Detection, Data Mining, Machine Learning, Bayesian Networks.
Related
Ontology
Subjects/Areas/Topics:
Applications of Expert Systems
;
Artificial Intelligence
;
Artificial Intelligence and Decision Support Systems
;
Bayesian Networks
;
Enterprise Information Systems
;
Soft Computing
;
Verification and Validation of Knowledge-Based Systems
Abstract:
Network Intrusion Detection Systems (NIDS) aim at preventing network attacks and unauthorised remote use of computers. More accurately, depending on the kind of attack it targets, an NIDS can be oriented to detect misuses (by defining all possible attacks) or anomalies (by modelling legitimate behaviour and detecting those that do not fit on that model). Still, since their problem knowledge is restricted to possible attacks, misuse detection fails to notice anomalies and vice versa. Against this, we present here ESIDE-Depian, the first unified misuse and anomaly prevention system based on Bayesian Networks to analyse completely network packets, and the strategy to create a consistent knowledge model that integrates misuse and anomaly-based knowledge. Finally, we evaluate
ESIDE-Depian against well-known and new attacks showing how it outperforms a well-established industrial NIDS.