SRI Logo
About Us|R and D Divisions|Careers|Newsroom|Contact Us|SRI Home
     
  SRI Logo

Adaptive, Model-based Monitoring for Cyber Attack Detection
 by Keith Skinner & Alfonso Valdes.

Lecture Notes in Computer Science, Number 1907.
From Recent Advances in Intrusion Detection (RAID 2000).
Edited by H. Debar and L. Me and F. Wu.
Springer-Verlag, Toulouse, France.
October, 2000.
Pages 80–92.
© Copyright Springer-Verlag, Berlin Heidelberg 2000.


Abstract
Inference methods for detecting attacks on information resources typically use signature analysis or statistical anomaly detection methods. The former have the advantage of attack specificity, but may not be able to generalize. The latter detect attacks probabilistically, allowing for generalization potential. However, they lack attack models and can potentially "learn" to consider an attack normal. Herein, we present a high-performance, adaptive, model-based technique for attack detection, using Bayes net technology to analyze bursts of traffic. Attack classes are embodied as model hypotheses, which are adaptively reinforced. This approach has the attractive features of both signature-based and statistical techniques: model specificity, adaptability, and generalization potential. Our initial prototype sensor examines TCP headers and communicates in IDIP, delivering a complementary inference technique to an IDS sensor suite. The inference technique is itself suitable for sensor correlation.
BibTEX Entry
@inproceedings{adaptbn,
    AUTHOR = {Alfonso Valdes and Keith Skinner},
    TITLE = {Adaptive, Model-based Monitoring for Cyber Attack Detection},
    BOOKTITLE = {Recent Advances in Intrusion Detection (RAID 2000)},
    YEAR = {2000},
    EDITOR = {{H.} Debar and {L.} Me and {F.} Wu},
    SERIES = {Lecture Notes in Computer Science},
    NUMBER = {1907},
    PAGES = {80--92},
    ADDRESS = {Toulouse, France},
    MONTH = {October},
    PUBLISHER = {Springer-Verlag},
    URL = {http://www.sdl.sri.com/papers/adaptbn/},
    COPYRIGHT = {Springer-Verlag, Berlin Heidelberg 2000},
    KEYWORDS = {Intrusion detection, Innovative approaches, {IDS} cooperation, Bayes nets.}
}
Files
 













 

About Us  |  R&D Divisions  |  Careers  |  Newsroom  |  Contact Us
© 2017 SRI International 333 Ravenswood Avenue, Menlo Park, CA 94025-3493
SRI International is an independent, nonprofit corporation. Privacy policy