Extending Signature-based Intrusion Detection Systems With Bayesian Abductive Reasoning
Links to Fileshttps://arxiv.org/abs/1903.12101
MetadataShow full item record
Type of Work10 pages
journal articles preprints
Citation of Original PublicationAshwinkumar Ganesan, Pooja Parameshwarappa, Akshay Peshave, Zhiyuan Chen, Tim Oates, Extending Signature-based Intrusion Detection Systems WithBayesian Abductive Reasoning, 2019, https://arxiv.org/abs/1903.12101
RightsThis item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
Evolving cybersecurity threats are a persistent challenge for system administrators and security experts as new malwares are continually released. Attackers may look for vulnerabilities in commercial products or execute sophisticated reconnaissance campaigns to understand a target’s network and gather information on security products like firewalls and intrusion detection / prevention systems (network or host-based). Many new attacks tend to be modifications of existing ones. In such a scenario, rule-based systems fail to detect the attack, even though there are minor differences in conditions / attributes between rules to identify the new and existing attack. To detect these differences the IDS must be able to isolate the subset of conditions that are true and predict the likely conditions (different from the original) that must be observed. In this paper, we propose a probabilistic abductive reasoning approach that augments an existing rule-based IDS (snort ) to detect these evolved attacks by (a) Predicting rule conditions that are likely to occur (based on existing rules) and (b) able to generate new snort rules when provided with seed rule (i.e. a starting rule) to reduce the burden on experts to constantly update them. We demonstrate the effectiveness of the approach by generating new rules from the snort 2012 rules set and testing it on the MACCDC 2012 dataset.