Extending Signature-based Intrusion Detection Systems With Bayesian Abductive Reasoning
Loading...
Links to Files
Permanent Link
Author/Creator ORCID
Date
2019-03-28
Type of Work
Department
Program
Citation of Original Publication
Ashwinkumar Ganesan, Pooja Parameshwarappa, Akshay Peshave, Zhiyuan Chen, Tim Oates, Extending Signature-based Intrusion Detection Systems WithBayesian Abductive Reasoning, 2019, https://arxiv.org/abs/1903.12101
Rights
This item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
Abstract
Evolving cybersecurity threats are a persistent challenge for system
administrators and security experts as new malwares are continually
released. Attackers may look for vulnerabilities in commercial
products or execute sophisticated reconnaissance campaigns to
understand a target’s network and gather information on security
products like firewalls and intrusion detection / prevention systems
(network or host-based). Many new attacks tend to be modifications
of existing ones. In such a scenario, rule-based systems fail to detect
the attack, even though there are minor differences in conditions /
attributes between rules to identify the new and existing attack. To
detect these differences the IDS must be able to isolate the subset of
conditions that are true and predict the likely conditions (different
from the original) that must be observed. In this paper, we propose
a probabilistic abductive reasoning approach that augments an existing
rule-based IDS (snort [29]) to detect these evolved attacks by (a)
Predicting rule conditions that are likely to occur (based on existing
rules) and (b) able to generate new snort rules when provided with
seed rule (i.e. a starting rule) to reduce the burden on experts to
constantly update them. We demonstrate the effectiveness of the
approach by generating new rules from the snort 2012 rules set and
testing it on the MACCDC 2012 dataset.