Extending Signature-based Intrusion Detection Systems With Bayesian Abductive Reasoning

Simple item page
dc.contributor.authorGanesan, Ashwinkumar
dc.contributor.authorParameshwarappa, Pooja
dc.contributor.authorPeshave, Akshay
dc.contributor.authorChen, Zhiyuan
dc.contributor.authorOates, Tim
dc.date.accessioned2019-04-19T19:13:19Z
dc.date.available2019-04-19T19:13:19Z
dc.date.issued2019-03-28
dc.description.abstractEvolving cybersecurity threats are a persistent challenge for system administrators and security experts as new malwares are continually released. Attackers may look for vulnerabilities in commercial products or execute sophisticated reconnaissance campaigns to understand a target’s network and gather information on security products like firewalls and intrusion detection / prevention systems (network or host-based). Many new attacks tend to be modifications of existing ones. In such a scenario, rule-based systems fail to detect the attack, even though there are minor differences in conditions / attributes between rules to identify the new and existing attack. To detect these differences the IDS must be able to isolate the subset of conditions that are true and predict the likely conditions (different from the original) that must be observed. In this paper, we propose a probabilistic abductive reasoning approach that augments an existing rule-based IDS (snort [29]) to detect these evolved attacks by (a) Predicting rule conditions that are likely to occur (based on existing rules) and (b) able to generate new snort rules when provided with seed rule (i.e. a starting rule) to reduce the burden on experts to constantly update them. We demonstrate the effectiveness of the approach by generating new rules from the snort 2012 rules set and testing it on the MACCDC 2012 dataset.en_US
dc.description.sponsorshipThis research is being conducted in the UMBC Accelerated Cognitive Computing Lab (ACCL) that is supported in part by a gift from IBM Research. We thank the other members of the ACCL Lab for their input, suggestions and guidance in developing this system.en_US
dc.description.urihttps://arxiv.org/abs/1903.12101en_US
dc.format.extent10 pagesen_US
dc.genrejournal articles preprintsen_US
dc.identifierdoi:10.13016/m2r7vz-rgfh
dc.identifier.citationAshwinkumar Ganesan, Pooja Parameshwarappa, Akshay Peshave, Zhiyuan Chen, Tim Oates, Extending Signature-based Intrusion Detection Systems WithBayesian Abductive Reasoning, 2019, https://arxiv.org/abs/1903.12101en_US
dc.identifier.urihttp://hdl.handle.net/11603/13475
dc.language.isoen_USen_US
dc.relation.isAvailableAtThe University of Maryland, Baltimore County (UMBC)
dc.relation.ispartofUMBC Computer Science and Electrical Engineering Department Collection
dc.relation.ispartofUMBC Faculty Collection
dc.relation.ispartofUMBC Student Collection
dc.relation.ispartofUMBC Information Systems Department
dc.rightsThis item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
dc.subjectabductive reasoningen_US
dc.subjectbayesian networksen_US
dc.subjectintrusion detection systemen_US
dc.subjectcybersecurityen_US
dc.titleExtending Signature-based Intrusion Detection Systems With Bayesian Abductive Reasoningen_US
dc.typeTexten_US

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
1903.12101.pdf
Size:
1.28 MB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
2.56 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

UMBC Computer Science and Electrical Engineering Department
UMBC Faculty Collection
UMBC Information Systems Department
UMBC Student Collection