Abstract:Identifying whether system objects are infected or not on a compromised system is a complex and error-prone task. Most existing solutions follow a traditional causal analysis method which tries to precisely correlate potential infected objects with the entry point of an intrusion, also known as intrusion root, based on dependencies between objects. However, the entanglement of both legitimate, and malicious, actions makes it difficult to pinpoint the intrusion root and establish precise dependencies. In this paper, we propose a novel method to identify intrusion infections with a small number of observed intrusion symptoms and legitimate objects. This method does not require the identification of an accurate intrusion root and precise dependencies. In particular, we propose a new form of dependency network to encode dependencies of information flows and take temporal information into account. It captures potential propagation paths of an intrusion from a system-wide perspective. Then, based on the temporal dependency network, we develop a probabilistic Bayesian network model to characterize uncertainties of propagating infections along the dependency edges. Finally, we employ a probabilistic inference method to identify the intrusion infections with the help of only a few observed intrusion symptoms and legitimate objects. Extensive experimental results in synthetic and real-world scenarios demonstrate that our method is capable of identifying the infected objects even when the intrusion root is undetermined and dependencies are coarse-grained.

Intrusion Tolerant System Based on Bayesian Networks

Model of Intrusion Tolerant System Based on Improved Neural Networks

Intrusion Intention Recognition Method Based on Dynamic Bayesian Networks

Intrusion Intention Identification Methods Based on Dynamic Bayesian Networks

Hybrid bayesian network method for predicting intrusion in reactive intrusion tolerance system

BAYESIAN Network for Intrusion Detection

Assessment Of Situation And Threat In Air To Air Combat Based On Discrete Dynamic Bayesian Networks

Intrusion Detection using Continuous Time Bayesian Networks

Underwater Target Threat Assessment Method Based on Bayesian Network

An intrusion-tolerant system based on neural network

Target Threat Estimate Based on Bayesian Network

Identifying Intrusion Infections via Probabilistic Inference on Bayesian Network.

Bayesian Networks for Intelligent Decision of Airborne Weapon System

The Threaten Grade Assessment Model of Target Based on Fuzzy Discrete Dynamic Bayesian Networks

Approach to Security Attack Pattern Networks on the Basis of Bayesian Networks

Probabilistic Inference Strategy in Distributed Intrusion Detection Systems

Information Security Evaluation of System Based on Bayesian Network.

The ModeIing Method with Bayesian Networks and Its AppIication in the Threat Assess ment Under S maII Data Sets

Process System Fault Source Tracing Based on Bayesian Networks

Threat Level Assessment of the Air Combat Target Based on DBN