Determining Placement of Intrusion Detectors for a Distributed Application through Bayesian Network Modeling

Modelo-Howard, Gaspar; Bagchi, Saurabh; Lebanon, Guy

doi:10.1007/978-3-540-87403-4_15

Cited by 29 publications

(39 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…BN captures the characteristic in real-world data of locality of influence, the idea that most variables are influenced by only a few others. [7] shows the implications of this. Bayesian networks combine graph theory with statistical techniques to model MSA scenarios.…”

Section: Probabilistic Reasoning Enginementioning

confidence: 92%

“…Bayesian networks have been used for intrusion detection, examples include [7] and [5]. [7] models the potential attacks to a target network using a Bayesian network to determine (off-line) a set of detectors to protect the network.…”

Section: Related Workmentioning

confidence: 99%

“…[7] models the potential attacks to a target network using a Bayesian network to determine (off-line) a set of detectors to protect the network. [5] presents a method based on Dynamic Bayesian networks to include the temporal properties of attacks in a distributed system.…”

Section: Related Workmentioning

confidence: 99%

“…Each node is parametrized by a set of probability values and represented as a conditional probability tables (CPT). Proposed in previous work [7] and also suggested by [5], the Bayesian network representation can unify the information available from multiple sensors, in order to determine if an MSA is occurring.…”

Section: Probabilistic Reasoning Enginementioning

confidence: 99%

“…Prior work has shown that it is possible to determine the choice and placement of sensors in a systematic manner and at runtime, perform inferencing based on alerts from the sensors to determine the security state of the protected system components [7] 1 . In achieving this, the solutions have performed characterization of individual sensors prior to deployment, in terms of their capability to detect specific attack step goals.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Secure Configuration of Intrusion Detection Sensors for Changing Enterprise Systems

Modelo-Howard

Sweval

Bagchi

2012

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

Self Cite

View full text Add to dashboard Cite

Abstract. Current attacks to distributed systems involve multiple steps, due to attackers usually taking multiple actions to achieve their goals. Such attacks are called multi-stage attacks and have the ultimate goal to compromise a critical asset for the victim. An example would be compromising a web server, then achieve a series of intermediary steps (such as compromising a developer's box thanks to a vulnerable PHP module and connecting to a FTP server with gained credentials) to ultimately connect to a database where user credentials are stored. Current detection systems are not capable of analyzing the multi-step attack scenario. In this document we present a distributed detection framework based on a probabilistic reasoning engine that communicates to detection sensors and can achieve two goals: (1) protect the critical asset by detecting multi-stage attacks and (2) tune sensors according to the changing environment of the distributed system monitored by the distributed framework. As shown in the experiments, the framework reduces the number of false positives that it would otherwise report if it were only considering alerts from a single detector and the reconfiguration of sensors allows the framework to detect attacks that take advantage of the changing system environment.

show abstract

Section: Probabilistic Reasoning Enginementioning

confidence: 92%