Forecast techniques for predicting increase or decrease of attacks using Bayesian inference

The analysis techniques of intrusion detection system (IDS) events are actively researched, since it is important to understand attack trends and devise countermeasures against incidents. To aim at a quick response in security operation, it is necessary to forecast a fluctuation of attacks. However, there is no approach for predicting the fluctuation of attacks, since the fluctuation of attacks seems to be random. In this paper, we propose forecast techniques for predicting increase or decrease of the attacks by using the Bayesian inference for calculating the conditional probability based on past-observed event counts. We consider two algorithms by focusing on an attack cycle and a fluctuation range of the event counts. We implement a forecasting system and evaluate it with real IDS events. As a result, our proposed technique can forecast increase or decrease of the event counts, and be effective to various types of attacks.