Abstract :
This paper describes the ESIDE-Depian intrusion detection and prevention system, which uses Bayesian structural and parametric learning and also evidence propagation and adaptation, in order to improve the accuracy and manageability of network intrusion detection systems (NIDS). Current NIDS do not consider the two main detection paradigms, i.e. misuse detection and anomaly detection, in an unified style, so the analysis is not inherently complete. Besides, historical data are not generally used, neither for analysis nor for sequential adaptation of the knowledge representation models used for detection; hence this wealthy information about the essence and the potential trends of the target system is not commonly considered. Thus, by the generalized use of Bayesian belief networks, ESIDE-Depian achieves the main goal of detecting and preventing both well-known and also zero-day attacks with excellent results, by means of unified real-time analysis of network traffic.
Keywords :
belief networks; learning (artificial intelligence); security of data; telecommunication security; telecommunication traffic; Bayesian belief networks; ESIDE-Depian intrusion detection; anomaly detection; evidence propagation; knowledge representation models; misuse detection; network traffic; parametric learning; prevention system; Artificial intelligence; Bayesian methods; Expert systems; Humans; Information analysis; Information security; Intelligent networks; Intrusion detection; Knowledge representation; Power system modeling;
