Host Anomalies Detection Using Logistic Regression Modeling

Malicious activities will lead to abnormal host traffic patterns. This paper presents a model of host anomalies detection that can be used given bi-directional flow data. We first select a group of variables to represent the host traffic, and then use a Bayesian logistic regression, which was developed using a combination of expert experiences and manually-flagged training data to evaluate the probability of host anomaly. The primary experiment results indicate the approach is effective.