Intrusion Detection Using Bayesian Login Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems face challenges in accurately identifying malicious activities amidst a high volume of data, often resulting in high false positive rates and difficulty in detecting sophisticated intrusions, especially in complex computer systems.
Innovation Solution
The implementation of a machine-learning based intrusion detection system that utilizes Bayes Networks to model unusual behaviors through user-specific and user-independent models, incorporating probabilistic methodologies and domain knowledge to score login attempts, and leveraging features such as server properties and user roles to enhance outlier detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unsupervised methods are used to detect unusual activity, then the system can identify potential intrusions, but the false positive rate increases
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing login attempt data over time to establish baseline behavior patterns for each user before detecting anomalies. This preliminary modeling of normal behavior enables more accurate distinction between legitimate and malicious activities, reducing false positives while maintaining detection reliability.
2Quantity of substance
If complex computer systems track a long-trail of unusual activity, then more data is available for analysis, but the difficulty of detecting and measuring malicious versus non-malicious activity increases
Solution Approach 1:
The system segments the analysis by creating user-specific models that evaluate login attempts individually for each user rather than analyzing all login data uniformly. This segmentation allows the system to handle large volumes of data while maintaining detection accuracy by comparing each login attempt against the specific user's established behavior patterns.
3Reliability
If sophisticated intruders attempt to circumvent detection systems by hiding their activity, then the intrusion becomes harder to detect, but the system can still identify deviations from normal user behavior
Solution Approach 1:
The system implements feedback by continuously monitoring login attempts and updating anomaly scores based on deviations from established user behavior patterns. This ongoing feedback mechanism enables the system to detect sophisticated intrusions that attempt to hide by comparing current activity against the user's historical baseline, revealing subtle deviations that indicate malicious behavior.
Data Source
AI summary
An attempt by a user to login to a destination server is identified from a source server. A destination score is determined based on the count of attempts by the user to login to the destination server and the count of attempts by the user to login to all destination servers. A source given destination score is determined based on the count of attempts by the user to login from the source server to the destination server, and the count of attempts by the user to login to the destination server. An outlier score is determined based on values associated with the destination score and the source given destination score. An alert is output if the outlier score satisfies a threshold.