Lecture Notes in Computer Science, Number 1907.
From Recent Advances in Intrusion Detection (RAID 2000).
Edited by H. Debar and L. Me and F. Wu.
Springer-Verlag, Toulouse, France.
October, 2000.
Pages 80–92.
© Copyright Springer-Verlag, Berlin Heidelberg 2000.

Inference methods for detecting attacks on information resources typically use signature analysis or statistical anomaly detection methods. The former have the advantage of attack specificity, but may not be able to generalize. The latter detect attacks probabilistically, allowing for generalization potential. However, they lack attack models and can potentially "learn" to consider an attack normal. Herein, we present a high-performance, adaptive, model-based technique for attack detection, using Bayes net technology to analyze bursts of traffic. Attack classes are embodied as model hypotheses, which are adaptively reinforced. This approach has the attractive features of both signature-based and statistical techniques: model specificity, adaptability, and generalization potential. Our initial prototype sensor examines TCP headers and communicates in IDIP, delivering a complementary inference technique to an IDS sensor suite. The inference technique is itself suitable for sensor correlation.

@inproceedings{adaptbn,
    AUTHOR = {Alfonso Valdes and Keith Skinner},
    TITLE = {Adaptive, Model-based Monitoring for Cyber Attack Detection},
    BOOKTITLE = {Recent Advances in Intrusion Detection (RAID 2000)},
    YEAR = {2000},
    EDITOR = {{H.} Debar and {L.} Me and {F.} Wu},
    SERIES = {Lecture Notes in Computer Science},
    NUMBER = {1907},
    PAGES = {80--92},
    ADDRESS = {Toulouse, France},
    MONTH = {October},
    PUBLISHER = {Springer-Verlag},
    URL = {http://www.sdl.sri.com/papers/adaptbn/},
    COPYRIGHT = {Springer-Verlag, Berlin Heidelberg 2000},
    KEYWORDS = {Intrusion detection, Innovative approaches, {IDS} cooperation, Bayes nets.}
}

• adaptbn.html
• adaptbn.pdf