Affiliations: Centre de Recherche en Informatique de Lens (CNRS-UMR 8188), Université d'Artois, rue Jean Souvraz, SP 18 F-62307, Lens Cedex, France. {kenaza,benferhat}@cril.univ-artois.fr; karim.tabia@univ-nantes.fr
Note: [] Also works: Laboratoire de Recherche en Intelligence Artificielle Ecole Militaire Polytechnique, BP 17 Bordj-Elbahri 16111, Algiers
Note: [] Also works: Laboratoire d'Informatique de Nantes Atlantique (UMR 6241), Polytech'Nantes - rue Christian Pauc BP 50609 44306 Nantes Cedex 3, France
Note: [] Address for correspondence: Centre de Recherche en Informatique de Lens (CNRS-UMR 8188), Université d'Artois rue Jean Souvraz, SP 18 F-62307, Lens Cedex, France
Abstract: Bayesian networks are very powerful tools for knowledge representation and reasoning under uncertainty. This paper shows the applicability of naive Bayesian classifiers to two major problems in intrusion detection: the detection of elementary attacks and the detection of coordinated ones. We propose two models starting with stating the problems and defining the variables necessary for model building using naive Bayesian networks. In addition to the fact that the construction of such models is simple and efficient, the performance of naive Bayesian networks on a representative data is competing with the most efficient state of the art classification tools. We show how the decision rules used in naive Bayesian classifiers can be improved to detect new attacks and new anomalous activities. We experimentally show the effectiveness of these improvements on a recent Web-based traffic. Finally, we propose a naive Bayesian network-based approach especially designed to detect coordinated attacks and provide experimental results showing the effectiveness of this approach.
