Réseaux Bayésiens naïfs pour la détection des attaques coordonnées

Salem Benferhat (1) , Tayeb Kenaza (1) , Aïcha Mokhtari (2)

1 CRIL - Centre de Recherche en Informatique de Lens
2 Département informatique

Alert correlation is a very useful mechanism to reduce the high volume of reported alerts and to detect complex and coordinated attacks. Existing approaches either require a large amount of expert knowledge or use simple similarity measures that prevent detecting complex attacks. They also suffer from high computational issues due, for instance, to a high number of possible scenarios. In this paper, we propose a naive bayes approach to alert correlation. Our modeling only needs a small part of expert knowledge. It takes advantage of available historical data, and provides efficient algorithms for detecting and predicting most plausible scenarios. Our approach is illustrated using the well known DARPA 2000 data set.

Mots clés: Détection d'intrusions; Corrélation d'alertes; Prédiction d'attaques; Réseaux Bayésiens naïfs; Intrusion detection; Alert correlation; Attack prediction; Naive bayes

Domaines: Apprentissage [cs.LG]

Salem Benferhat, Tayeb Kenaza, Aïcha Mokhtari. Réseaux Bayésiens naïfs pour la détection des attaques coordonnées. Journées Francophone sur les Réseaux Bayésiens, May 2008, Lyon, France. ⟨hal-00259683⟩