Method and system for adaptive anomaly-based intrusion detection
AssigneeThe School of Electrical Engineering and Computer Science (SEECS), National University of Sciences and Technology (NUST)
InventorsSyed Ali Khayam, Muhammad Qasim Ali
Life of this patent
Estimating the term…
Abstract
The input characteristics of a real-time IDS change continuously with time therefore setting a rigid (time and behavior invariant) classification threshold limits the accuracy that the IDS can potentially achieve. A generic threshold tuning method and system is proposed which can adaptively tune the detection threshold of a real-time IDS in accordance with varying host and network behavior. The method and system perform statistical and information-theoretic analysis of network and host-based IDSs' anomaly based intrusions to reveal a consistent time correlation structure between benign activity periods which is used to predict future anomaly scores and to adapt an IDS' detection threshold accordingly.
Claims14
A computer implemented method of intrusion detection in an enterprise network, the method comprising:
- a) developing a prediction model to predict expected values of future anomaly scores from real time anomaly scores based on an output of an anomaly detection system derived from an input of network traffic pattern data of the enterprise network in real time under benign conditions;
- b) setting an adaptive classification threshold based on the expected values predicted by the prediction model;
- and
- c) classifying unknown observations not within the adaptive classification threshold as possible intrusions;
- wherein the expected values of future anomaly scores ({circumflex over (r)}(n+1)) are calculated from the equation:
- r
- ^
- (
- n
- +
- 1
- )
- =
- max
- j
- =
- 1
- ,
- …
- ,
- k
-
- p
- j
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- ,
-
- where
- p
- j
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- =
- p
- ~
- j
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- ∑
- i
- =
- 1
- k
-
- p
- ~
- i
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- ,
- ∀
- j
- =
- 1
- ,
- …
-
- ,
- k
- ,
-
- where
- p
- ~
- r
- (
- n
- )
- ±
- i
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- =
- ɛ
- (
- n
- )
- ×
- p
- r
- (
- n
- )
- ±
- i
- |
- r
- (
- n
- )
- (
- m
- )
- ,
- ∀
- i
- =
- 1
- ,
- …
-
- ,
- β
- ,
-
- where
- ɛ
- (
- n
- )
- =
-
- r
- (
- n
- )
- -
- r
- ^
- (
- n
- )
-
- ,
- where p(n) is a kXk transition probability matrix of a Markov chain predictor at time n and r(n) is the real time anomaly score at time n.
A computer implemented method of adjusting an adaptive classification threshold in an intrusion detection system, the intrusion detection system using the adaptive classification threshold to identify possible intrusions, the method comprising:
- a) tracking a real time anomaly score based on an output of an anomaly detection system derived from an input of network traffic pattern data of an enterprise network in real time using a stochastic prediction model;
- b) predicting expected values of future anomaly scores from the real time anomaly score of the stochastic prediction model;
- and
- c) adjusting the adaptive classification threshold based on the expected values of future anomaly scores;
- wherein the expected values of future anomaly scores ({circumflex over (r)}(n+1)) are calculated from the equation:
- r
- ^
- (
- n
- +
- 1
- )
- =
- max
- j
- =
- 1
- ,
- …
- ,
- k
-
- p
- j
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- ,
-
- where
- p
- j
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- =
- p
- ~
- j
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- ∑
- i
- =
- 1
- k
-
- p
- ~
- i
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- ,
- ∀
- j
- =
- 1
- ,
- …
-
- ,
- k
- ,
-
- where
- p
- ~
- r
- (
- n
- )
- ±
- i
- |
- r
- (
- n
- )
- (
- n
- +
- 1
- )
- =
- ɛ
- (
- n
- )
- ×
- p
- r
- (
- n
- )
- ±
- i
- |
- r
- (
- n
- )
- (
- m
- )
- ,
- ∀
- i
- =
- 1
- ,
- …
-
- ,
- β
- ,
-
- where
- ɛ
- (
- n
- )
- =
-
- r
- (
- n
- )
- -
- r
- -
- (
- n
- )
-
- ,
- where p(n) is a kXk transition probability matrix of a Markov chain predictor at time n and r(n) is the real time anomaly score at time n.
Dependencies are inferred from the claim text.