A BAYESIAN CLASSIFICATION MODEL FOR REAL TIME COMPUTER NETWORK INTRUSION DETECTION SYSTEMS

Intrusion detection systems (IDSs) attempt to identify attacks by comparing collected data to predefined signatures known to be malicious (misuse-based IDSs) or to a model of legal behaviour (anomaly-based IDSs). In this paper we present a new design of an anomaly IDS. Design and development of the IDS are considered in three main steps: normal behaviour construction, anomaly- based detection intrusion and model upgrading. A parametrical mixture model is used for behaviour modelling from reference data and the associated Bayesian classification. Real-time requirements are presented as well as detection and upgrade algorithms for the special case of Gaussian parametrical model and are evaluated with respect to their real-time features.