A Bayesian paradigm for designing intrusion detection systems

Computational Statistics and Data Analysis

Volumn 45, Issue 1, 2004, Pages 69-83

  Scott, Steven L ^a  

^a UNIVERSITY OF SOUTHERN CALIFORNIA   (United States)

Author keywords

Bayesian model averaging; Fraud; Graphical model; Hierarchical model; Markov modulated Poisson process; Mixture model

Indexed keywords

ALGORITHMS; COMPUTER NETWORKS; MATHEMATICAL MODELS; PATTERN RECOGNITION;

DESIGNING INTRUSION DETECTION SYSTEMS;

DATA REDUCTION;

STATISTICAL ANALYSIS;

EID: 0442296744     PISSN: 01679473     EISSN: None     Source Type: Journal    
DOI: 10.1016/S0167-9473(03)00177-4     Document Type: Article

References (23)

1. Baum L.E. Petrie T. Soules G. Weiss N. A maximization technique occurring in the statistical analysis of probabilistic functions of Markov chains Ann. Math. Statist. 41 1970 164-171
2. Cahill, M., Chen, F., Lambert, D., Pinheiro, J., Sun, D., 2002. Detecting fraud in the real world. In: Abello, J., Pardalos, P.M., Resende, M.G.C., Handbook of Massive Datasets. Kluwer Academic Publishers, Dordrecht
3. Cowell R.G. Dawid A.P. Lauritzen S.L. Spiegelhalter D.J. Probabilistic Networks and Expert Systems 1999 Springer Berlin
4. Denning, D.E., Denning, P.J. (Eds.), 1997. Internet Beseiged. ACM Press, New York.
5. DuMouchel, W., 1999. Computer intrusion detection based on Bayes factors for comparing command transition probabilities. Technical Report 91, National Institute of Statistical Sciences. http://www.niss.org/downloadabletechreports.html
6. Glickman M.E. Parameter estimation in large dynamic paired comparison experiments Appl. Statist. 48 1999 377-394
7. Hoeting J.A. Madigan D. Raftery A.E. Volinsky C.T. Bayesian model averaging: A tutorial (disc: P401-417) Statist. Sci. 14 1999 382-401
8. Ju W.-H. Vardi Y. A hybrid high-order Markov chain model for computer intrusion detection J. Comput. Graphical Statist. 10 2001 277-295
9. Kass R.E. Raftery A.E. Bayes factors J. Amer. Statist. Assoc. 90 1995 773-795
10. Kretzschmar M. Morris M. Measures of concurrency in networks and the spread of infectious disease Math. Biosci. 133 1996 165-195
11. Lambert D. Pinheiro J. Sun D. Estimating millions of dynamic timing patterns in real-time J. Amer. Statist. Assoc. 96 2001 316-330
12. MacDonald I.L. Zucchini W. Hidden Markov and Other Models for Discrete-Valued Time Series 1997 Chapman and Hall London
13. Raftery A.E. A model for high-order Markov chains J. Roy. Statist. Soc. Ser. B, Methodological 47 1985 528-539
14. Raftery A. Tavaré S. Estimation and modelling repeated patterns in high order Markov chains with the mixture transition distribution model Appl. Statist. 43 1994 179-199
15. Schonlau M. Theus M. Detecting masquerades in intrusion detection based unpopular commands Inform. Process. Lett. 76 2000 33-38
16. Schonlau M. DuMouchel W. Ju W. Karr A. Theus M. Vardi Y. Computer intrusion: Detecting masquerades Statist. Sci. 16 2001 58-74
17. Scott S.L. Bayesian analysis of a two state Markov modulated Poisson process J. Comput. Graphical Statist. 8 3 1999 662-670
18. Scott S.L. Bayesian methods for hidden Markov models: Recursive computing in the 21st century J. Amer. Statist. Assoc. 97 2002 337-351
19. Scott, S.L., 2002b. Detecting network intrusion using the Markov modulated nonhomogeneous Poisson process. Technical Report IOM-00-09, The Marshall School of Business, University of Southern California. www-rcf.usc.edu/~sls/mmnhpp.ps
20. Scott, S.L., Smyth, P., 2003. The Markov modulated Poisson process and Markov Poisson cascade with applications to Web traffic data. In: Bernardo, J.M., Bayarri, M.J., Berger, J.O., Dawid, A.P., Heckerman, D., Smith, A.F.M., West, M. (Eds.), Bayesian Statistics, Vol. 7. Oxford University Press, Oxford, 671-680.
21. West M. Harrison J. Bayesian Forecasting and Dynamic Models 1997 Springer Berlin
22. Whittaker J. Graphical Models in Applied Multivariate Statistics 1990 Wiley New York
23. Willinger W. Taqqu M.S. Leland W.E. Wilson D.V. Self-similarity in high-speed packet traffic: Analysis and modeling of ethernet traffic measurements Statist. Sci. 10 1995 67-85