A Bayesian Networks in Intrusion Detection Systems

Transcription

1 Joural of Computer Scece 3 (5: 59-65, 007 ISSN Scece Publcatos A Bayesa Networs Itruso Detecto Systems M. Mehd, S. Zar, A. Aou ad M. Besebt Electrocs Departmet, Uversty of Blda, Algera Abstract: Itruso detecto systems (IDSs have bee wdely used to overcome securty threats computer etwors. Aomaly-based approaches have the advatage of beg able to detect prevously uow attacs, but they suffer from the dffculty of buldg robust models of acceptable behavour whch may result a large umber of false alarms caused by correct classfcato of evets curret systems. We propose a ew approach of a aomaly Itruso detecto system (IDS. It cossts of buldg a referece behavour model ad the use of a Bayesa classfcato procedure assocated to usupervsed learg algorthm to evaluate the devato betwee curret ad referece behavour. Cotuous re-estmato of model parameters allows for real tme operato. The use of recursve Log-lelhood ad etropy estmato as a measure for motorg model degradato related wth behavor chages ad the assocated model update show that the accuracy of the evet classfcato process s sgfcatly mproved usg our proposed approach for reducg the mssgalarm. ey words: Computer etwor, Securty, Itruso detecto, Probablstc reasog, Bayesa learg, Real-tme. INTRODUCTION Itruso detecto ca be defed as the process of detfyg malcous behavor that targets a etwor ad ts resources. Itruso detecto systems have tradtoally bee classfed as ether msuse-based or aomaly-based. Systems that use msuse-based techques cota a umber of attac descrptos, or sgatures, that are matched agast a stream of audt data loog for evdece of the modeled attacs. The audt data ca be gathered from the etwor [], from the operatg system, or from applcato log fles. Sgature-based systems have the advatage that they usually geerate few false postves (.e., correctly flaggg a evet as malcous whe t s legtmate. Ufortuately, they ca oly detect those attacs that have bee prevously specfed. That s, they caot detect trusos for whch they do ot have a predefed sgature Aomaly-based techques follow a approach that s complemetary wth respect to msuse detecto. These approaches rely o models, or profles, of the ormal behavour of users, applcatos ad etwor traffc. Devatos from the establshed models are terpreted as attacs. Aomaly detecto systems have the advatage that they are able to detfy prevously uow attacs. By defg a Correspodg Author:: MEHDI Merouae, Electrocs Departmet, Uversty of Blda, Algera 59 expected, ormal state, ay abormal behavor ca be detected, whether t s part of the threat model or ot. Ths capablty should mae aomaly-based systems a preferred choce. However, the advatage of beg able to detect prevously uow attacs s usually pad for terms of a large umber of false postves. Ths ca mae the system uusable by floodg ad evetually desestzg the system admstrator wth large umbers of correct alerts. We have detfed two ma problems that cotrbute to the large umber of false postves. Frst, the decso whether a evet should be classfed as aomalous or as ormal s made a smplstc way. Aomaly detecto systems usually cota a collecto of models that evaluate dfferet features of a evet. These models retur a aomaly score or a probablty value that reflects the ormalty of ths evet accordg to ther curret profles. However, the system s faced wth the tas of aggregatg the dfferet model outputs to a sgle, fal result. The secod problem of aomaly-based systems s that they caot dstgush betwee aomalous behavor caused by uusual but legtmate actos ad actvty that s the mafestato of a attac. Ths leads to the stuato where ay devato from ormal behavor s reported as suspcous, gorg

2 potetal addtoal formato that mght suggest otherwse []. Such addtoal formato ca be exteral to the system, receved from system health motors (e.g., CPU utlzato, memory usage, process status or other truso detecto sesors. Cosder the example of a IDS that motors a web server by aalyzg the system calls that the server process voes. A sudde jump CPU utlzato ad a cotuous crease of the memory allocated by the server process ca corroborate the belef that a certa system call cotas traces of a deal-of-servce attac [3]. Addtoal formato ca also be drectly related to the models, such as the cofdece a model output. Depedg o the ste-specfc structure of put evets, certa features mght ot be sutable to dstgush betwee legtmate ad malcous actvty. I such a case, the cofdece the output of the model based o these features should be reduced. I ths paper, we propose a ew model for truso detecto followg the aomaly detecto approach. We are especally terested formato systems that are smultaeously submtted to dfferet behavor profles. Typcal examples are mult-user applcatos ad computer systems or etwors carryg dfferet commucato protocols. I such cases, audt data reflectg actos or system states assocated wth each system behavor profle usually ca ot be separated a pror. Moreover, t s sometmes eve mpossble to ow how may profles are preset the system behavor. The proposed IDS model s teded to deal wth both stuatos. Aomaly IDS desg cossts of three ma steps. Frst, t s ecessary to buld a referece behavor model for the motored system. I our case, ths referece behavor should be modeled from observed audt data descrbg the use of the system by a represetatve set of legtmate, o-malcous ettes. The am s to model dfferet ettes profles that could ot be separated a pror by a learg procedure. A parametrcal mxture model [4] s used to costruct a Bayesa classfcato procedure based o the observatos ad leads to the system behavor model. Usupervsed learg s accomplshed by fttg the mxture model parameters by the expectatomaxmzato (EM algorthm [4, 5]. As the model order may also be uow, a mmum etropy crtero s troduced to allow model order estmato [6]. The ext step cossts evaluatg audt data related to ew system actvtes to detect devatos betwee the curret ad the referece behavors. New observed data s compared to the referece model by meas of both a Bayesa classfcato ad cluster pertece evaluatos. As behavor ca chage, the behavor J. Computer Sc., 3 (5: 59-65, 007 model should be updated durg IDS operato. Ths s the last step. I our desg, the model update s doe by re-estmato of model parameters gve the ew data preseted to the system. The desg of the learg, detecto ad update phases usg Bayesa techques s the frst cotrbuto of the paper, the secod les the dscusso of real-tme capabltes of the proposed algorthms, especally the detecto ad update phase. Adaptatos of the detecto algorthm to the case of Gaussa mxture models are proposed, resultg a lear complexty for the detecto algorthm. Recursve parameter estmato s also proposed, as a possble alteratve to real-tme model update. IDS Model (Bayesa classfcato: The dea s to buld a behavor model that taes to accout multple use profles ad allows for a Bayesa classfcato of data as part of the detecto algorthm. A referece audt data set represetg the ormal system behavor s used to create the model wth a learg procedure. Before startg to descrbe the model, we should ote that audt data must be mapped to radom varables. Mappg audt data geerated by the system to radom varables, both durg extracto of referece data system behavor modelg ad system usage, s out of the scope of ths dscusso. Hereafter, we admt that audt data ca be represeted by a set of realzatos of a cotuous radom vector y, whose probablty dstrbuto fucto (PDF wll have to be modeled. Mxture Model ad EM-Algorthm: The PDF of the (d-dmesoal radom vector y, for whch realzatos are mapped from the audt data doma, are represeted by a parametrcal mxture model [4, 5]. I such models, the realzatos of y are regarded as beg trals of oe of the smple models desged by a erel probablty fucto, wth each erel fucto represetg the model of a use profle. Realzatos from y are ot clustered, e.g. the profle of each realzato y s ot observable. The mxture model fudametal expresso, gvg the probablty of y, ca be formally expressed as:,..., θ = g ( y, p( z = p( y θ θ ( where: P( z deotes the pror probablty that a data pot s geerated by mxture compoet, y s the -th 60

3 observed data; z s the hdde vector that dcates whch source (profle the data comes from (e.g. z = f data comes from cluster ad z = 0, otherwse; g are erel dstrbuto fuctos wth respectve parameters θ, each of them modelg oe of the use profles; s the model order correspodg to the umber of sources beg modeled. The uow parameters the model (Eq. ( are the set of cluster probabltes p(z ad the parameters of erel dstrbuto fuctos of each cluster θ, represeted by µ = [ p( z, p( z,..., p( z, θ, θ,.., θ ] ( The mxture model represeted by ( has bee creasgly used to model the dstrbuto of a wde varety of supposed radom pheomea [7]. A teratve algorthm of optmzg the uow vector µ by a maxmum lelhood (ML crtero has bee defed ad s also called the expectato-maxmzato (EM algorthm [5, 6]. Let: Y = [ y, y,..., y ] T m (3 Where the subscrpts,, deote a observed m- dmesoal realzato vector of y (that has to be J. Computer Sc., 3 (5: 59-65, geeral dstrbutos (g by the ormal dstrbuto (represeted by φ ad the dstrbuto parameters θ by the mea vector (µ ad covarace matrx (R, as stated at Eq. (4, where the probablty p(z are also replaced by the weghtg factor w, for otato smplcty. p( y = w φ ( y, µ, R (4 = For completeess, we provde the EM recurso equatos (Eq. (5-(6 for the Gaussa mxture models: p( y w φ ( y, µ, R = w ' φ ( y, µ ', R ' ' = / = + = p( y y / p( = = (5 w + = p( y (6 µ y (7 + + T p( y ( y µ ( y µ + = R = (8 p( y = modeled. Y s regarded as the referece data cotag represetatve ormal behavor formato ad s used.. Etropy-Based Estmato of Model Order to ft µ usg the EM algorthm. Ths algorthm permts For the purpose of the EM-algorthm, the model both log-lelhood ad model parameter estmato to order (whch correspods to the umber of parttos be doe a teratve maer. The recursve process or data sources, whe usg parametrc mxture models should be repeated utl varato the estmated loglelhood betwee two cosecutve teratos becomes for parttog data must be provded. Sce the umber of parttos s ot ow a pror, t s useful to small, dcatg that the algorthm has coverged to a be able to estmate the most probable umber of (local maxmum of the log-lelhood data fucto, parttos, as well. gve that the realzato probabltes are expressed as Our objectve s to buld a deal parttog Eq. (. As the log-lelhood fucto evaluato at estmato for, whch should be regarded as havg the pot represeted by the parameter ftted by the the posteror probablty p( y (Eq. (5 the GMM EM-algorthm s ot guarateed to be a global case close to uty for oe value of ad close to zero maxmum, a fte umber of radom talzatos of for all the others, for each realzato. the parameters are realzed ad the EM-algorthm s As descrbed [7], ths deal parttog should be executed at dfferet tmes. The results (parameter obtaed by mmzg Shao etropy gve estmato correspodg to a maxmum log-lelhood observed data, whch ca be evaluated for each evaluato all executos are ept as the optmal observato by Eq. (9: model parameters ad are used durg detecto phase. H = p( y log( p( y (9 A detaled dscusso of the EM-algorthm s out of = the scope of ths paper, as t has already bee The expected value of ths etropy s evaluated extesvely dscussed the lterature. The reader s tag the mea of H over all observed data (Eq. (0: ased to refer to [5, 6] for a more geeral descrpto of the EM-algorthm. p( y log( p( y * = = (0 I the partcular case of Gaussa mxture models E ( H = (GMM, e.g. mxture model wth Gaussa erel Where: E* deotes a expectato estmator ad H fuctos, whch s used our expermets preseted s the measure questo. further, the Eq. ( should be rewrtte replacg the We proceed by fttg max models wth dfferet

4 J. Computer Sc., 3 (5: 59-65, 007 order ( =,,... max ad we evaluate the expected etropy (3 for each case. The resultg model a mmum of ths measure wll be cosdered the optmum model. The complete algorthm of the learg phase, used to obta a mxture model ftted wth the EM-algorthm ad wth optmal model order ( estmato ca be summarsed as follows: EM-Algorthm wth Model Order Estmato = 0, H opt = 0, opt =. = +. Ft the -order model to data usg the EM- Algorthm (Eqs. -7. Calculate expected value of H (Eq. (7. If H < H opt the H opt = H ; opt = ; ad µ = µ opt. If < max, the repeat (. Update actual model order wth optmal model order: = opt. Update actual model parameters µ wth optmal model parameters µ opt. Aomaly Detecto: Durg detecto, the behavor model has bee already ftted ad s avalable for fdg fereces a ew data preseted to the system. The am s to defe some pealty λ, whch vares from 0 to (e.g. 0 λ, dcatg the degree of ormalty cocerg ths realzato from certaly abormal (λ= 0 to a certaly ormal (λ = behavor. May dfferet approaches for defg such crtera from the behavor statstcal model represeted by Eq. ( are possble. We have defed a detecto procedure formed by two basc steps: a (Bayesa classfcato ferece ad a cluster pertece ferece [9]. The classfcato ferece s straghtforward for parametrcal mxture models ad cossts of evaluato of the posteror cluster probabltes codtoed to ew data y, p ( y', for = (,,..., ( Cluster pertece ferece s more complex. As all the erel dstrbutos used our model have a cotuous ature, cosderg data posteror probabltes codtoed to cluster probablty, p(y, by smple evaluato of the cluster probablty desty fucto s meagless. A more realstc approach cossts evaluatg the probablty of ew data beg cotaed some pertece terval (Π, defed as a fucto of cluster dstrbuto parameters (µ ad R, for stace ad the observato y, whch should be formally expressed as follows (Eq. (: p ( y' Π = g ( y, θ dπ ( Such probablty should, deed, loo le some d of cumulatve dstrbuto fucto, f we defe Π as stated Eq. (3, below [0] : Π = y µ d y R γ (3 R Where ad deote gve types of orm operators ad γ s a costat that should deped o y. Fally, detecto pealty should be defed as Eq. (4: λ ( y' = p( y' p( y' Π (4 = Model Upgradg: The behavor model should be updated to avod the rasg of erroeous alerts (false postves. Updatg should also be regarded as actualzato of smooth chages system behavor, as the basc model should become vald or complete case of expressve chages. I our approach, we smply update the estmato of model parameters. Thus, updatg s doe the cluster probabltes ad the erel parameters. Usual estmators ca be used for cotuous estmato of these model statstcs [0]. Note that both log-lelhood ad etropy should also be estmated ad compared wth prevous values (e.g. log-lelhood ad etropy obtaed after learg phase, as t could gve a dea about the goodess of the ew model whe compared to the referece oe. Real-Tme Capabltes: The learg procedure the referece behavor model costructo s usually executed off-le. Computato complexty costrats are ot strog at ths stage. However, t s usually desrable to have detecto ad update phases beg executed cotuously. Thus, the algorthms for detecto ad update should be desged for real-tme. I ths secto, we show how detecto ad updatg algorthms preseted above should be adapted for realtme executo. Although a formal performace evaluato of the proposed real-tme algorthms are stll progress, we regard them as havg a lear complexty, both wth respect to the umber of evets (ew data preseted to be aalyzed by the system ad wth respect to the model order. The IDS s desged to be mplemeted as software for executo a covetoal PC platform, wthout 6

5 eed of ay specal hardware for ehacg computatoal capacty. Thus, for real-tme evaluato, the processg power avalable for the IDS executo should be comparable wth those of a stadard PC. As a prelmary referece, IDS use-tesve systems should deal wth thousads or eve mllos of ew evets per secod. Real-tme detecto algorthm wth Gaussa Mxture Models s as follows. Eq. ( ca ot be usually evaluated aalytcally. A geeral soluto should use umercal evaluato that ca be prohbtve for hgher dmesos. Besdes, umercal evaluato s computato-tesve eve the oe-dmesoal or two-dmesoal cases, mag real-tme executo dffcult ad eve mpossble. Although Eq. ( would be dffcult for arbtrary erel fuctos g, a computatoal-effcet algorthm for evaluatg ths tegral equato ca be establshed for the partcular case of Gaussa dstrbuto. These algorthms, whch are dscussed ths secto, have bee successfully used the expermets, where we are essetally dealg wth Gaussa mxture models. Wheever GMM s beg used, evaluato of the Eq. ( ca be doe by coveet choce of the udefed elemets o Eq. (3. The dea s to defe Π as the complemetary space of the sodesty ellpsod ( R d, whose boudary cotas y ad s cetered µ. Ths meas that Π s bouded terally by a d-dmesoal ellpsodal surface formed by all pots havg the same desty as y ( e. g. φ ( y, µ, R = φ( y', µ, R (5 Thus, rewrtg of Eq.(3 gves Equato (6: d y R Π = ( y γ (6 αβ α [ R ] ( y µ µ α αβ β β T T Where: y = y, y,... ; µ = ( µ, µ,... µ ; [ R ] αβ ( y d s the elemet at α -th le ad β -th colum of the verse covarace matrx, ad γ s doe by (Eq. (7: ' γ =( yα µ α [ R ] ( yβ µ β (7 αβ αβ Ths strategy s llustrated for oe ad two dmesoal spaces as showed Fg ad, respectvely. The latter was tae from a bvarate Gaussa dstrbuto, wth dagoal covarace matrx. J. Computer Sc., 3 (5: 59-65, 007 d 63 Fg. : Π for cluster wth oe-dmesoal Gaussa dstrbuto Fg. : Π for a cluster wth bvarate Gaussa dstrbuto wth dagoal covarace matrx. Ths procedure ca be used eve the case of multvarate Gaussa dstrbutos wth urestrcted covarace matrx, as t s always possble to fd a lear trasformato that maps ay multvarate Gaussa dstrbuto a equvalet ew o correlated multvarate Gaussa dstrbuto wth same value for γ as the former dstrbuto [8]. As observed data ca belog to a multdmesoal space (R, a geeralzed dstace γ, defed Eq. (8, s troduced. Ths leads to a ormalzato of the probabltes expressed by Eq.( data models belogg to dfferet dmesoal spaces, allowg computato of probabltes to be reduced to the oe dmesoal space, whch ca be executed by a smple looup table procedure, mag computatoal complexty feasble real tme. γ = γ/ d (8 RESULTS AND DISCUSSION The proposed model was mplemeted ad evaluated wth artfcal data. Fgures 3 ad 4 preset results for a model traed from data extracted from depedet ad well-separated Gaussa sources. Model order ( has bee estmated by evaluato of mmum etropy for models wth varyg from to 3. Estmated etropy for each ad optmal model parameters are show as well. Fgures 3 ad 4 also preset the detecto pealty evaluated for a ew occurrece represetg, respectvely, a clearly ormal behavor ad a clearly aomalous behavor.

6 J. Computer Sc., 3 (5: 59-65, 007 Trag data cossts of all realzatos of the same operato all coectos logged durg the referece data extracto. The use of recursve loglelhood ad etropy estmato as a measure for motorg model degradato related wth behavor chages ad the assocated model update. I our prelmary expermets, the proposed IDS model has bee tested a stadard PC platform. Executo of detecto ad updatg algorthms were verfed for data rates of 500 requests per secod a thrd order model (=3. 0, 0,08 0,06 0 Etropy- 3D 0,09 3 Fg. 3: 3-cluster behavor model ad ormal behavor recogto. 0, 0,08 0,06 0 Etropy- 3D 0,09 3 Fg. 4: 3-cluster behavor model ad abormal behavor detecto. Cocluso Ths probablstc approach s a tetatve research o the possblty of applyg Bayesa usupervsed learg the detecto of etwor trusos. Based o usupervsed learg algorthms (Bayesa classfcato, some ovel detecto methods are proposed showg a very hgh detecto rate wth a reasoable true postve rate as results, much better tha the classc method. By trag wth usupervsed learg algorthms, amely, Bayesa classfcato procedure, the log aalyzer performs well dscoverg the heret ature of the dataset, clusterg smlar staces to the same classes. We have preseted a ew aomaly IDS desg usg a parametrc mxture model for behavor modelg ad Bayesa based detecto. Cotuous model update s accomplshed by model parameter re-estmato. Algorthms for detecto ad update phases are desged for real-tme operatos. Prelmary expermetatos show that proposed algorthms have some lmtatos such as that the erel dstrbutos are used to model umercal data wth cotuous ad ubouded ature, the Gaussa parametrcal model may ot be sutable for complex data ad that the use of mxed models assumes statstcal depedece betwee trals, whch ca be restrctve some cases. Despte these drawbacs the system presets real-tme feasblty wth o specal hardware requremet. Moreover, t s beg exteded to detect securty volatos a heterogeeous etwored evromet. The scalablty, performace ad fault tolerace ca be mproved whe moble agets perform dstrbuted detecto ad do ot eed a cetral locato where data s gathered. For stace, for wreless etwors such as Moble Ad hoc Networs are greatly proe to securty threats. Sce truso to the trasmsso support s relatvely easy, compared to fxed etwors, the use of such IDS s greatly recommeded. 64

7 J. Computer Sc., 3 (5: 59-65, 007 REFERENCES. H. Debar, M. Dacer ad A. Wesp, 999. A Revsed Taxoomy for Itruso-Detecto Systems, IBM Research Report.. C. rügel ad T. Toth, 00. Flexble, moble aget based truso detecto for dyamc etwors, Europea Wreless, Florece Italy. 3. H. Luo, P. Zerfos, J. og, S. Lu ad L. Zhag, 004. Self Securg Ad Hoc Wreless Networs, proceedg of the 7th Iter. Symp. O computers ad commucatos. 4. P. Cheesema ad J. Stutz, 996. Bayesa classfcato (Auto Class: theory ad results Advaces owledge Dscovery ad Data Mg, edted by U.M. Fayyad et al., Calfora: The AAAI Press, pp: A. P. Dempster, N. M. Lard ad D. B. Rub, 977. Joural of the Royal Statstcal Socety B 39, pp: G. J. McLachla, D. Peel,. E. Basford ad P. Adams, 999. Joural of Statstcal Software S. J. Roberts, R. Everso ad I. Reze, 999. Patter Recogto, 33:5, pp: Z. Marrach, 00. Détecto d Itruso Comportemetale das les Systèmes à Objets Réparts: Modélsato des Séqueces de Requêtes et de la Répartto de leurs Paramètres, PhD Thess, Uversté de Rees I. 9. Z. Marrach, L. Mé, B. Vvs ad B. Mor, 000. Flexble Itruso-Detecto Usg Varable- Legth Behavor Modelg Dstrbuted Evromet: Applcato to CORBA Objects, Proceedgs of 3rd Iteratoal Worshop o the Recet Advaces Itruso Detecto, pp: R. A. Johso, D.A. Wcher ad D. W. Wcher, 998. Appled Multvarate Statstcal Aalyss 4th Edto, Pretce-Hall, pp: