Probabilistic Models for Anomaly Detection Based on Usage of Network Traffic

Abstract

Recent advances in intrusions and attacks reflect vulnerabilities in computer networks. Innovative methods and tools can help attack defenses, prevent attack propagations, detect and respond to such attacks in a timely manner. Intrusion detection and prevention systems search for unauthorized use, recognize anomalous behavior, and prevent attempts to deny services.  These systems gather and analyze information from the network, identify possible breaches of the security profile, as well as misuses. We have been experimenting with methods for introducing important concepts related to intrusion detection and improving undergraduate research experiences and education. To achieve this goal, probabilistic models are introduced to students in computer, information system and network security courses. This article presents a set of probabilistic methods and statistical models for network traffic anomaly detection. It also describes some prospects and how models have ripened from theories to big data analysis applications.

Keywords: Intrusion, conditional probability, network system, regression, data analysis