Method and system for adaptive anomaly-based intrusion detection

• US 8,800,036 B2
• Filed: 01/22/2010
• Issued: 08/05/2014
• Est. Priority Date: 01/22/2010
• Status: Expired due to Fees

• Current Assignee: School of Electrical Engineering and Automation Tianjin University
• Original Assignee: School of Electrical Engineering and Automation Tianjin University
• Inventors: Khayam, Syed Ali, Ali, Muhammad Qasim
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US12/692,165
• Publication Number:
  US 20110185422A1
• Time in Patent Office: 1,656 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

The input characteristics of a real-time IDS change continuously with time therefore setting a rigid (time and behavior invariant) classification threshold limits the accuracy that the IDS can potentially achieve. A generic threshold tuning method and system is proposed which can adaptively tune the detection threshold of a real-time IDS in accordance with varying host and network behavior. The method and system perform statistical and information-theoretic analysis of network and host-based IDSs'"'"' anomaly based intrusions to reveal a consistent time correlation structure between benign activity periods which is used to predict future anomaly scores and to adapt an IDS'"'"' detection threshold accordingly.

Claims

1. A computer implemented method of intrusion detection in an enterprise network, the method comprising:

a) developing a prediction model to predict expected values of future anomaly scores from real time anomaly scores based on an output of an anomaly detection system derived from an input of network traffic pattern data of the enterprise network in real time under benign conditions;

b) setting an adaptive classification threshold based on the expected values predicted by the prediction model; and

c) classifying unknown observations not within the adaptive classification threshold as possible intrusions;

wherein the expected values of future anomaly scores ({circumflex over (r)}⁽ⁿ⁺¹⁾) are calculated from the equation;

2. The method of claim 1, wherein the real time anomaly scores exhibit a decaying temporal dependence.

3. The method of claim 1 further comprising predicting the future anomaly scores based on the real time anomaly scores.

8. The method of claim 1, wherein the prediction model is quantified using a statistical measure and an information theoretic measure.

9. The method of claim 8, wherein the statistical measure is an autocorrelation and the information theoretic measure is a conditional entropy.

10. The method of claim 1 further comprising adjusting the adaptive classification threshold in real time in accordance with real time variations in the network traffic pattern data.

13. The method of claim 1, wherein the input of network traffic pattern data is selected from the group consisting of operating system measurements and system call sequences.

4. A computer implemented method of adjusting an adaptive classification threshold in an intrusion detection system, the intrusion detection system using the adaptive classification threshold to identify possible intrusions, the method comprising:

a) tracking a real time anomaly score based on an output of an anomaly detection system derived from an input of network traffic pattern data of an enterprise network in real time using a stochastic prediction model;

b) predicting expected values of future anomaly scores from the real time anomaly score of the stochastic prediction model; and

c) adjusting the adaptive classification threshold based on the expected values of future anomaly scores;

wherein the expected values of future anomaly scores ({circumflex over (r)}⁽ⁿ⁺¹⁾) are calculated from the equation;

5. The method of claim 4, wherein the real time anomaly scores exhibit a decaying temporal dependence.

6. The method of claim 4 further comprising predicting the future anomaly scores based on the real time anomaly scores.

7. The method of claim 4 further comprising adjusting the adaptive classification threshold in real time in accordance with real time variations in the network traffic pattern data.

11. The method of claim 4, wherein the prediction model is quantified using a statistical measure and an information theoretic measure.

12. The method of claim 11, wherein the statistical measure is an autocorrelation and the information theoretic measure is a conditional entropy.

14. The method of claim 4, wherein the input of network traffic pattern data is selected from the group consisting of operating system measurements and system call sequences.