Using Bayesian Networks
for Detecting Network
Anomalies
Lane Thames
ECE 8833 Intelligent Systems
Goals for this Project
To see how well a Bayesian Learning
Network performs at predicting attacks
within a computer network
How do the predictions change when
using pure network data versus a
combination of network and host data
Common Types of Attacks
Buffer Overflow Attacks


Redirects Program Control Flow which
causes the computer to execute carefully
injected malicious code
Code be crafted to elevate the privileges of a
user by obtaining super user (root) privileges
Common Types of Attacks
Denial of Service


Exhaust a computer’s resources: TCP SYN
Flooding Attack
Consume a computer’s available networking
bandwidth: ICMP Smurf Attack
Data Sets
UCI Knowledge Discovery in Databases
(KDD) archive
KDD Cup 1999 for Intrusion Detection
Database
A subset of data generated by MIT Lincoln
Labs that simulated a military networking
environment (4 weeks @ 22 hrs/day of
data)
Data Sets
Contained data for training and separate,
labeled data for testing
The test data contained noise because it
contained attack data that was not
included in the training data
Data Sets
22 total attack types were generated and
were interlaced with normal traffic flows
Types of Attacks within the data




Denial of Service
Unauthorized remote access
Local user to super user access
Probing: Reconnaissance and network
mapping
Data Sets
41 Features that could be used as
Random Variables within a Bayesian
Network


Host Based Features
Network Based Features
Feature Set Snippet
protocol
service
flag
srcB
dstB
cnt
srvcnt
serrrate
rerrrate
typeAtck
tcp
http
SF
235
1337
8
8
0
0
normal.
tcp
http
SF
219
1337
6
6
0
0
normal.
icmp
ecr_i
SF
1032
0
511
511
0
0
smurf.
icmp
ecr_i
SF
1032
0
511
511
0
0
smurf.
tcp
private
S0
0
0
103
1
1
0
neptune.
tcp
private
S0
0
0
112
10
1
0
neptune.
Tool Boxes Used for the Project
BN Power Constructor



Developed by J. Cheng at the University of
Alberta in Canada
Tool for generating possible network
structures given a set of training data
Exports the structure in DNE Bayesian
network file format
Tool Boxes Used for the Project
NeticaJ by Norsys




Java based development library
Used to build the Bayesian network codebase
for this project
Imports structure in DNE file format
Contains functions for doing inference and
learning CPTs given a set of training data
Implementation
2 types of structures used


Combination of network and host based
features
Only network based features
Host/Network Structure
Host/Network Test Results
Using the Noisy Test Data
65,505 Total Test Cases
65,019 Correctly Classified
99.26% Classification Accuracy
Probabilities for a Single Flow
Attack Probablities for a Normal Flow
1.00E+01
1.00E+00
1.00E-01
1.00E-02
1.00E-03
Probability
1.00E-04
1.00E-05
1.00E-06
1.00E-07
1.00E-08
1.00E-09
1.00E-10
1.00E-11
1.00E-12
1.00E-13
Attack Type
Probabilities for a Smurf Flow
Attack Probability during a SMURF attack
1.00E+01
1.00E+00
1.00E-01
1.00E-02
1.00E-03
1.00E-04
1.00E-05
Probability
1.00E-06
1.00E-07
1.00E-08
1.00E-09
1.00E-10
1.00E-11
1.00E-12
1.00E-13
1.00E-14
1.00E-15
1.00E-16
1.00E-17
1.00E-18
Attack Type
Time Series of Normal Probabilities
Time Series Normal Classifications
1.2
1
Probability
0.8
0.6
0.4
0.2
0
0
50
100
150
200
250
Time Epoch
300
350
400
450
Network Features Structure
Network Variables Test Results
62,047 Total Noisy Test Cases
59,734 Correctly Classified
96.27% Classification Accuracy
Conclusion
The Bayesian Network produced very
impressive results
The reduced structure only relied on
network data, and only suffered from a
small decrease in accuracy
Term project will extend this to incorporate
a SOM variable