Creating behavior-based rules for snort based on Bayesian network learning algorithms

Abstract

Anomaly detection itself may not be considered as the perfect solution to detect any new threat. In this paper, we propose to use Bayesian approach to detect relationship among variables in a network traffic dataset of the University's computer network. We apply two algorithms for learning Bayesian networks in order to form a Bayesian model. Next, p Bayesian Inference is performed in order to examine relationships among variables. The strong relationship among variables and unusually strong influences on other variables in the BN model will be used to define the rules according to our environment and needs for building an intrusion detection system. Finally, we create Snort rules based upon the relationships in the model.