A Probabilistic Approach for Network Intrusion Detection

Abstract

This study aims to propose a probabilistic approach for detecting network intrusions using Bayesian networks (BNs). Three variations of BN, namely, naive Bayesian network (NBC), learned BN, and handcrafted BN, were evaluated and from which, an optimal BN was obtained. A standard dataset containing 494020 records, a category for normal network traffics, and four major attack categories (denial of service, probing, remote to local, user to root and normal), were used in this study. The dataset went through an 80-20 split to serve the training and testing phases. 80% of the dataset were treated with a feature selection algorithm to obtain a set of features, from which the three BNs were constructed. During the evaluation phase, the remaining 20% of the dataset were used to obtain the classification accuracies of the BNs. The results show that the hand-crafted BN, in general, has outperformed NBC and Learned BN.