Burstiness of Intrusion Detection Process: Empirical Evidence and a Modeling Approach
This work provides insights into network security dynamics for organizations, though it is incremental as it focuses on modeling rather than new detection capabilities.
The authors analyzed intrusion detection records from large organizations and found that the detection process exhibits significant burstiness and memory, similar to natural threshold-driven processes but distinct from human activities. They developed a hidden Markov model to capture this burstiness, showing it accounts for intrinsic bursting patterns in network incidents.
We analyze sets of intrusion detection records observed on the networks of several large, nonresidential organizations protected by a form of intrusion detection and prevention service. Our analyses reveal that the process of intrusion detection in these networks exhibits a significant degree of burstiness as well as strong memory, with burstiness and memory properties that are comparable to those of natural processes driven by threshold effects, but different from bursty human activities. We explore time-series models of these observable network security incidents based on partially observed data using a hidden Markov model with restricted hidden states, which we fit using Markov Chain Monte Carlo techniques. We examine the output of the fitted model with respect to its statistical properties and demonstrate that the model adequately accounts for intrinsic "bursting" within observed network incidents as a result of alternation between two or more stochastic processes. While our analysis does not lead directly to new detection capabilities, the practical implications of gaining better understanding of the observed burstiness are significant, and include opportunities for quantifying a network's risks and defensive efforts.