Hybrid Intrusion Detection and Prediction multiAgent System HIDPAS

This paper proposes an intrusion detection and prediction system based on uncertain and imprecise inference networks and its implementation. Giving a historic of sessions, it is about proposing a method of supervised learning doubled of a classifier permitting to extract the necessary knowledge in order to identify the presence or not of an intrusion in a session and in the positive case to recognize its type and to predict the possible intrusions that will follow it. The proposed system takes into account the uncertainty and imprecision that can affect the statistical data of the historic. The systematic utilization of an unique probability distribution to represent this type of knowledge supposes a too rich subjective information and risk to be in part arbitrary. One of the first objectives of this work was therefore to permit the consistency between the manner of which we represent information and information which we really dispose. Besides, our system integrates host intrusion detection and network intrusion prediction in the setting of a global antiintrusions system capable to function like a HIDS (Host based Intrusion Detection System) before functioning like NIPS (Network based Intrusion Prediction System). The so proposed anti-intrusions system permits to combine two powerful tools together to permit a reliable host intrusion detection leading to an as reliable network intrusion prediction. In our contribution, we chose to do a supervised learning based on Bayesian networks. The choice of modeling the historic of data with Bayesian networks is dictated by the nature of learning data (statistical data) and the modeling power of Bayesian networks. However, taking into account the incompleteness that can affect the knowledge of parameters characterizing the statistical data and the set of relations between phenomena, the proposed system in the present work uses for the inference process a propagation method based on a bayesian possibilistic hybridization. The so proposed system is adapted to the modeling of reliability with taking into account imprecision. Keywords-uncertainty; imprecision; host intrusion detection; network intrusion prediction; Bayesian networks; bayesian possibilistic hybridization.