Extending Signature-based Intrusion Detection Systems WithBayesian
  Abductive Reasoning
  Evolving cybersecurity threats are a persistent challenge for
systemadministrators and security experts as new malwares are continu-ally
released. Attackers may look for vulnerabilities in commercialproducts or
execute sophisticated reconnaissance campaigns tounderstand a targets network
and gather information on securityproducts like firewalls and intrusion
detection / prevention systems(network or host-based). Many new attacks tend to
be modificationsof existing ones. In such a scenario, rule-based systems fail
to detectthe attack, even though there are minor differences in conditions
/attributes between rules to identify the new and existing attack. Todetect
these differences the IDS must be able to isolate the subset ofconditions that
are true and predict the likely conditions (differentfrom the original) that
must be observed. In this paper, we proposeaprobabilistic abductive
reasoningapproach that augments an exist-ing rule-based IDS (snort [29]) to
detect these evolved attacks by (a)Predicting rule conditions that are likely
to occur (based on existingrules) and (b) able to generate new snort rules when
provided withseed rule (i.e. a starting rule) to reduce the burden on experts
toconstantly update them. We demonstrate the effectiveness of theapproach by
generating new rules from the snort 2012 rules set andtesting it on the MACCDC
2012 dataset [6].
