Intrusion diagnosis and prediction with expert system

Network diagnosis and attack prediction can help the network administrator to take timely actions to defend against well-planned attacks that exploit a chain of vulnerabilities. One important data source for such analysis is the alerts generated by intrusion detection systems (IDS) deployed over the network. However, IDS typically generates overwhelming amount of alerts, where one cannot simply aggregate or discard. In addition, the chance of a successful exploit depends on many hidden factors such as system status and attacker power, and thus the dependencies among exploits and conditions are typically too complicated to analyze under probability framework. In this paper, we employ expert system to deal with such uncertainties and conduct certainty factor inference. We show that analysis in fuzzy system is tractable and we propose an algorithm to analyze the network status and predict the potential attacks. Finally, we give a case study to illustrate our algorithm and evaluate the effectiveness of our approach on the DARPA data sets.