Evidential reasoning in network intrusion detection systems

Abst rac t . Intrusion Detection Systems (IDS) have previously been built by hand. These systems have difficulty successfully classifying intruders, and require a significant amount of computational overhead making it difficult to create robust real-time IDS systems. Artificial Intelligence techniques can reduce the human effort required to build these systems and can improve their performance. AI has recently been used in Intrusion Detection (ID) for anomaly detection, data reduction and induction, or discovery, of rules explaining audit data [l]. This paper proposes the application of evidential reasoning for dealing with uncertainty in Intrusion Detection Systems. We show how dealing with uncertainty can allow the system to detect the abnormality in the user behavior more efficiently.