Network attack detection using combined probabilities

摘要

In one embodiment, a device in a network receives a set of output label dependencies for a set of attack detectors. The device identifies applied labels that were applied by the attack detectors to input data regarding a network, the applied labels being associated with probabilities. The device determines a combined probability for two or more of the applied labels based on the output label dependencies and the probabilities associated with the two or more labels. The device selects one of the applied labels as a finalized label for the input data based on the probabilities associated with the applied labels and on the combined probability for the two or more labels.

主权项

1. A method, comprising:
receiving, at a device in a network, a set of output label dependencies for a set of attack detectors that exploit dependencies between overlapping labels used by different attack detection classifiers; identifying, by the device, applied labels that were applied by the attack detectors to input data regarding the network, wherein probabilities are associated with the applied labels; determining, by the device, a combined probability for two or more of the applied labels based on the output label dependencies and the probabilities associated with the two or more labels; and selecting, by the device, one of the applied labels as a finalized label for the input data based on the probabilities associated with the applied labels and on the combined probability for the two or more labels.