Internet Threat Detection System Using Bayesian Estimation

Abstract. We present an Internet security threat detection system∗4 using Bayesian estimation method. This system analyzes security state of the Internet using Bayesian estimation with transi-tion of frequencies of IP packet arrival events to some specified IP addresses such as port scanning, worm activities and so on. While the system calculates the frequency of access events in each time interval, Bayesian updating has been repeatedly applied to improve the confidence in degree of Internet critical states. When the system detects security threat(s) on the Internet, a security alert message is automatically sent to registered E-mail addresses, such as system administrators’, and the system issues security alert details on our Web site∗5. We also provide simple HTML and HDML for mobile phone browsers aka NTT DoCoMo’s i-mode and KDDI’s EZweb. Since the security state of the Internet changes dynamically, application of Bayesian estimation for threat detection is considered suitable because parameters of the model of Bayesian estimation are consid-ered as dynamically changing quantities. This paper is focused on mechanism of detecting security threat using Bayesian estimation and our experimental evaluation.