Cyber Security Inference Based on a Two-Level Bayesian Network Framework
Yun Zhou, Cheng Zhu, Luohao Tang, Weiming Zhang, Pei‐Chao Wang · 2018
Graphical models are widely used in cyber security analysis to capture relationships among variables in attack scenarios. However, most models are difficult to build due to the greatly imbalanced data in cyber attacks. To solve this problem, we propose a two-level Bayesian network framework in this paper. We firstly classify the cyber attacks into two levels, one is used to identify general types of attacks and the other is used to classify specific forms. Then we train Bayesian networks for each level. To help administrators cope with threats in time, we propose an analysis method. This method finds the important node's Markov blanket and sorts nodes in it by their influence on each specific form, which could help to understand key threats in cyberspace.