Protection of an information system by artificial intelligence: a three-phase approach based on behaviour analysis to detect a hostile scenario

by   Jean-Philippe Fauvelle, et al.

The analysis of the behaviour of individuals and entities (UEBA) is an area of artificial intelligence that detects hostile actions (e.g. attacks, fraud, influence, poisoning) due to the unusual nature of observed events, by affixing to a signature-based operation. A UEBA process usually involves two phases, learning and inference. Intrusion detection systems (IDS) available still suffer from bias, including over-simplification of problems, underexploitation of the AI potential, insufficient consideration of the temporality of events, and perfectible management of the memory cycle of behaviours. In addition, while an alert generated by a signature-based IDS can refer to the signature on which the detection is based, the IDS in the UEBA domain produce results, often associated with a score, whose explainable character is less obvious. Our unsupervised approach is to enrich this process by adding a third phase to correlate events (incongruities, weak signals) that are presumed to be linked together, with the benefit of a reduction of false positives and negatives. We also seek to avoid a so-called "boiled frog" bias inherent in continuous learning. Our first results are interesting and have an explainable character, both on synthetic and real data.


page 1

page 2

page 3

page 4


Creating an Explainable Intrusion Detection System Using Self Organizing Maps

Modern Artificial Intelligence (AI) enabled Intrusion Detection Systems ...

Sufficient Reasons for A Zero-Day Intrusion Detection Artificial Immune System

The Internet is the most complex machine humankind has ever built, and h...

The Influence of Explainable Artificial Intelligence: Nudging Behaviour or Boosting Capability?

This article aims to provide a theoretical account and corresponding par...

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

This survey presents a comprehensive review of current literature on Exp...

Domain Knowledge Aided Explainable Artificial Intelligence for Intrusion Detection and Response

Artificial Intelligence (AI) has become an integral part of modern-day s...

Ransomware Detection using Process Memory

Ransomware attacks have increased significantly in recent years, causing...

Please sign up or login with your details

Forgot password? Click here to reset