Abstract—Intrusion detection is an essential tool to protect hacking and unauthorized access in computer networks nowadays. Mechanisms used to attack keep evolving as the internet technology is improving. Hence, the task of differentiating authorized and unauthorized access has become more and more challenging. The modeling of network intrusion domain and causal reasoning for the intrusion detection has been proposed in this paper to address the security issues of a network. Bayesian network modeling with causal knowledge-driven approach has been selected for a network intrusion domain. Reasoning capabilities of Bayesian network have been adapted to perform detection and analysis in the domain.There are two main problems to be addressed in this paper: the first problem is to model the network intrusion domain and the second problem is to perform causal reasoning for intrusion detection and analysis. A methodology has been proposed to solve the two problems mentioned above. Intrusion detection is viewed as fault diagnosis in causal reasoning, and the analysis of the effect is viewed as fault prognosis. To address the first problem under causal knowledge-driven approach, we propose Bayesian network for the modeling of network intrusion domain. The second problem is addressed by applying the powerful reasoning capabilities of Bayesian network. The capabilities of causal reasoning using Bayesian network have not been fully discovered in the domain of intrusion detection. This research work is to bridge the gap.

Index Terms—Soft computing, intrusion detection, Bayesiannetwork , causal discovery, causal reasoning.

The authors are with the Multimedia University, Jalan Ayer Keroh Lama75450 Bukit Beruang Melaka Malaysia. (e-mail: yywee@mmu.edu.my,wpcheah@mmu.edu.my, sctan@mmu.edu.my,wee.kuok.kwee@mmu.edu.my).

Cite: Yit Yin Wee, Wooi Ping Cheah, Shing Chiang Tan, and KuokKwee Wee, "Reasoning with Cause and Effect in Intrusion Detection," International Journal of Computer and Electrical Engineering vol. 4, no. 5, pp. 641-646, 2012.