skip to main content


Title: A likelihood ratio anomaly detector for identifying within-perimeter computer network attacks

The rapid detection of attackers within firewalls of enterprise computer networks is of paramount importance. Anomaly detectors address this problem by quantifying deviations from baseline statistical models of normal network behavior and signaling an intrusion when the observed data deviates significantly from the baseline model. But, many anomaly detectors do not take into account plausible attacker behavior. As a result, anomaly detectors are prone to a large number of false positives due to unusual but benign activity. Our paper first introduces a stochastic model of attacker behavior which is motivated by real world attacker traversal. Then, we develop a likelihood ratio detector that compares the probability of observed network behavior under normal conditions against the case when an attacker has possibly compromised a subset of hosts within the network. Since the likelihood ratio detector requires integrating over the time each host becomes compromised, we illustrate how to use Monte Carlo methods to compute the requisite integral. We then present Receiver Operating Characteristic (ROC) curves for various network parameterizations that show for any rate of true positives, the rate of false positives for the likelihood ratio detector is no higher than that of a simple anomaly detector and is often lower.more » Finally, we demonstrate the superiority of the proposed likelihood ratio detector when the network topologies and parameterizations are extracted from real-world networks.« less
 [1] ;  [2] ;  [3] ;  [1] ;  [4] ;  [4]
  1. American Univ., Washington, DC (United States). Economics Dept.
  2. Santa Fe Inst. (SFI), Santa Fe, NM (United States)
  3. Ernst and Young, Denver, CO (United States)
  4. Los Alamos National Lab. (LANL), Los Alamos, NM (United States)
Publication Date:
Report Number(s):
Journal ID: ISSN 1084-8045
Grant/Contract Number:
Accepted Manuscript
Journal Name:
Journal of Network and Computer Applications
Additional Journal Information:
Journal Volume: 66; Journal Issue: C; Journal ID: ISSN 1084-8045
Research Org:
Los Alamos National Lab. (LANL), Los Alamos, NM (United States)
Sponsoring Org:
Country of Publication:
United States
97 MATHEMATICS AND COMPUTING; Anomaly detection; Computer network defense; Cyber security; Likelihood ratio detection; ROC analysis; Model misspecification
OSTI Identifier: