Search

Bayesian belief networks (BBN) and fuzzy cognitive maps (FCM) are two major causal knowledge frameworks that are frequently used in various domains for cause and effect analysis. However, most researchers use these as separate approaches to analyse the cause(s) and effect(s) of an event. In practice, both methods have their own strengths and weaknesses in both causal modelling and causal analysis. In this paper, a combination of BBN and FCM is used in order to model and analyse network intrusions. First, the BBN is learnt from network intrusion data; following this, an FCM is generated from the BBN, using a migration method. A data-mining approach is suitable for use in the construction of a BBN for network intrusion since this is a data-rich domain, while an FCM is appropriate for the intuitive representation of complex domains. The proposed method of network intrusion analysis using both BBN and FCM consists of several stages, in order to leverage the capabilities of each approach in building the causal model and performing causal analysis. Both the intuitive representation of the causal model in FCM and the wide variety of reasoning methods supported by BBN are exploited in this research to facilitate network intrusion analysis. [ABSTRACT FROM AUTHOR]

People often want to know the root cause of things and events in certain application domains such as intrusion detection, medical diagnosis, and fault diagnosis. In many of these domains, a large amount of data is available. The problem is how to perform root cause analysis by leveraging the data asset at hand. Root cause analysis consists of two main functions, diagnosis of the root cause and prognosis of the effect. In this paper, a method for root cause analysis is proposed. In the first phase, a causal knowledge model is constructed by learning a Bayesian belief network (BBN) from data. BBN’s backward and forward inference mechanisms are used for the diagnosis and prognosis of the root cause. Despite its powerful reasoning capability, the representation of causal strength in BBN as a set of probability values in a conditional probability table (CPT) is not intuitive at all. It is at its worst when the number of probability values needed grows exponentially with the number of variables involved. Conversely, a fuzzy cognitive map (FCM) can provide an intuitive interface as the causal strength is simply represented by a single numerical value. Hence, in the second phase of the method, an intuitive interface using FCM is generated from the BBN-based causal knowledge model, applying the migration framework proposed and formulated in this paper. [ABSTRACT FROM AUTHOR]