# IT Intrusion Detection Using Statistical Learning and Testbed Measurements

arXiv: https://arxiv.org/abs/2402.13081 · HTML: https://mlsanity.com/paper/2402.13081/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 53 references that are in the map.
- First posted on arXiv 20 Feb 2024.

## Builds on (most cited first, 6 of 6)

- [Learning Near-Optimal Intrusion Responses Against Dynamic Attackers](https://mlsanity.com/paper/2301.06085/) (2023)
- [Shuffling Recurrent Neural Networks](https://mlsanity.com/paper/2007.07324/) (2020)
- [Learning Security Strategies through Game Play and Optimal Stopping](https://mlsanity.com/paper/2205.14694/) (2022)
- [Architectures for Detecting Interleaved Multi-stage Network Attacks Using Hidden Markov Models](https://mlsanity.com/paper/1807.09764/) (2018)
- [Attacker Behaviour Profiling using Stochastic Ensemble of Hidden Markov Models](https://mlsanity.com/paper/1905.11824/) (2019)
- [Attack Prediction using Hidden Markov Model](https://mlsanity.com/paper/2106.02012/) (2021)

## Built on by (most cited first, 1 of 1)

- [Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search](https://mlsanity.com/paper/2407.11070/) (2024)

## Abstract (arXiv)

We study automated intrusion detection in an IT infrastructure, specifically the problem of identifying the start of an attack, the type of attack, and the sequence of actions an attacker takes, based on continuous measurements from the infrastructure. We apply statistical learning methods, including Hidden Markov Model (HMM), Long Short-Term Memory (LSTM), and Random Forest Classifier (RFC) to map sequences of observations to sequences of predicted attack actions. In contrast to most related research, we have abundant data to train the models and evaluate their predictive power. The data comes from traces we generate on an in-house testbed where we run attacks against an emulated IT infrastructure. Central to our work is a machine-learning pipeline that maps measurements from a high-dimensional observation space to a space of low dimensionality or to a small set of observation symbols. Investigating intrusions in offline as well as online scenarios, we find that both HMM and LSTM can be effective in predicting attack start time, attack type, and attack actions. If sufficient training data is available, LSTM achieves higher prediction accuracy than HMM. HMM, on the other hand, requires less computational resources and less training data for effective prediction. Also, we find that the methods we study benefit from data produced by traditional intrusion detection systems like SNORT.