A Renewal Model of Intrusion

TL;DR

This paper introduces a probabilistic Bayesian model for detecting intrusions within renewal processes, applicable to scenarios like fraud detection and equipment failures, with evaluation on synthetic and real payment data.

Contribution

It proposes a novel Bayesian approach to identify intrusion subsequences in renewal processes, including inference methods for intrusion probability and MAP subsequence detection.

Findings

Effective intrusion detection on synthetic data

Successful application to anonymized online payment data

Accurate marginal probability estimation for events

Abstract

We present a probabilistic model of an intrusion in a renewal process. Given a process and a sequence of events, an intrusion is a subsequence of events that is not produced by the process. Applications of the model are, for example, online payment fraud with the fraudster taking over a user's account and performing payments on the user's behalf, or unexpected equipment failures due to unintended use. We adopt Bayesian approach to infer the probability of an intrusion in a sequence of events, a MAP subsequence of events constituting the intrusion, and the marginal probability of each event in a sequence to belong to the intrusion. We evaluate the model for intrusion detection on synthetic data and on anonymized data from an online payment system.