  Intrusion detection systems (IDSs) fall into two high-level categories:
network-based systems (NIDS) that monitor network behaviors, and host-based
systems (HIDS) that monitor system calls. In this work, we present a general
technique for both systems. We use anomaly detection, which identifies patterns
not conforming to a historic norm. In both types of systems, the rates of
change vary dramatically over time (due to burstiness) and over components (due
to service difference). To efficiently model such systems, we use continuous
time Bayesian networks (CTBNs) and avoid specifying a fixed update interval
common to discrete-time models. We build generative models from the normal
training data, and abnormal behaviors are flagged based on their likelihood
under this norm. For NIDS, we construct a hierarchical CTBN model for the
network packet traces and use Rao-Blackwellized particle filtering to learn the
parameters. We illustrate the power of our method through experiments on
detecting real worms and identifying hosts on two publicly available network
traces, the MAWI dataset and the LBNL dataset. For HIDS, we develop a novel
learning method to deal with the finite resolution of system log file time
stamps, without losing the benefits of our continuous time model. We
demonstrate the method by detecting intrusions in the DARPA 1998 BSM dataset.
