用贝叶斯方法动态检测网络入侵，自动匹配运维误差预算。
Risk-Calibrated Bayesian Streaming Intrusion Detection with SRE-Aligned Decisions
- 结合贝叶斯在线变化点检测与SRE误差预算，动态调整告警阈值。
- 在UNSW-NB15和CIC-IDS2017上实现中高召回率下精度提升，概率校准更好。
- 适合关注实时安全监控与运维可靠性平衡的工程师和研究者。
我们提出一种风险校准的流式入侵检测方法，将贝叶斯在线变化点检测（BOCPD）与站点可靠性工程（SRE）误差预算对齐的决策阈值相结合。BOCPD提供随分布漂移和概念漂移自适应的运行长度后验概率；我们通过在误报与漏报预算下优化预期运营成本，将这些后验概率映射为告警决策。文中详述了危险模型、共轭更新及每事件复杂度O(1)的实现方式。以99.9%可用性服务等级目标（每月43.2分钟误差预算）为例，当漏检代价是误报的10倍时，最优概率阈值接近0.91。在完整UNSW-NB15与CIC-IDS2017基准数据集上采用时间顺序划分进行评估，对比强无监督基线（ECOD、COPOD、LOF）。评价指标包括PR-AUC、ROC-AUC、Brier得分、校准可靠性图以及以事件数衡量的检测延迟。结果表明，在中高召回率下精度提升，概率校准优于基线。我们公开实现细节、超参数及对危险敏感性和计算开销的消融实验。代码与可复现材料将在发表后提供；数据集与实现可通过合理请求向通讯作者获取。
原文摘要 · Abstract (English)
We present a risk-calibrated approach to streaming intrusion detection that couples Bayesian Online Changepoint Detection (BOCPD) with decision thresholds aligned to Site Reliability Engineering (SRE) error budgets. BOCPD provides run-length posteriors that adapt to distribution shift and concept drift; we map these posteriors to alert decisions by optimizing expected operational cost under false-positive and false-negative budgets. We detail the hazard model, conjugate updates, and an O(1)-per-event implementation. A concrete SRE example shows how a 99.9% availability SLO (43.2 minutes per month error budget) yields a probability threshold near 0.91 when missed incidents are 10x more costly than false alarms. We evaluate on the full UNSW-NB15 and CIC-IDS2017 benchmarks with chronological splits, comparing against strong unsupervised baselines (ECOD, COPOD, and LOF). Metrics include PR-AUC, ROC-AUC, Brier score, calibration reliability diagrams, and detection latency measured in events. Results indicate improved precision-recall at mid to high recall and better probability calibration relative to baselines. We release implementation details, hyperparameters, and ablations for hazard sensitivity and computational footprint. Code and reproducibility materials will be made available upon publication; datasets and implementation are available from the corresponding author upon reasonable request.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。