Using Bayesian Inference To Detect Cyber Attacks

The talk opens with spam filtering as a familiar example of how one word is weak evidence, while several words together raise suspicion. The speaker explains Bayesian inference as a way to update the probability of a conclusion each time new evidence arrives, using a wet street as an everyday analogy for rain.

The main case is CrowdSec, an open-source security engine whose leaky bucket mechanism collects events, lets them drain over time, and raises an alert on overflow. The proposal replaces the internal counting with Bayesian updates, so each event shifts a running probability that a client is a bot, and an alert fires once that value crosses a threshold. An e-commerce case study shows how signals such as disabled JavaScript, the language path of product URLs, browsing patterns and early searches each look harmless alone but add up when combined.

The speaker stresses that this suits evasive scraping and fraud bots rather than clear exploit signatures, where a plain threshold rule remains the better choice. Priors and conditional probabilities can be estimated by counting labelled bot and non-bot IPs in logs. More complex models would be expensive per IP inside a security engine, so the speaker invites people with use cases and logs to get in touch for feedback on an upcoming automated training tool.