Capturing uncertain aspects in network security domain and their analysis by an intelligent agent is an important research domain in the current world of implementing AI in network security. When an intelligent agent is referred to, the picture that immediately comes to minds is a design that can sense the environment and take legitimate decisions by itself based upon the knowledge gathered from its environment. Hence the ability of reasoning among the agents is an important factor which governs this ability to act. There are a lots of knowledge representation schemes which are used in domain specific situations. One such situation is representing knowledge in uncertain domains. Traditional probabilistic languages lack the expressive power to handle relational domains where as classical first-order logic is sufficiently expressive, but again lacks a coherent uncertainty reasoning capability. So, an effort was made to combine both the expressiveness of first order logic as well as plausible reasoning capability of Bayesian networks in a reasoning scheme called Multi Entity Bayesian Networks (MEBN) logic. The proposal in this paper tries to detect and prevent a type of bandwidth depletion attacks (which falls in the category of DOS attacks) by filtering out the features of the network traffic relevant to these attacks and providing them as input to a MEBN model, which finally decides the fate of the traffic i.e. either it is to be allowed to enter the network or flagged as a probable threat in future and dropped.

Keywords: Probabilistic reasoning DDoS Uncertain MEBN UnBBayes.