An auto-learning approach for network intrusion detection

In this paper, we propose a novel intrusion detection technique with a fully automatic attack signatures generation capability. The proposed approach exploits a honeypot traffic data analysis to build an attack scenarios database, used to detect potential intrusions. Furthermore, for an effective and efficient intrusion detection mechanism, we introduce several new or adapted algorithms for signature generation, signature comparison, etc. Finally, we use DARPA’99 and UNSW-NB15 traffic to evaluate the proposed approach. The results indicate that the generated attack signatures are of high quality with low rates of false negatives and false positives.     

基于数据挖掘和蜜罐的新型入侵检测系统研究

文中对基于数据挖掘和蜜罐技术的新型入侵检测系统进行了研究。简单介绍了入侵检测系统和蜜罐技术的概念及优缺点,及入侵检测系统和蜜罐系统的互补性。进而提出将其两者相结合的方案,分析其模型,并将数据挖掘技术融入其中,构成新型的入侵检测系统。该系统提高了蜜罐系统对资源的保护及对攻击数据的分析能力,有效的增强了入侵检测系统的防护能力。     

Control theoretic approach to intrusion detection using a distributed hidden Markov model

Cooperative ad hoc wireless networks are more vulnerable to malicious attacks than traditional wired networks. Many of these attacks are silent in nature and cannot be detected by conventional intrusion detection methods such as traffic monitoring, port scanning, or protocol violations. These sophisticated attacks operate under the threshold boundaries during an intrusion attempt and can only be identified by profiling the complete system activity in relation to normal behavior. In this article we discuss a control- theoretic hidden Markov modelstrategy for intrusion detection using distributed observation across multiple nodes. This model comprises a distributed HMM engine that executes in a randomly selected monitor node and functions as a part of the feedback control engine. This drives the defensive response based on hysteresis to reduce the frequency of false positives, thereby avoiding inappropriate ad hoc responses.     

车联网中基于神经网络的入侵检测方案

车联网的入侵检测（IDS）可用于确认交通事件通知中描述的事件的真实性。当前车联网IDS多采用基于冗余数据的一致性检测方案,为降低IDS对冗余数据的依赖性,提出了一个基于神经网络的入侵检测方案。该方案可描述大量交通事件类型,并综合使用了反向传播（BP）和支持向量机（SVM）2种学习算法。这2种算法分别适用于个人安全驾驶速度快与高效交通系统检测率高的应用。仿真实验和性能分析表明,本方案具有较快的入侵检测速度,且具有较高的检测率和较低的虚警率。     

一种基于区间时序逻辑模型检测的入侵检测算法

Model checking based on linear temporal logic reduces the false negative rate of misuse detection. However, linear temporal logic formulae cannot be used to describe concurrent attacks and piecewise attacks. So there is still a high rate of false negatives in detecting these complex attack patterns. To solve this problem, we use interval temporal logic formulae to describe concurrent attacks and piecewise attacks. On this basis, we formalize a novel algorithm for intrusion detection based on model checking interval temporal logic. Compared with the method based on model checking linear temporal logic, the new algorithm can find unknown succinct attacks. The simulation results show that the new method can effectively reduce the false negative rate of concurrent attacks and piecewise attacks.     

Divided two-part adaptive intrusion detection system

The main objective of this paper is to design a more complete intrusion detection system solution. The paper presents an efficient approach for reducing the rate of alerts using divided two-part adaptive intrusion detection system (DTPAIDS). The proposed DTPAIDS has a high degree of autonomy in tracking suspicious activity and detecting positive intrusions. The proposed DTPAIDS is designed with the aim of reducing the rate of detected false positive intrusion through two achievements. The first achievement is done by implementing adaptive self-learning neural network in the proposed DTPAIDS to gives it the ability to be automatic adaptively system based on Radial Basis Functions (RBF) neural network. The second achievement is done through dividing the proposed intrusion detection system IDS into two parts. The first part is IDS₁, which is installed in the front of firewall and responsible for checking each entry user’s packet and deciding if the packet considered is an attack or not. The second is IDS₂, which is installed behind the firewall and responsible for detecting only the attacks which passed the firewall. This proposed approach for IDS exhibits a lower false alarm rate when detects novel attacks. The simulation tests are conducted using DARPA 1998 dataset. The experimental results show that the proposed DTPAIDS [1] reduce false positive rate, [2] detects intrusion occurrence sensitively and precisely, [3] accurately self–adapts diagnoser model, thus improving its detection accuracy.     

自定义蜜罐在抵御蠕虫攻击中的应用研究

全文分析了蠕虫病毒的危害和特征,提出一种自定义蜜罐系统的设计:结合入侵检测、虚拟蜜罐和数据挖掘技术,把自定义蜜罐置于DMZ中,利用欺骗地址空间技术捕获已知蠕虫,延缓未知蠕虫的扫描速度,并对相关日志进行数据挖掘,更新入侵检测系统的规则集,以便在遭受后续攻击时做出响应。探讨了自定义蜜罐系统在抵御蠕虫病毒攻击中的可行性和应用实现。     

无线局域网中辅助NIDS的蜜罐的实现

无线网络入侵监测系统(NIDS)还不能应对流量过载和新型攻击的问题,这制约着它的发展.蜜罐使用不同的实现方法可以达到不同的目的.文中主要研究无线局域网中如何利用蜜罐来辅助NIDS设计的问题.文中概述了无线NIDS中存在的安全问题,分析了802.11b中无线NIDS和蜜罐结合的可能性,提出了无线局域网中利用hot zone来辅助NIDS的方案.通过在校园网里部署这一系统,得到了针对客户机和AP的攻击信息,最后人工对整个系统进行测试,证明了这一设计的正确性.     

基于数据挖掘和特征选择的入侵检测模型

提出了一种基于SVM特征选择和C4.5数据挖掘算法的高效入侵检测模型.通过使用该模型对经过特征提取后的攻击数据的训练学习,可以有效地识别各种入侵,并提高检测速度.在经典的KDD 1999入侵检测数据集上的测试说明：该数据挖掘模型能够高效地对攻击模式进行训练学习,能够采用选择的特征正确有效地检测网络攻击.     

基于数据挖掘技术的入侵检测系统

设计一个基于教据挖掘技术的入侵检测系统模型.该模型针对现有入侵检测系统在处理大量数据时,挖掘速度慢.自适应能力差的缺点.引入数据挖掘技术使其能从大量数据中发现入侵特征和模式.介绍其核心模块工作流程.实验结果表明该模型不仅能有效提高系统的检测速度,降低误报率,同时还能有效检测新的入侵行为.     

ID-based proxy re-signature without pairing

Several new attacks have been identified in CRNs such as primary user emulation, dynamic spectrum access (DSA), and jamming attacks. Such types of attacks can severely impact network performance, specially in terms of the over all achieved network throughput. In response to that, intrusion detection system (IDS) based on anomaly and signature detection is recognized as an effective candidate solution to handle and mitigate these types of attacks. In this paper, we present an intrusion detection system for CRNs (CR-IDS) using the anomaly-based detection (ABD) approach. The proposed ABD algorithm provides the ability to effectively detect the different types of CRNs security attacks. CR-IDS contains different cooperative components to accomplish its desired functionalities which are monitoring, feature generation and selection, rule generation, rule based system, detection module, action module, impact analysis and learning module. Our simulation results show that CR-IDS can detect DSA attacks with high detection rate and very low false negative and false positive probabilities.     

基于蜜罐技术的计算机动态取证系统研究

提出了一种基于蜜罐的计算机动态取证方法.该方法通过蜜罐技术将入侵转移到一个虚拟的环境,不仅可以保护网络或主机不受攻击,而且还可以为证据的提取争取到更长的时间,从而获得更为真实的电子证据.实验结果表明:基于蜜罐的动态取证系统具有检测率高、误报率低、取证能力强的特性.     

A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection

Extensive research activities have been observed on network-based intrusion detection systems (IDSs). However, there are always some attacks that penetrate trafficprofiling- based network IDSs. These attacks often cause very serious damages such as modifying host critical files. A host-based anomaly IDS is an effective complement to the network IDS in addressing this issue. This article proposes a simple data preprocessing approach to speed up a hidden Markov model (HMM) training for system-call-based anomaly intrusion detection. Experiments based on a public database demonstrate that this data preprocessing approach can reduce training time by up to 50 percent with unnoticeable intrusion detection performance degradation, compared to a conventional batch HMM training scheme. More than 58 percent data reduction has been observed compared to our prior incremental HMM training scheme. Although this maximum gain incurs more degradation of false alarm rate performance, the resulting performance is still reasonable.     

基于频繁模式挖掘的报警关联与分析算法

提出了一个入侵检测与响应协作模型,结合入侵容忍的思想扩展了入侵检测消息交换格式IDMEF,增加了怀疑度属性.除了发现的入侵事件外,一些可疑的事件也会报告给协作部件.提出了一个基于修改的CLOSET频繁闭模式挖掘算法的报警关联与分析算法,在分布式入侵检测与响应协作系统中,帮助协作部件对收到的IDMEF格式的报警消息进行关联和分析,以便做出合适的响应.为此,修改了CLOSET算法来按照最小支持度和最小怀疑度来得到频繁闭模式.实验结果表明,应用该算法可以很好地缩减报警数量,同时对于所有可疑的和入侵事件,都可以做出适宜的响应.     

入侵检测系统中的新型协同信号机制

提出了一种入侵检测系统中的新型协同信号机制,该机制根据入侵检测的定义以及自然免疫系统的T协助淋巴细胞的工作机理,利用三种检测代理提供的说明系统完整性、保密性、可用性是否受到危及的信号作为入侵检测系统的协同信号以降低系统的虚警率。*     

An intrusion detection system based on combining probability predictions of a tree of classifiers

Intrusion detection system (IDS) represents an unavoidable tool to secure our network. It is considered as a second defense line against the different form of attacks. The principal limits of the current IDSs are their inability to combine the detection of the new form of attacks with high detection rate and low false alarm rate. In this paper, we propose an intrusion detection system based on the combination of the probability predictions of a tree of classifiers. Specifically, our model is composed of 2 layers. The first one is a tree of classifiers. The second layer is a classifier that combines the probability predictions of the tree. The built tree contains 4 levels where each node of this tree represents a classifier. The first node classifies the connections in 2 clusters: Denial of Service attacks and Cluster 2. Then, the second node classifies the connections of the Cluster 2 in Probing attacks and Cluster 3. The third node classifies the connections of the Cluster 3 in Remote‐to‐Local attacks and Cluster 4. Finally, the last node classifies the connections of the Cluster 4 in User‐to‐Root attacks and Normal connections. The second layer contains the last classifier that combines the probability predictions of the first layer and take the final decision. The experiments on KDD'99 and NSL‐KDD show that our model gives a low false alarm rate and the highest detection rate. Furthermore, our model is more precise than the recent intrusion detection system models with accuracy equal to 96.27% for KDD'99 and 89.75% for NSL‐KDD.     

Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions

Dependence on the Internet is increasing dramatically. Therefore, many researchers have given great attention to the issue of how to tighten Internet security. This study proposes a new scheme for the distributed intrusion prevention system (DIPS), in which the concept of ‘union’ is presented for satisfying the increasing requirements of Internet security issues. In this proposed design, the network intrusion detection system (NIDS) applies a misuse detection technique to detect well‐known intrusion behavior on the Internet. Meanwhile, for anomaly detection technique, a tool named ‘Scent’ (a network traffic sniffer) is combined with conditional legitimate probability to reveal previously undiscovered intrusion packets that do not match the intrusion signatures in NIDS. Moreover, blocking distributed denial‐of‐service (DDoS) attacks inside the protected allied network is also covered. To increase the detection accuracy, reduction of false positives and false negatives is also accomplished. Experimental results reveal that the suggested network security system scheme is effective and efficient in resolving the intrusion activity problem of real network environments. Copyright © 2011 John Wiley & Sons, Ltd.     

Hybrid Fuzzy Adaptive Wiener Filtering with Optimization for Intrusion Detection

Intrusion detection plays a key role in detecting attacks over networks, and due to the increasing usage of Internet services, several security threats arise. Though an intrusion detection system (IDS) detects attacks efficiently, it also generates a large number of false alerts, which makes it difficult for a system administrator to identify attacks. This paper proposes automatic fuzzy rule generation combined with a Wiener filter to identify attacks. Further, to optimize the results, simplified swarm optimization is used. After training a large dataset, various fuzzy rules are generated automatically for testing, and a Wiener filter is used to filter out attacks that act as noisy data, which improves the accuracy of the detection. By combining automatic fuzzy rule generation with a Wiener filter, an IDS can handle intrusion detection more efficiently. Experimental results, which are based on collected live network data, are discussed and show that the proposed method provides a competitively high detection rate and a reduced false alarm rate in comparison with other existing machine learning techniques.     

入侵诱骗模型的建立与应用

网络攻击和入侵事件不断发生 ,给人们造成了巨大的损失 ,网络安全问题越来越来成为社会关注的热点。HoneyPot系统就是入侵诱骗技术中的一种 ,在网络安全中起着主动防御的作用。本文在分析了它的实现方式技术基础上 ,形式化的定义了入侵诱骗系统 ,提出了入侵诱骗的体系结构 ,并给出了一个入侵诱骗系统的实现模型。     

A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks.