NETWORK INTRUSION DETECTION
CONTENTS APPROACHES IN ANOMALY BASED NETWORK INTRUSION DETECTION SYSTEMS 1 1 INTRODUCTION 1 2 ANOMALY BASED INTRUSION DETECTION SYSTEMS 2 2 1 PAYLOAD BASED VS HEADER BASED APPROACHES 4 3 SETTING UP AN ABS 6 3 1 BUILDING THE MODEL 7 3 2 SETTING THE THRESHOLD 8 4 PAYL AND POSEIDON 8 4 1 PAYL 8 4 2 POSEIDON 9 5 CONCLUSIONS 12 6 APPENDIX 13 6 1 PAYL ALGORITHM 13 6 2 SOM ALGORITHM 14 REFERENCES 15 FORMAL SPECI CATION FOR FAST AUTOMATIC PRO LING OF PROGRAM BEHAVIOR 17 1 INTRODUCTION 17 2 RELATED WORKS 19 3 METHODOLOGY 21 4 CASE STUDY 22 4 1 POP3 COMMANDS 22 4 2 THE FSM STEP 1 23 4 3 VSP SPECI CATION FOR IPOP3D STEP 2 24 4 4 COMPILING VSP STEP 3 27 4 5 VISITING THE FSM1 STEP 4 28 4 6 EXECUTING TRACES STEP 5 28 5 USING THE METHODOLOGY TO CON GURE REMUS 29 5 1 RESULTS 30 6 CONCLUDING REMARKS 31 7 APPENDIX 32 7 1 THE CRITICAL SYSTEM CALLS 32 7 2 POSTGRES VSP SPECI CATION 32 REFERENCES 32 LEARNING BEHAVIOR PRO LES FROM NOISY SEQUENCES 39 1 INTRODUCTION 39 2 LEARNING BY ABSTRACTION 41 3 REGULAR EXPRESSIONS 42 4 STRING ALIGNMENT AND FLEXIBLE MATCHING 43 5 THE LEARNING ALGORITHM 45 5 1 S OPERATOR 46 5 2 I OPERATOR 47 5 3 BASIC LEARNING CYCLE 48 5 4 RE NEMENT CYCLE 50 6 EVALUATION ON ARTI CIAL TRACES 51 6 1 MOTIF RECONSTRUCTION IN PRESENCE OF NOISE 52 6 2 ASSESSING THE IN UENCE OF ALPHABET SIZE AND MOTIF LENGTH 53 6 3 DISCOVERING GRAPH STRUCTURED PATTERNS 57 7 USER PRO LING 59 7 1 KEY PHRASE TYPING MODEL 59 7 2 TEXT TYPING MODEL 60 8 CONCLUSION 62 REFERENCES 62 CORRELATION ANALYSIS OF INTRUSION ALERTS 65 1 INTRODUCTION 66 2 APPROACHES BASED ON SIMILARITY BETWEEN ALERT ATTRIBUTES 67 2 1 PROBABILISTIC ALERT CORRELATION 68 2 2 STATISTICAL ANOMALY ANALYSIS TO DETECT STEALTHY PORTSCANS 69 2 3 ROOT CAUSE ANALYSIS 70 2 4 STATISTICAL CAUSALITY ANALYSIS BASED APPROACH 71 2 5 ALERT CLUSTERING AND MERGING IN MIRADOR PROJECT 72 3 APPROACHES BASED ON PREDE NED ATTACK SCENARIOS 74 3 1 AGGREGATION AND CORRELATION IN IBM TIVOLI SYSTEMS 74 3 2 CHRONICLES BASED APPROACH 75 4 APPROACHES BASED ON PREREQUISITES AND CONSEQUENCES OF ATTACKS 76 4 1 PRE CONDITION POST CONDITION BASED APPROACH IN MIRADOR PROJECT 77 4 2 A PREREQUISITE AND CONSEQUENCE BASED APPROACH 78 4 3 ATTACK HYPOTHESIZING AND REASONING TECHNIQUES 79 5 APPROACHES BASED ON MULTIPLE INFORMATION SOURCES 82 5 1 MISSION IMPACT BASED APPROACH 83 5 2 A DATA MODEL M2D2 FOR ALERT CORRELATION 84 5 3 TRIGGERING EVENTS AND COMMON RESOURCES BASED APPROACH 85 6 PRIVACY ISSUES IN ALERT CORRELATION 86 6 1 AN APPROACH ON ALERT SHARING AND CORRELATION 87 6 2 GENERALIZATION AND PERTURBATION BASED APPROACHES 88 7 SUMMARY 90 REFERENCES 90 AN APPROACH TO PREVENTING CORRELATING AND PREDICTING MULTI STEP NETWORK ATTACKS 93 1 INTRODUCTION 93 2 RELATED WORK 95 3 PRELIMINARIES 97 3 1 ATTACK GRAPH 97 3 2 INTRUSION ALERT AND CORRELATION 99 4 HARDENING NETWORK TO PREVENT MULTI STEP INTRUSIONS 100 4 1 A MOTIVATING EXAMPLE 100 4 2 A GRAPH BASED ALGORITHM FOR HARDENING A NETWORK 102 4 3 MINIMUM COST SOLUTIONS 106 5 CORRELATING AND PREDICTING MULTI STEP ATTACKS 108 5 1 MOTIVATION 108 5 2 QUEUE GRAPH BASED ALERT CORRELATION 109 5 3 HYPOTHESIZING MISSING ALERTS AND PREDICTING FUTURE ALERTS 114 5 4 COMPRESSING RESULT GRAPHS 117 5 5 EMPIRICAL RESULTS 119 5 6 EFFECTIVENESS 120 5 7 PERFORMANCE 122 6 CONCLUSION 124 REFERENCES 126 RESPONSE BRIDGING THE LINK BETWEEN INTRUSION DETECTION ALERTS AND SECURITY POLICIES 129 1 INTRODUCTION 129 2 PROBLEM STATEMENT 130 2 1 DOMAIN TERMINOLOGY 130 2 2 INTRUSION PREVENTION AND RESPONSE 132 2 3 COMPREHENSIVE APPROACH TO RESPONSE 133 3 SECURITY POLICY FORMALISM 133 3 1 CHOICE OF A SECURITY POLICY FORMALISM 133 3 2 THE OR BAC FORMALISM 134 3 3 OR BAC CONTEXTS 136 3 4 PRESENTATION OF A USE CASE 137 3 5 MODELLING OF THE USE CASE 139 4 APPLYING OR BAC FOR THREAT RESPONSE 144 4 1 EXAMPLES OF THREAT CONTEXTS 144 4 2 ATOMIC CONTEXTS 148 4 3 COMPOSED CONTEXTS 149 4 4 CONTEXT ACTIVATION 151 4 5 CONTEXT DEACTIVATION 154 4 6 IN UENCE OF MAPPING ON THE RESPONSE STRATEGY 154 5 THE THREAT RESPONSE SYSTEM 155 5 1 SYSTEM ARCHITECTURE 155 5 2 ALERT CORRELATION ENGINE ACE 155 5 3 POLICY INSTANTIATION ENGINE PIE 157 5 4 POLICY DECISION POINT PDP 157 5 5 POLICY ENFORCEMENT POINT PEP 158 6 FROM ALERTS TO NEW POLICIES 158 6 1 SYNTACTIC MAPPING 158 6 2 ENRICHMENT 159 6 3 STRATEGY APPLICATION 160 7 CASE STUDY E MAIL SERVER 160 7 1 THREATS RELATED TO THE USE CASE 161 7 2 THREAT ANALYSIS 163 7 3 REVISED DESCRIPTION OF THE POLICY COMPONENTS 164 7 4 DE NITION OF THE SECURITY POLICY 165 7 5 THE MAPPING PREDICATES 167 8 ISSUES WITH THE APPROACH 167 9 CONCLUSION 168 REFERENCES 169 INTRUSION DETECTION AND REACTION AN INTEGRATED APPROACH TO NETWORK SECURITY 171 1 INTRODUCTION 172 2 RELATED WORK 173 2 1 INTRUSION DETECTION SYSTEMS 173 2 2 TRACEBACK 176 3 THE PROPOSED FRAMEWORK 177 4 AN ARCHITECTURE FOR INTRUSION DETECTION 178 4 1 AN APPROACH TO INTRUSION DETECTION 179 4 2 PERFORMANCE EVALUATION 188 4 3 A DISTRIBUTED INTRUSION DETECTION SYSTEM 191 4 4 PRIVACY ISSUES IN INTRUSION DETECTION 193 5 INTRUSION REACTION A SYSTEM FOR ATTACK SOURCE DETECTION 195 5 1 THE ASSYST ARCHITECTURE 195 5 2 ATTACK SESSIONS 196 5 3 THE ASP PROTOCOL 197 5 4 ASSYST CASE STUDIES 197 5 5 INTRUSION DETECTION SUBSYSTEM 201 5 6 TRAF C CLASSI CATION AND INTRUSION REACTION 202 5 7 ASSYST IMPLEMENTATION DETAILS 203 5 8 ASP PROTOCOL IMPLEMENTATION DETAILS 204 5 9 TESTING THE APPROACH 205 6 CONCLUSIONS AND FUTURE WORK 205 REFERENCES 207