Computer Science ›› 2014, Vol. 41 ›› Issue (4): 126-133.

Previous Articles     Next Articles

Multilevel Real-time Payload-based Intrusion Detection System Framework

LIU Jie-fang,ZHAO Bin and ZHOU Ning   

  • Online:2018-11-14 Published:2018-11-14

Abstract: Intrusion detection systems use a lot of features sets to identify intrusions,so they need to deal with the huge network traffic.However,most of the existing systems lack real-time anomaly detection capability.This paper presented multilevel real-time payload-based intrusion detection system.It first uses n-gram to analyse network packet payload and build feature model for data preparation,and then uses 3-Level Iterative Feature Selection Engine for feature subset selection.Principal component analysis in 3LIFSEng is used for data preprocessing,and combining the cumulative energy,parallel analysis and gravel test,the principal component selection is made.Mahalanobis distance map is used to discover the hidden dependencies between packets and between features.Mahalanobis distance criteria is used to distinguish normal or attack data packets.DARPA 99and GATECH datasets verify the system’s validity.Web application traffic verifies its mode.F-value assesses its detection performance. Experimental results show that compared with the present mainstream two intrusion detection system, the system improves the detection accuracy and reduces the false positive rate and the computational complexity.Additionally,it has 1.3time higher throughput in comparison with real scenario of medium sized enterprise network.

Key words: Intrusion detection,Data pre-processing,N-gram,Principal component analysis,Mahalanobis distance map,Iterative feature selection

[1] 黄金钟,朱淼良.基于程序的异常检测研究综述[J].计算机科学,2011,8(6):6-13
[2] Patcha A,Park J M.An overview of anomaly detection tech-niques:existing solutions and latest technological trends[J].Computer Networks,2007,1(12):3448-3470
[3] 边婧,彭新光,闰建红.入侵检测大数据集代价敏感重平衡分类策略[J].小型微型计算机系统,2012,3(11):2526-2530
[4] Lazarevic A,Kumar V,Srivastava J.Intrusion detection:a survey[M]∥Managing Cyber Threats.Springer,2005:19-78
[5] Early J,Brodley C.Behavioral features for network anomaly detection[M]∥Machine Learning and Data Mining for Computer Security.Springer,2006:107-124
[6] Mahoney M,Chan P K.PHAD:packet header anomaly detection for identifying hostile network traffic[DB/OL].http://cs.fit.edu/~ mmahoney/paper3.pdf,2013-06-17
[7] 魏小涛,黄厚宽,田盛丰.在线自适应网络异常检测系统模型与算法[J].计算机研究与发展,2010,7(3):485-492
[8] Kotsiantis S,Kanellopoulos D,Pintelas P.Data preprocessing for supervised leaning[J].International Journal of Computer Science,2006(1):111-117
[9] Garca-Teodoro P,Daz-Verdejo J,Macia-Fernandez G,et al.Anomaly-based network intrusion detection:techniques,systems and challenges[J].Computers&Security,2009,8(1/2):18-28
[10] 宁卓,龚俭,顾文杰.高速网络中入侵检测的抽样方法[J].通信学报,2009,0(11):27-36
[11] Damashek M.Gauging similarity with N-grams:language independent categorization of text[J].Science,1995,267:843-848
[12] Davis J J,Clark A J.Data preprocessing for anomaly based network intrusion detection:a review[J].Computers&Security,2011,0(6/7):353-375
[13] Lippmann R,Haines J W,Fried D J,et al.The 1999DARPA off-line intrusion detection evaluation[J].Computer Networks,2000,34(4):579-595
[14] Ingham K,Inoue H.Comparing anomaly detection techniquesfor HTTP[M]∥Recent Advances in Intrusion Detection.Sprin-ger,2007:42-62
[15] Wang K,Stolfo S.Anomalous payload-based network intrusion detection[M]∥Recent Advances in Intrusion Detection.Sprin-ger,2004:203-222
[16] Perdisci R,Ariu D,Fogla P,et al.McPAD:a multiple classifier system for accurate payload-based anomaly detection[J].Computer Networks,2009,3(6):864-881
[17] 孙卫,宋连涛,庄卫华.基于有效载荷的异常入侵检测技术研究[J].计算机工程与设计,2009,0(23):5348-535
[18] Jamdagni A,Tan Z,Nanda P,et al.Intrusion detection using geometrical structure[C]∥Proceedings of the Fourth InternationalConference on Frontier of Computer Science and Technology.2009:327-333
[19] Bolzoni D,Etalle S,Hartel P.POSEIDON:a 2-tier anomaly-based network intrusion detection system[C]∥Proceedings of the Fourth IEEE International Workshop on Information Assurance.2006:156-165
[20] Wang K,Parekh J J,Stolfo S J.Anagram:a content anomaly detector resistant to mimicry attack[C]∥Proceedings of the 9th International Conference on Recent Advances in Intrusion Detection.2006:226-248
[21] Rieck K,Laskov P.Language models for detection of unknown attacks in network traffic[J].Journal in Computer Virology,2007,2(4):243-256
[22] Chu Y M.Deep packet inspection in network intrusion detection and prevention systems[D].Institute of Communications Engineering,National Tsing Hua University,2010
[23] Porter T.The Perils of Deep Packet Inspection[DB/OL].http://www.securityfocus.com,2005-1-11
[24] Yu F.High speed deep packet inspection with hardware support[D].Berkeley:EECS Department,University of California,2006
[25] Jolliffe I.Principal Component Analysis[DB/OL].http://on-linelibrary.wiley.com,2013-6-17
[26] Bouzida Y,Cuppens F,Cuppens-Boulahia N,et al.Efficient intrusion detection using principal component analysis[C]∥Proceedings of the 3me Conference sur la Scurit et Architectures Rseaux (SAR).2004
[27] Bouzida Y,Gombault S.Eigenconnections to Intrusion Detection[M]∥Security and Protection in Information Processing Systems.Springer,2004:241-258
[28] Wang W,Guan X,Zhang X.Processing of massive audit datastreams for real-time anomaly intrusion detection[J].Computer Communications,2008,1(1):58-72
[29] Nwanze N,Sun-il K,Summerville D H.Payload modeling for network intrusion detection systems[C]∥Proceedings of the Military Communications Conference.2009:1-7
[30] Liao Y,Vemuri V R.Using text categorization techniques for intrusion detection[C]∥Proceedings of the 11th USENIX Security Symposium.2002:51-59
[31] Nelson L R.Some observations on the scree test,and on coefficient alpha[J].Thai Journal of Educational Research and Mea-surement,2005,3(1):1-17
[32] Cattell R B.The scree test for the number of factors[J].Multivariate Behavioral Research,1966,1(2):245-276
[33] Jamdagni A,Tan Z,Nanda P,et al.Intrusion detection using GSAD model for HTTP traffic on web services[C]∥Procee-dings of the 6th International Wireless Communications and Mobile Computing Conference.2010:1193-1197
[34] Tan Z,Jamdagni A,He X,et al.Network Intrusion Detectionbased on LDA for Payload Feature Selection[C]∥Proceedings of the GLOBECOM Workshops (GC Wkshps).2010:1545-1549
[35] Chapell L.Wireshark Network Analysis:The Official Wireshark Certified Network Analyst Study Guide[M].California:Laura Chappell University,2010

No related articles found!
Viewed
Full text


Abstract

Cited

  Shared   
  Discussed   
No Suggested Reading articles found!