ROOK: Multi-session Based Network Security Event Detector

Authors:
Masayoshi Mizutani;Shin Shirahata;Masaki Minami;Jun Murai
Affiliations:
-;-;-;-
Venue:
SAINT '08 Proceedings of the 2008 International Symposium on Applications and the Internet
Year:
2008

Citing 0
Cited 1

Behavior rule based intrusion detection

Proceedings of the 5th international student workshop on Emerging networking experiments and technologies

Quantified Score

Hi-index	0.00

Visualization

Abstract

We have implemented Multi-Session based Network Security Event Detector: ROOK to detect botnet activity and P2P file sharing traffic and our results show that our method is less false positives than existing network security event detectors (e.g. IDS). We proposed a network security event detection method by analyzing correlation among multiple sessions. Our method can recognize hosts behaviors by rules that describe multi-session correlations: a rule includes the order of starting sessions and information exchange between sessions. By this method, ROOK detected DNS and IRC activities of bots in the experiment.