McPAD: A multiple classifier system for accurate payload-based anomaly detection

  • Authors:

  • Roberto Perdisci;Davide Ariu;Prahlad Fogla;Giorgio Giacinto;Wenke Lee

  • Affiliations:

  • Damballa, Inc., 817 West Peachtree St. NW, Suite A-110, Atlanta, 30308 GA, USA and College of Computing, Georgia Institute of Technology, Atlanta, 30308 GA, USA;Department of Electrical and Electronic Engineering, University of Cagliari, Piazza D'Armi, 09123 Cagliari, Italy;Google, Inc., Mountain View, CA 94043, USA;Department of Electrical and Electronic Engineering, University of Cagliari, Piazza D'Armi, 09123 Cagliari, Italy;College of Computing, Georgia Institute of Technology, Atlanta, 30308 GA, USA

  • Venue:
  • Computer Networks: The International Journal of Computer and Telecommunications Networking
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Anomaly-based network intrusion detection systems (IDS) are valuable tools for the defense-in-depth of computer networks. Unsupervised or unlabeled learning approaches for network anomaly detection have been recently proposed. Such anomaly-based network IDS are able to detect (unknown) zero-day attacks, although much care has to be dedicated to controlling the amount of false positives generated by the detection system. As a matter of fact, it is has been shown that the false positive rate is the true limiting factor for the performance of IDS, and that in order to substantially increase the Bayesian detection rate, P(Intrusion|Alarm), the IDS must have a very low false positive rate (e.g., as low as 10^-^5 or even lower). In this paper we present McPAD (multiple classifier payload-based anomaly detector), a new accurate payload-based anomaly detection system that consists of an ensemble of one-class classifiers. We show that our anomaly detector is very accurate in detecting network attacks that bear some form of shell-code in the malicious payload. This holds true even in the case of polymorphic attacks and for very low false positive rates. Furthermore, we experiment with advanced polymorphic blending attacks and we show that in some cases even in the presence of such sophisticated attacks and for a low false positive rate our IDS still has a relatively high detection rate.