Experimenting with an Intrusion Detection System for Encrypted Networks

Authors:
Vik Tor Goh;Jacob Zimmermann;Mark Looi
Affiliations:
Faculty of Science and Technology, Information Security Institute, Queensland University of Technology, GPO Box 2434, Brisbane QLD 4001, Australia.;Information Security Institute, Queensland University of Technology, MS-714, Level 7, 126 Margaret St, Brisbane QLD 4001, Australia.;Faculty of Science and Technology, Information Security Institute, Queensland University of Technology, GPO Box 2434, Brisbane QLD 4001, Australia
Venue:
International Journal of Business Intelligence and Data Mining
Year:
2010

Citing 7
Cited 2

How to share a secret

Communications of the ACM
Analyzing Internet Security Protocols

HASE '01 The 6th IEEE International Symposium on High-Assurance Systems Engineering: Special Topic: Impact of Networking
ProtoMon: Embedded Monitors for Cryptographic Protocol Intrusion Detection and Prevention

ITCC '04 Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC'04) Volume 2 - Volume 2
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
Intrusion Detection for Encrypted Web Accesses

AINAW '07 Proceedings of the 21st International Conference on Advanced Information Networking and Applications Workshops - Volume 01
A fast worm scan detection tool for VPN congestion avoidance

DIMVA'06 Proceedings of the Third international conference on Detection of Intrusions and Malware & Vulnerability Assessment
DEMEM: distributed evidence-driven message exchange intrusion detection model for MANET

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection

Translating shared state based ebXML BPSS models to WS-BPEL

International Journal of Business Intelligence and Data Mining
Security system for encrypted environments (S2E2)

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

Network-based Intrusion Detection Systems (NIDSs) analyse network traffic to detect instances of malicious activity. Typically, this is only possible when the network traffic is accessible for analysis. With the growing use of Virtual Private Networks (VPNs) that encrypt network traffic, the NIDS can no longer access this crucial audit data. In this paper, we present an implementation and evaluation of our approach proposed in Goh et al. (2009). It is based on Shamir's secret-sharing scheme and allows a NIDS to function normally in a VPN without any modifications and without compromising the confidentiality afforded by the VPN.