Service-independent payload analysis to improve intrusion detection in network traffic

Authors:
Iñigo Perona;Ibai Gurrutxaga;Olatz Arbelaitz;José I. Martín;Javier Muguerza;Jesús Ma Pérez
Affiliations:
University of the Basque Country, Donostia, Spain;University of the Basque Country, Donostia, Spain;University of the Basque Country, Donostia, Spain;University of the Basque Country, Donostia, Spain;University of the Basque Country, Donostia, Spain;University of the Basque Country, Donostia, Spain
Venue:
AusDM '08 Proceedings of the 7th Australasian Data Mining Conference - Volume 87
Year:
2008

Citing 7
Cited 0

Algorithms on strings, trees, and sequences: computer science and computational biology

Algorithms on strings, trees, and sequences: computer science and computational biology
Bro: a system for detecting network intruders in real-time

Computer Networks: The International Journal of Computer and Telecommunications Networking
Service specific anomaly detection for network intrusion detection

Proceedings of the 2002 ACM symposium on Applied computing
A data mining framework for constructing features and models for intrusion detection systems (computer security, network security)

A data mining framework for constructing features and models for intrusion detection systems (computer security, network security)
Unsupervised anomaly detection in network intrusion detection using clusters

ACSC '05 Proceedings of the Twenty-eighth Australasian conference on Computer Science - Volume 38
Compiling network traffic into rules using soft computing methods for the detection of flooding attacks

Applied Soft Computing
The similarity metric

IEEE Transactions on Information Theory

Quantified Score

Hi-index	0.00

Visualization

Abstract

The popularity of computer networks broadens the scope for network attackers and increases the damage these attacks can cause. In this context, Intrusion Detection Systems (IDS) are included as part of any complete security package. This work focuses on nIDSs which work by scanning the network traffic. A service-independent payload processing approach is presented to increase detection rates in non-flood attacks. Three different techniques for payload processing are proposed and they are shown to be able to efficiently detect some of the attack types. Moreover, the proper integration of the knowledge of the different techniques, payload-based and packet header-based, always improves the results. This work leads us to conclude that payload analysis can be used in a general manner, with no service- or port-specific modelling, to detect attacks in network traffic.