An Approach for Unifying Rule Based Deep Packet Inspection

Muñoz, Arantxa; Sezer, Sakir; Burns, D. C.; Douglas, Gareth

doi:10.1109/icc.2011.5963095

Cited by 8 publications

(9 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The rule set itself is of enterprise quality because it is commercially maintained and has numerous commercial users and contributors. However, the major limitation of the Snort rule set is that it is purpose built for the Snort IDS and so can only be used, in their original format, by systems based on the Snort IDS [5]. Also, a general issue with modern IDSs is the continuing increase in network traffic and network speeds as well as the continuous addition of new detection rules.…”

Section: Network Intrusion Detectionmentioning

confidence: 99%

“…The system developed in [5] aims to create a unified DPI rule set integrating, initially, the Snort rule set but later also integrating most other DPI rule sets such as Bro, L7-filter and ClamAV as well. These new generalized rules incorporate regular expression (Regex) pattern matching for DPI since Regex is particularly useful for its high speed performance.…”

Section: Network Intrusion Detectionmentioning

confidence: 99%

“…Rather, given a set of such rules (called Snort2Regex a rules) created using the Snort2Regex translator [5], our task is to deploy formal Artificial Intelligence (AI) approaches for analyzing these rules and to discover any (logical) inconsistencies among them, i.e. to identify rules which may conflict.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Measuring Inconsistency in a Network Intrusion Detection Rule Set Based on Snort

McAreavey

Liu

Miller

et al. 2011

Int. J. Semantic Computing

View full text Add to dashboard Cite

In this preliminary study, we investigate how inconsistency in a network intrusion detection rule set can be measured. To achieve this, we first examine the structure of these rules which are based on Snort and incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correlations among rules more explicit. We measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the *This is a revised and significantly extended version of [1]. Vol. 5, No. 3 (2011) 281À322°c World Scientific Publishing Company DOI: 10.1142/S1793351X11001274 281 informativeness of these measures. Finally, we propose a new measure of inconsistency for prioritized knowledge which incorporates the normalized number of atoms in a language involved in inconsistency to provide a deeper inspection of inconsistent formulae. We conclude that such measures are useful for the network intrusion domain assuming that introducing expert knowledge for correlation of rules is feasible. International Journal of Semantic Computing

show abstract

Section: Network Intrusion Detectionmentioning

confidence: 99%

Section: Network Intrusion Detectionmentioning

confidence: 99%

See 1 more Smart Citation

Measuring Inconsistency in a Network Intrusion Detection Rule Set Based on Snort

McAreavey

Liu

Miller

et al. 2011

Int. J. Semantic Computing

View full text Add to dashboard Cite

show abstract

“…We currently have 8500 rules from [4], which have been translated into Snort2Regex format using the Snort2Regex translator. Regex pattern matching is then executed using highspeed hardware for intrusion detection on raw packet data.…”

Section: Network Intrusion Rulesmentioning

confidence: 99%

“…Rather, we assume that given a set of such rules (called Snort2Regex rules) created using the Snort2Regex translator [4], our task is to deploy formal AI approaches for analyzing these rules and to discover any inconsistencies (the occurrence of conflicting information) among them. Such attempts for inconsistency detection have not been carried out within intrusion detection research.…”

Section: Introductionmentioning

confidence: 99%

Measuring Inconsistency in Network Intrusion Rules

McAreavey

Liu

Miller

2011

2011 22nd International Workshop on Database and Expert Systems Applications

View full text Add to dashboard Cite

Abstract-In this preliminary case study, we investigate how inconsistency in a network intrusion detection rule set can be measured. To achieve this, we first examine the structure of these rules which incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correlations among rules more explicit. Finally, we measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the informativeness of these measures. We conclude that such measures are useful for the network intrusion domain assuming that incorporating domain knowledge for correlation of rules is feasible.

show abstract