Exploitation of NetEm Utility for Non-payload-based Obfuscation Techniques Improving Network Anomaly Detection

Homoliak, Ivan; Teknős, Martin; Barabas, Maroš; Hanáček, Petr

doi:10.1007/978-3-319-59608-2_48

Cited by 7 publications

(5 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The proposed obfuscation techniques had been instantiated as part of the obfuscation tool designed and implemented in the Unix environment. Parametrized instances of these techniques (introduced in our previous work [18]) are presented in Table 1. The selection of particular obfuscation techniques was primarily motivated by the need for achieving divergent behavior of obfuscated network attacks as well as by capabilities of Unix OS.…”

Section: Methodsmentioning

confidence: 99%

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Homoliak¹,

Teknős²,

Ochoa³

et al. 2019

ICST Transactions on Security and Safety

Self Cite

View full text Add to dashboard Cite

Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network traffic for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform evaluation on five classifiers: Gaussian Naïve Bayes, Gaussian Naïve Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% -73.3%, while the FPR is deteriorated only slightly (0.1% -1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations. intrusion detection suffers from undetected attacks such as zero-day attacks or polymorphism, enabling an exploit-code to avoid positive signature matching of the packet payload data. Therefore, researchers and developers are motivated to design new methods to detect various versions of the modified network attacks including the zero-day ones. These goals motivate the popularity of Anomaly Detection Systems (ADS) and also the classification approaches in the context 1 EAI Endorsed Transactions Preprint

show abstract

Section: Methodsmentioning

confidence: 99%

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Homoliak¹,

Teknős²,

Ochoa³

et al. 2019

ICST Transactions on Security and Safety

Self Cite

View full text Add to dashboard Cite

show abstract

“…Given this, a classification model developed without awareness of mutated connection instances might not perform as well as expected. In accordance with to the report of [50], various techniques have been invented for the purpose of building an obfuscation tool in the Unix setting. Some examples of these operations f (γ a ) are spreading out packets along the time domain via a constant delay, loss of some packet content, duplicated packets, modification of packet order, packet fragmentation through specific MTU (maximum transmission unit), and a mix of these functions.…”

Section: Non-payload-based Obfuscationmentioning

confidence: 99%

Classification of Adversarial Attacks Using Ensemble Clustering Approach

Tatongjai¹,

Boongoen²,

Iam-On³

et al. 2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

As more business transactions and information services have been implemented via communication networks, both personal and organization assets encounter a higher risk of attacks. To safeguard these, a perimeter defence like NIDS (network-based intrusion detection system) can be effective for known intrusions. There has been a great deal of attention within the joint community of security and data science to improve machine-learning based NIDS such that it becomes more accurate for adversarial attacks, where obfuscation techniques are applied to disguise patterns of intrusive traffics. The current research focuses on non-payload connections at the TCP (transmission control protocol) stack level that is applicable to different network applications. In contrary to the wrapper method introduced with the benchmark dataset, three new filter models are proposed to transform the feature space without knowledge of class labels. These ECT (ensemble clustering based transformation) techniques, i.e., ECT-Subspace, ECT-Noise and ECT-Combined, are developed using the concept of ensemble clustering and three different ensemble generation strategies, i.e., random feature subspace, feature noise injection and their combinations. Based on the empirical study with published dataset and four classification algorithms, new models usually outperform that original wrapper and other filter alternatives found in the literature. This is similarly summarized from the first experiment with basic classification of legitimate and direct attacks, and the second that focuses on recognizing obfuscated intrusions. In addition, analysis of algorithmic parameters, i.e., ensemble size and level of noise, is provided as a guideline for a practical use.

show abstract

“…As a result, a classifier trained without knowledge of obfuscated or modified patterns may not perform as well as it does against intrusive connections with original features. According to the study of [29], a set of techniques have been initiated as part of developing an obfuscation tool in the Unix environment. Examples of functions f (γ a ) are listed below.…”

Section: Adversarial Attack and Non-payload-based Obfuscationmentioning

confidence: 99%

Strengthening intrusion detection system for adversarial attacks: improved handling of imbalance classification problem

Pimsarn

Boongoen

Iam-On

et al. 2022

Complex Intell. Syst.

View full text Add to dashboard Cite

Most defence mechanisms such as a network-based intrusion detection system (NIDS) are often sub-optimal for the detection of an unseen malicious pattern. In response, a number of studies attempt to empower a machine-learning-based NIDS to improve the ability to recognize adversarial attacks. Along this line of research, the present work focuses on non-payload connections at the TCP stack level, which is generalized and applicable to different network applications. As a compliment to the recently published investigation that searches for the most informative feature space for classifying obfuscated connections, the problem of class imbalance is examined herein. In particular, a multiple-clustering-based undersampling framework is proposed to determine the set of cluster centroids that best represent the majority class, whose size is reduced to be on par with that of the minority. Initially, a pool of centroids is created using the concept of ensemble clustering that aims to obtain a collection of accurate and diverse clusterings. From that, the final set of representatives is selected from this pool. Three different objective functions are formed for this optimization driven process, thus leading to three variants of FF-Majority, FF-Minority and FF-Overall. Based on the thorough evaluation of a published dataset, four classification models and different settings, these new methods often exhibit better predictive performance than its baseline, the single-clustering undersampling counterpart and state-of-the-art techniques. Parameter analysis and implication for analyzing an extreme case are also provided as a guideline for future applications.

show abstract

Exploitation of NetEm Utility for Non-payload-based Obfuscation Techniques Improving Network Anomaly Detection

Cited by 7 publications

References 1 publication

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Classification of Adversarial Attacks Using Ensemble Clustering Approach

Strengthening intrusion detection system for adversarial attacks: improved handling of imbalance classification problem

Contact Info

Product

Resources

About