Exploiting N-Gram Location for Intrusion Detection

Abstract

Signature-based and protocol-based intrusion detection systems (IDS) are employed as means to reveal content-based network attacks. Such systems have proven to be effective in identifying known intrusion attempts and exploits but they fail to recognize new types of attacks or carefully crafted variants of well known ones. This paper presents the design and the development of an anomaly-based IDS technique which is able to detect content-based attacks carried out over application level protocols, like HTTP and FTP. In order to identify anomalous packets, the payload is split up in chunks of equal length and the n-gram technique is used to learn which byte sequences usually appear in each chunk. The devised technique builds a different model for each pair protocol of interest, packet length and uses them to classify the incoming traffic. Models are build by means of a semi-supervised approach. Experimental results witness that the technique achieves an excellent accuracy with a very low false positive rate.

Recurring verification of interaction authenticity within bluetooth networks

“…Specifically, we considered three granularities: device type, device type and make, and specific device instance. 4 We also conducted experiments to examine various special cases where verification is less successful. For example, VIA's verification performs worse in cases where nearly identical devices (i.e., devices of the same type, make, and model) exist in both the target and other classes.…”

“…Wireless traffic analysis systems and Intrusion Detection Systems have a long and rich history [2,4,6,11,12,16,23,25,26,29,33,35,39,48,55,58]. Generally speaking, wireless traffic analysis systems and Intrusion Detection Systems (IDS) continually monitor computers or networks, collecting data (e.g., system calls, network communication), extracting quantifiable features from this data, and applying a variety of techniques to analyze the data in search of signs of anomalies or compromise.…”

“…To model network traffic in IP-based networks, past systems have successfully used n-grams (e.g., PAYL [55], PCkAD [4]). To describe data in terms of n-grams, we adopt the definition presented by Wressnegger et al [56] and summarize it below.…”

“…Attempts to improve upon simple 1-gram models have shown only slight improvements. For instance, past work has shown that slightly higher detection rates, and slightly lower false-positive rates can be achieved [4], but these improvements come at the expense of increased computational complexity, or the use of additional preprocessing that imposes domain knowledge. Furthermore, Angiulli et al suggest that there is an inherent trade-off: greater values of n lead to higher false-positive rates, whereas 1-gram models have been shown to have lower detection rates (but not by much).…”

Prevention and Fighting against Web Attacks through Anomaly Detection Technology. A Systematic Review

“…The results obtained are 100% True Positive Rate (TPR) and 0.087% False Positive rate (FPR). Angiulli, Argento and Furfaro [82] identify anomalous packets in the DARPA dataset, by dividing the payload into segments of equal length, using n-grams to learn the byte sequences that usually appear in each chunk. Using a semi-supervised approach, a model is built that associates the protocol-packet length pair.…”