Intrusion detection based on model checking timed interval temporal logic

Zhu, Weiping; Zhou, Qinglei; Li, Ping

doi:10.1109/icitis.2010.5689549

Cited by 8 publications

(21 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Compared with linear temporal logic, RASL has been additionally equipped with interval semantics. So, a phase, that is, a sequence of atomic actions, in an attack can be described with an interval in a RASL formula, while various steps in the phase can be described with various points in the interval [2]. Temporal relationship between steps in an attack can be described with temporal operators.…”

Section: Construct Signatures With Rasl Formulasmentioning

confidence: 99%

“…However, these papers do not mention how to detect these attacks automatically. The method presented in [2] can do it automatically, but it can only find concurrent attacks rather than real-time attacks.…”

Section: Detect Various Attack Types Using Model Checking Interval Tementioning

confidence: 99%

“…First, affected by intruders' subjective wishes or other random factors, the logical relationship among its atomic actions associated with attacks of the same pattern launched by different intruders may present different features [1,2], where an atomic action means a minimum operation step in an attack. It is hard to depict precisely so vastly different attacks with a relatively small-scale attack pattern library.…”

Section: Introductionmentioning

confidence: 99%

“…As the first attempt to address these issues, a method based on ITL model checking was presented in [2], and it can describe and detect concurrent attacks, since ITL has more power than LTL. However, ITL-model-checkingbased methods still cannot describe and detect real-time attacks.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Novel Algorithm for Intrusion Detection Based on RASL Model Checking

Zhu

Zhou

Yang

et al. 2013

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

The interval temporal logic (ITL) model checking (MC) technique enhances the power of intrusion detection systems (IDSs) to detect concurrent attacks due to the strong expressive power of ITL. However, an ITL formula suffers from difficulty in the description of the time constraints between different actions in the same attack. To address this problem, we formalize a novel real-time interval temporal logic-real-time attack signature logic (RASL). Based on such a new logic, we put forward a RASL model checking algorithm. Furthermore, we use RASL formulas to describe attack signatures and employ discrete timed automata to create an audit log. As a result, RASL model checking algorithm can be used to automatically verify whether the automata satisfy the formulas, that is, whether the audit log coincides with the attack signatures. The simulation experiments show that the new approach effectively enhances the detection power of the MC-based intrusion detection methods for a number of telnet attacks, p-trace attacks, and the other sixteen types of attacks. And these experiments indicate that the new algorithm can find several types of real-time attacks, whereas the existing MC-based intrusion detection approaches cannot do that.

show abstract

Section: Construct Signatures With Rasl Formulasmentioning

confidence: 99%

Section: Detect Various Attack Types Using Model Checking Interval Tementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Novel Algorithm for Intrusion Detection Based on RASL Model Checking

Zhu

Zhou

Yang

et al. 2013

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…Time and attribute-relative features were utilized to lead the mining process, and strict attribute schemes were used to prune sequential rules. Weijun Zhu et al, in [27], applied Interval temporal logic (ITL) model which reduces the false negative rate of misuse detection for concurrent attacks. Milanesi, G. et al [28], proposed a novel system for indoor video surveillance.…”

Section: Related Workmentioning

confidence: 99%

Mining DoS attack sequences on Network Traffic using Fuzzy Time Interval

Reshamwala¹,

Mahajan²

2013

IJCA

View full text Add to dashboard Cite

Intrusion of network which couldn't be analyzed, detected and prevented may make whole network system paralyze while the abnormal detection can prevent it by detecting the known and unknown character of data. Many intrusions aren't composed by single events, but by a series of attack steps in chronological order. Analyzing the order in which events occur can improve the attack detection accuracy and reduce false alarms. Intrusion is a multi step process in which a number of events must occur sequentially in order to launch a successful attack. Although conventional sequential patterns can reveal the order of attack events, the time between events can also be determined but it causes the sharp boundary problem. That is, when a time interval is near the boundary of two predetermined time ranges, one either ignore or overemphasize it. Therefore, this paper uses the concept of fuzzy sets so that Dos attack sequential patterns are discovered on network traffic in fuzzy time interval. In this paper, an apriori based candidate generation algorithm has been implemented with Fuzzy time intervals to detect Dos attack sequences. The experimental results are also compared with the dataset which is generated by the SPMF sequential dataset generator.

show abstract

Benchmark Tests for the Model-Checking-Based IDS Algorithms

et al. 2019

Self Cite

View full text Add to dashboard Cite

A fundamental concern for the security community is to identify the comprehensive comparable performance of various intrusion detection algorithms which are based on the Model Checking (MC) techniques. To address this open issue, we conduct the benchmark tests for the model-checking-based intrusion detection systems algorithms. At first, linear temporal logic, interval temporal logic and real-time attack signature logic are employed respectively to establish formula models for twenty-four types of attacks selected from KDDCUP, i.e., the annual data mining and knowledge discovery competition organized by association for computing machinery. And then, a standard intrusion set, called intrusion set for intrusion detection based on model checking, which is a behavior version of a subset of KDDCUP, is constructed. On the basis of it, detection abilities and efficiency of the intrusion detection algorithms based on model checking the three logics mentioned above are compared exhaustively. The experimental results illustrate the efficiency and abilities of these three algorithms. It is beneficial for selecting the suitable MC-based algorithms in actual deployment of intrusion detection systems. INDEX TERMS Benchmark test, intrusion detection systems, model checking, network security, temporal logic.

show abstract

Intrusion detection based on model checking timed interval temporal logic

Cited by 8 publications

References 4 publications

A Novel Algorithm for Intrusion Detection Based on RASL Model Checking

A Novel Algorithm for Intrusion Detection Based on RASL Model Checking

Mining DoS attack sequences on Network Traffic using Fuzzy Time Interval

Benchmark Tests for the Model-Checking-Based IDS Algorithms

Contact Info

Product

Resources

About