Measuring Inconsistency in a Network Intrusion Detection Rule Set Based on Snort

Abstract

In this preliminary study, we investigate how inconsistency in a network intrusion detection rule set can be measured. To achieve this, we first examine the structure of these rules which are based on Snort and incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correlations among rules more explicit. We measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the *This is a revised and significantly extended version of [1]. Vol. 5, No. 3 (2011) 281À322°c World Scientific Publishing Company DOI: 10.1142/S1793351X11001274 281 informativeness of these measures. Finally, we propose a new measure of inconsistency for prioritized knowledge which incorporates the normalized number of atoms in a language involved in inconsistency to provide a deeper inspection of inconsistent formulae. We conclude that such measures are useful for the network intrusion domain assuming that introducing expert knowledge for correlation of rules is feasible. International Journal of Semantic Computing

Computational approaches to finding and measuring inconsistency in arbitrary knowledge bases

“…For example, IDS rules in [MLMM11] and requirements specications in [MJLL05] are always dened in terms of arbitrary formulae. Applying these practical algorithms for computing MUSes to such real-world applications is a useful path for research, but since they require knowledge bases in clausal form, the algorithms cannot be directly applied.…”

“…Inconsistency has been studied extensively in a range of applications. For example, in network security, a logic-based analysis of inconsistency in an Intrusion Detection System (IDS) was carried out in [MLMM11]. In this case the industry standard IDS [Roe99], which was the focus of this work, had a false alarm rate of between 69% [TPFC08b] and 96% [TPFC08a] and it was suggested that this was, at least in part, the result of inconsistency in the rule set.…”

“…Therefore we can say that some formulae have a greater share in the inconsistency of the knowledge base than others. Incorporating additional information, such as stratication of formulae, has also proved benecial when measuring formulalevel inconsistency [MLJ12,MLMM11].…”

“…This syntax-sensitivity is also necessary for a wide range of applications including the previously mentioned work on network security systems [MLMM11] and requirements specications [MJLL05]. Also, it has been said that minimal inconsistent subsets represent the purest form of formula-centric inconsistency [Rei87,HK10,MLJ12], so it is intuitive to dene formula-level measures using this approach.…”

HTTP Traffic Classification Based on Hierarchical Signature Structure

“…For accuracy reason, the packet payload must be examined. Snort [4], an open source intrusion detection system, analyses payload signature. 70% of the whole processing time dedicates to the signature pat- tern matching.…”