On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks

Abstract

Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to significantly reduce the false alarm rate for a target operational environment. We tested our approach using Snort’s ruleset in our real-life trace, increasing the precision from 0.015 to 1 in less than 16 h of work.

An Intuitionistic Fuzzy-Rough Set-Based Classification for Anomaly Detection

“…Taha et al [8] reviewed the different anomaly detection methods for categorical data. Diaz Verdejo et al [5] proposed an efficient alternative approach, named signature-recognition-based detection, in the context of web attacks. Mazarbhuiya et al [13] introduced a neighborhood rough-set-based classification approach to detect the anomaly in a mixed attribute dataset.…”

“…Anomaly-based IDS is the name given to the ensuing system [3,4]. However, a signature-recognition-based intrusion detection technique [5] uses a database of known attack signatures and raises an alarm whenever network traffic matches any signature. Usually, a computer and associated network can easily use an anomaly-based IDS as a risk mitigation technique.…”

Finsformer: A Novel Approach to Detecting Financial Attacks Using Transformer and Cluster-Attention

“…Diaz-Verdejo Jesus et al conducted experimental studies on the detection rates of three standard pre-configurations of SIDS in the context of URI web attacks and proposed an effective method to reduce false positives by disabling complete rule sets of signatures. However, WAF is only a subset of the detection capabilities of SIDS, and it is unclear whether their model results hold true in different types of attacks [4]. Saez-de-Camara Xabier et al found that traditional IT security mechanisms, such as signature-based intrusion detection and defense systems, are difficult to integrate [5].…”

Tools for Analyzing Signature-Based Hardware Solutions for Cyber Security Systems

“…In contrast to traditional fields of application of information systems, attacks on critical infrastructure facilities, which include energy companies, can lead to catastrophic consequences. Therefore, methods of detecting malicious activity, based on the use of signatures that ensure mathematically strict recognition, do not lose their relevance in the creation of cybersecurity systems, such as network intrusion detection systems (NIDS), antiviruses, anti-worm systems and spam filters [1,2].…”