A close look on n -grams in intrusion detection

Abstract

Detection methods based on n-gram models have been widely studied for the identification of attacks and malicious software. These methods usually build on one of two learning schemes: anomaly detection, where a model of normality is constructed from n-grams, or classification, where a discrimination between benign and malicious n-grams is learned. Although successful in many security domains, previous work falls short of explaining why a particular scheme is used and more importantly what renders one favorable over the other for a given type of data. In this paper we provide a close look on n-gram models for intrusion detection. We specifically study anomaly detection and classification using n-grams and develop criteria for data being used in one or the other scheme. Furthermore, we apply these criteria in the scope of web intrusion detection and empirically validate their effectiveness with different learning-based detection methods for client-side and service-side attacks.

Caracterização e Classificação do Tráfego da Darknet com Modelos Baseados em Árvores de Decisão

“…Por meio dessa comparac ¸ão, os modelos utilizados, embora simples, possibilitaram resultados próximos à 100% de acurácia geral, ao contrário dos modelos de Deep Learning encontrados no estado da arte. Dessa forma, a base de dados disponibilizada por [Gurdip Kaur 2020] é a escolhida para alcanc ¸ar os objetivos propostos, expandindoa com novas características, inserindo informac ¸ão dos enderec ¸os IP de origem e destino, dividindo-os em n-grams [Wressnegger et al 2013], e manipulando os registros originais. Essas alterac ¸ões e comparac ¸ões possibilitam a evoluc ¸ão tanto da base quanto do tema em destaque.…”

Recurring verification of interaction authenticity within bluetooth networks

“…To model network traffic in IP-based networks, past systems have successfully used n-grams (e.g., PAYL [55], PCkAD [4]). To describe data in terms of n-grams, we adopt the definition presented by Wressnegger et al [56] and summarize it below. Each data object x first needs to be represented as a string of symbols from an alphabet, A, where A is often defined as bytes or tokens.…”

A hybrid feature-selection approach for finding the digital evidence of webapplication attacks

“…Therefore, this finding was in line with those of [30,31,33], However, if there is a lot of attack syntax, this could decrease the performance of the detection. Moreover, Wressnegger et al [34] set up a series of experiments by utilizing high-order n-grams of bytes with a combination of learning schemes. Their methods perform well in the detection of web attacks with a successive identification of 81.5% attacks and 0.01% false alarms.…”