A Database of Anomalous Traffic for Assessing Profile Based IDS

Owezarski, Philippe

doi:10.1007/978-3-642-12365-8_5

Cited by 9 publications

(4 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Closer to our work, Owezarski [19] recently proposed a data set containing real backbone traffic where anomalies are precisely located. In this work the traffic is captured at different points in the RENATER network, which is supposed to be anomaly free, and the researchers generate two kinds of anomalies (i.e.…”

Section: Related Workmentioning

confidence: 93%

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Mazel¹,

Esaki

Fontugne

et al. 2012

Proceedings of the Asian Internet Engineeering Conference on - AINTEC '12

View full text Add to dashboard Cite

Network anomaly detection is a crucial task in traffic monitoring. Tools targeting this particular problematic need to be thoroughly evaluated to assess their efficiency. Such evaluation needs reliable ground truth data to be effective. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labelled anomaly traffic traces. One of the promising strategies to provide reliable ground truth data is to combine the output of the multiple anomaly detectors with different theoretical background. In this paper, we provide an in-depth analysis of the Singular Value Decomposition (SVD) based combination strategy that has been recently applied to anomaly detectors (MAWILab). This analysis highlights the key drawback of the method to efficiently discriminate the anomalous traffic from the harmless one. We then propose several techniques to overcome this drawback and improve the discrimination power of the combination strategy. Our evaluation using four anomaly detectors and four years of real backbone traffic traces (MAWI) emphasizes the accuracy gain of the proposed techniques over the original study.

show abstract

Section: Related Workmentioning

confidence: 93%

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Mazel¹,

Esaki

Fontugne

et al. 2012

Proceedings of the Asian Internet Engineeering Conference on - AINTEC '12

View full text Add to dashboard Cite

show abstract

“…In addition to aging, the computer technology is highly dynamic and changes rapidly. This resulted in KDD dataset to be irrelevant quickly and impractical [23][24] . Moreover, generalization of results obtained from Solarisbased system is not logical since Solaris-based system has limited usage in cyber community compared to Linux [25][26] .…”

Section: Kdd Datasetsmentioning

confidence: 99%

Enhanced Host-Based Intrusion Detection Using System Call Traces

Ikram¹

2019

JKAU Comp IT Sci

View full text Add to dashboard Cite

To detect zero-day attacks in modern systems, several host-based intrusion detection systems are proposed using the newly compiled ADFA-LD dataset. These techniques use the system call traces of the dataset to detect anomalies, but generally they suffer either from high computational cost as in window-based techniques or low detection rate as in frequency-based techniques. To enhance the accuracy and speed, we propose a host-based intrusion detection system based on distinct short sequences extraction from traces of system calls with a novel algorithm to detect anomalies. To the best of our knowledge, the obtained results of the proposed system are superior to all up-to-date published systems in terms of computational cost and learning time. The obtained detection rate is also much higher than almost all compared systems and is very close to the highest result. In particular, the proposed system provides the best combination of high detection rate and very small learning time. The developed prototype achieved 90.48% detection rate, 22.5% false alarm rate, and a learning time of about 30 seconds. This provides high capability to detect zero-day attacks and also makes it flexible to cope with any environmental changes since it can learn quickly and incrementally without the need to rebuild the whole classifier from scratch.

show abstract

“…• A recent attempt to propose a database of labeled traffic for IDSs comparison and evaluation is the work of Owezarski [113]. The database consists of a collection of packet traces from the METROSEC experimental platform [102].…”

Section: Existing Tracesmentioning

confidence: 99%

Flow-based intrusion detection

Sperotto

Pras

2011

12th IFIP/IEEE International Symposium on Integrated Network Management (IM 2011) and Workshops

View full text Add to dashboard Cite

The spread of 1-10Gbps technology has in recent years paved the way to a flourishing landscape of new, high-bandwidth Internet services. As users, we depend on the Internet in our daily life for simple tasks such as checking emails, but also for managing private and financial information. However, entrusting such information to the Internet also means that the network has become an alluring place for hackers. To this threat, the research community has answered with an increased interest in intrusion detection. With the number of attacks almost exponentially increasing, and the attackers' motivations moving from ideological to economical, the researchers' attention is focused on developing new techniques to timely detect intruders and prevent damage. Our studies in the field of intrusion detection, however, made us realize that additional research is needed, in particular: the creation of shared data sets to validate Intrusion Detection Systems (IDSs) and the development of automatic procedures to tune the parameters of IDSs.The contribution of this thesis is that it develops a structured approach to intrusion detection that focuses on (i) shared ground-truth data sets and (ii) automatic parameter tuning. We develop our approach by focusing on network flows. Flows offer an aggregated view of network traffic, by reporting on the amount of packets and bytes exchanged over the network. Therefore, flows drastically reduce the amount of data to be analyzed. In this thesis, we aim at detecting anomalies in flow-based time series, describing how the number of flows, packets and bytes changes over time.Ground truth data sets are fundamental in the development phase, for validation purposes and, if publicly available, for comparison between different IDSs. We attack the problem of ground truth generation in two complementary manners.First, we obtain ground truth information for flow-based intrusion detection by manually creating it. We do so by means of a honeypot-based data collection and monitoring setup, specifically tuned to (i) offer an attracting platform for attackers, and (ii) include enhanced logging capabilities to support the vi labeling of the collected data. The outcome of our research has been a publicly released flow-based labeled data set. To the best of our knowledge, no such data set already exists.Second, we generate ground truth information in an automatic manner. We do this by generating artificial flow, packet and byte time series for benign and attack traffic. In this thesis, we rely upon Hidden Markov Models (HMMs), which allow for probabilistic and compact representations of flow-based time series and can be used for generation purposes.Finally, we approach the problem of automatic tuning of IDSs. The performance of an IDS is governed by the trade-off between detecting all anomalies (at the expense of raising alarms too often), and missing anomalies (but not issuing many false alarms). We developed an optimization procedure that aims to mathematically treat such trade-off in a systematic m...

show abstract

A Database of Anomalous Traffic for Assessing Profile Based IDS

Cited by 9 publications

References 12 publications

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Enhanced Host-Based Intrusion Detection Using System Call Traces

Flow-based intrusion detection

Contact Info

Product

Resources

About