An Ontology for SNORT Rule

Khurat, Assadarat; Sawangphol, Wudhichart

doi:10.1109/jcsse.2019.8864190

Cited by 3 publications

(11 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the present Snort versions allow the spanning of rules in multiple lines but require the addition of backslash (\) at the end of each line; generally, Snort rules are composed of dual logical portions. For instance, the rule header and the rule options ( Khurat & Sawangphol, 2019 ). Usually, Snort rules share all sections of the rule option like the general options, payload detection options, non-payload detection options, and post-detection options.…”

Section: Essential Conceptsmentioning

confidence: 99%

“…However, it can be specified differently depending on the configuration approach. Finally, Snort rules are generally applied to the headers of the application, transport, and network layers such as FTP, HTTP, ICMP, IP, UDP, and TCP ( Chanthakoummane et al, 2016 ; Khurat & Sawangphol, 2019 ). However, they can also be applied to the packet payload, which is the adopted approach for SARG.…”

Section: Essential Conceptsmentioning

confidence: 99%

“…Table 1 presents a classical representation of Snort rules ( Khurat & Sawangphol, 2019 ). The two rules shown in Table 1 denote that an alert will be triggered based on an icmp traffic protocol from any source IP address and port number to any destination IP address and port number if the traffic content contains a probe .…”

Section: Essential Conceptsmentioning

confidence: 99%

“…The default Snort actions are: alert , log , and pass , and it is a required field for every Snort rule, and it defaults to alert if not specified explicitly. Nevertheless, drop , reject, and sdrop are additional options for an inline mode ( Chanthakoummane et al, 2016 ; Khurat & Sawangphol, 2019 ).…”

Section: Essential Conceptsmentioning

confidence: 99%

“…Likewise, a source port field allows a port number or range of port numbers, and the destination IP and port fields are almost the same as the source IP and port fields. Finally, the direction of the monitored traffic is specified using the directional operators (->, and <-), and the monitoring of source to destination (->) is the most common practice ( Khurat & Sawangphol, 2019 ).…”

Section: Essential Conceptsmentioning

confidence: 99%

See 4 more Smart Citations

A novel hybrid-based approach of snort automatic rule generator and security event correlation (SARG-SEC)

Jaw

Wang

2022

PeerJ Computer Science

View full text Add to dashboard Cite

The rapid advanced technological development alongside the Internet with its cutting-edge applications has positively impacted human society in many aspects. Nevertheless, it equally comes with the escalating privacy and critical cybersecurity concerns that can lead to catastrophic consequences, such as overwhelming the current network security frameworks. Consequently, both the industry and academia have been tirelessly harnessing various approaches to design, implement and deploy intrusion detection systems (IDSs) with event correlation frameworks to help mitigate some of these contemporary challenges. There are two common types of IDS: signature and anomaly-based IDS. Signature-based IDS, specifically, Snort works on the concepts of rules. However, the conventional way of creating Snort rules can be very costly and error-prone. Also, the massively generated alerts from heterogeneous anomaly-based IDSs is a significant research challenge yet to be addressed. Therefore, this paper proposed a novel Snort Automatic Rule Generator (SARG) that exploits the network packet contents to automatically generate efficient and reliable Snort rules with less human intervention. Furthermore, we evaluated the effectiveness and reliability of the generated Snort rules, which produced promising results. In addition, this paper proposed a novel Security Event Correlator (SEC) that effectively accepts raw events (alerts) without prior knowledge and produces a much more manageable set of alerts for easy analysis and interpretation. As a result, alleviating the massive false alarm rate (FAR) challenges of existing IDSs. Lastly, we have performed a series of experiments to test the proposed systems. It is evident from the experimental results that SARG-SEC has demonstrated impressive performance and could significantly mitigate the existing challenges of dealing with the vast generated alerts and the labor-intensive creation of Snort rules.

show abstract

Section: Essential Conceptsmentioning

confidence: 99%

Section: Essential Conceptsmentioning

confidence: 99%

Section: Essential Conceptsmentioning

confidence: 99%

Section: Essential Conceptsmentioning

confidence: 99%

Section: Essential Conceptsmentioning

confidence: 99%

See 3 more Smart Citations