Artificially Augmented Training for Anomaly-based Network Intrusion Detection Systems

Abstract

Attacks on web servers are becoming increasingly prevalent; the resulting social and economic impact of successful attacks is also exacerbated by our dependency on web-based applications. There are many existing attack detection and prevention schemes, which must be carefully configured to ensure their efficacy. In this paper, we present a study challenges that arise in training network payload anomaly detection schemes that utilize collected network traffic for tuning and configuration. The advantage of anomaly-based intrusion detection is in its potential for detecting zero day attacks. These types of schemes, however, require extensive training to properly model the normal characteristics of the system being protected. Usually, training is done through the use of real data collected by monitoring the activity of the system. In practice, network operators or administrators may run into cases where they have limited availability of such data. This issue can arise due to the system being newly deployed (or heavily modified) or due to the content or behavior that leads to normal characterization having been changed. We show that artificially generated packet payloads can be used to effectively augment the training and tuning. We evaluate the method using real network traffic collected at a server site; We illustrate the problem at first (use of highly variable and unsuitable training data resulting in high false positives of 3.6∼10%), then show improvements using the augmented training method (false positives as low as 0.2%). We also measure the impact on network performance, and present a lookup based optimization that can be used to improve latency and throughput.

Method for Cyberincidents Network-Centric Monitoring in Critical Information Infrastructure

“…1): in ITS happens a certain event of information security E 1 ... E n (according to [2] in meaning of event of information security, we understand identified system behavior , service or network, that points to a possible breach of information security, policy, control facilities failure or previously unknown situation that may be relevant to information security) caused by cyberattacks CA 1 ... CA n [11] as well as unintentional actions that coming on the sensors S 1 ... S n (sensors of network-centric monitoring system of cyberincidents can be sources of information such as intrusion detection/prevention systems IDS / IPS [23,24] Network-centric monitoring is determined by that for each management system of cyberincidents forms a network of agents (sensors). The overall management system of cyberincidents region or state can be displayed as a complex network of interconnected centers (teams) campus type, each of which is able to: have a clearly defined goal of the functioning; act in accordance with its rules and algorithms; manage a database containing the requested information; use the results of monitoring, responding to them by their actions; take their own initiative; send and receive messages from other systems and join with them in interaction.…”

“…ITS is an environment in which can occur cyberincidents, typical structure of ITS according to [11,21,22] given in Table 8. (23). Cyberincident that having a greater impact, gets a lower score (1, 2), less influentialbigger (3,4) [23,24].…”

“…(23). Cyberincident that having a greater impact, gets a lower score (1, 2), less influentialbigger (3,4) [23,24]. …”

Incorporating a Honeyfarm With MLFFNN Ids for Improving Intrusion Detection

“…Currently there are no publicly available datasets based on real network traffic due to privacy concerns from their owners. There is no standard method for collecting real traffic for training and testing a MLFFNN IDS [7]. Reference [8] found that a dataset composed of simulated and real traffic is needed.…”

Stochastic RA-Network for the Nodes Functioning Analysis in the Distributed Computer Systems

“…The number of events, arriving from this component is significantly exceeds the similar parameter in comparison to the other components. At the same time, the mechanisms for the sustainable supporting of the DCS functioning should quickly respond to these situations [7][8][9][10][11][15][16][17]. Thus, there is the need to develop and use the specific networking mechanisms that will work correctly with the differential intensities of the arriving events related to the DCS components functions [18].…”