Enhancing Intrusion Detection System with proximity information

Abstract

Abstract:The wide spread of worms poses serious challenges to today's Internet. Various IDSes (Intrusion Detection Systems) have been proposed to identify or prevent such spread. These IDSes can be largely classified as signature-based or anomaly-based ones depending on what type of knowledge the system knows. Signature-based IDSes are unable to detect the outbreak of new and unidentified worms when the worms' characteristic patterns are unknown. In addition, new worms are often sufficiently intelligent to hide their activities and evade anomaly detection. Moreover, modern worms tend to spread more quickly, and the outbreak period lasts in the order of hours or even minutes. Such characteristics render existing detection mechanisms less effective.In this work, we consider the drawbacks of current detection approaches and propose PAIDS, a proximity-assisted IDS approach for identifying the outbreak of unknown worms. PAIDS does not rely on signatures. Instead, it takes advantage of the proximity information of compromised hosts. PAIDS operates on an orthogonal dimension with existing IDS approaches and can thus work collaboratively with existing IDSes to achieve better performance. We test the effectiveness of PAIDS with trace-driven simulations and observe that PAIDS has a high detection rate and a low false positive rate. We also build a proof-of-concept prototype using Google Maps APIs and libpcap library.

Wireless telemedicine and m-health: technologies, applications and research issues

“…IPI can be measured from sensors implanted in the body parts or externally without much variation. There are many other related security aspects (Abbes et al, 2010;Chen et al, 2010;Schrader et al, 2010;Zhuang et al, 2010;Kundur et al, 2011;Kalogridis et al, 2011;Li et al, 2011;Ramsey et al, 2011;Xiao, 2011;Zhang and Gunter, 2011).…”

A survey of cyber crimes

“…There are many related research studies in the following topics: various attacks and vulnerabilities , key management , traceback , elliptic curve cryptosystem intrusion detection , radio frequency identification security , security in wireless networks , trust , authentication , security in peer‐to‐peer networks , and other security issues .…”

Accountability using flow‐net: design, implementation, and performance evaluation

“…Our other related work includes temporal accountability , accountability for wireless networks , logging , accountability in smart grids , and quantitative study of accountability . There are also many related work in network security .…”