Enhancing Network Intrusion Detection with Integrated Sampling and Filtering

Abstract

The structure of many standalone network intrusion detection systems (NIDSs) centers around a chain of analysis that begins with packets captured by a packet filter, where the filter describes the protocols (TCP/UDP port numbers) and sometimes hosts or subnets to include or exclude from the analysis. In this work we argue for augmenting such analysis with an additional, separately filtered stream of packets. This "Secondary Path" supplements the "Main Path" by integrating sampling and richer forms of filtering into a NIDS's analysis. We discuss an implementation of a secondary path for the Bro intrusion detection system and enhancements we developed to the Berkeley Packet Filter to work in concert with the secondary path. Such an additional packet stream provides benefits in terms of both efficiency and ease of expression, which we illustrate by applying it to three forms of NIDS analysis: tracking very large individual connections, finding "heavy hitter" traffic streams, and implementing backdoor detectors (developed in previous work) with particular ease.

Highly compressed multi-pattern string matching on the cell broadband engine

“…RELATED WORK Snort [9] and Bro [8], [3], [5], [10], [2] are two of the more popular public domain Network Intrusion Detection Systems (NIDSs). The current implementation of Snort uses the optimized version of the AC automaton [1].…”

Making Network Intrusion Detection Work With IPsec

“…However, decryption times are typically small and only a small portion of the packet will be decrypted using Two-Key IPsec. Further, there is ongoing research [6,7,15,16] to improve the performance of NIDSs and deal with growing traffic rates.…”

Critical infrastructure protection: Resource efficient sampling to improve detection of less frequent patterns in network traffic

“…The authors then use this technique to create a behavioral pattern, which can be used to block potential ''exploit traffic'' (Xu et al, 2005a, b) by constructing appropriate Access Control Lists for routers. Gonzalez and Paxson (2006), also inspired by AutoFocus, proposed packet level random sampling to detect heavy-hitters in network traffic. It has been observed (Duffield et al, 2001;Feldmann et al, 2001) that a small number of heavy flows account for a large amount of traffic.…”