isDSL - A Domain Specific Language for Intrusion Signature Declaration

Abstract

This paper presents a signature-based network intrusion detection system. The intrusions are detected using their signatures defined as a set of rules contained in DSL scripts. A domain specific language is created, called isDSL, of which the syntax aligns with the TCP/ IP stack and the encoding of GA chromosomes. Genetic algorithm is the technique used for searching malicious states on network traffics. The attack is defined as a combination of properties and values that could be across the packets, matches with the conditions defined in a particular rule described in DSL scripts. The presented approach is promising for several reasons. A domain specific language is a declarative approach for describing intrusion signatures that could spread across network packets. Additionally, the rules are expressive that could tune out false positives. Moreover, the use of genetic algorithm would reduce the number of packet combinations being investigated for signs of the intrusions.