Learning stateful models for network honeypots

Krueger, Tammo; Gascón, Hugo; Krämer, Nicole; Rieck, Konrad

doi:10.1145/2381896.2381904

Cited by 56 publications

(60 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Krueger et al [14] went beyond the approach of Sekar et al, using n-grams and Markov chains to model protocols such as SIP, DNS and FTP. They demonstrated the effectiveness of the detection mechanisms on text protocols, but they did not test them against binary protocols.…”

Section: Related Workmentioning

confidence: 99%

Modeling Message Sequences for Intrusion Detection in Industrial Control Systems

Caselli

Zambon

Petit

et al. 2015

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Compared with standard information technology systems, industrial control systems show more consistent and regular communications patterns. This characteristic contributes to the stability of controlled processes in critical infrastructures such as power plants, electric grids and water treatment facilities. However, Stuxnet has demonstrated that skilled attackers can strike critical infrastructures by leveraging knowledge about these processes. Sequence attacks subvert infrastructure operations by sending misplaced industrial control system messages. This chapter discusses four main sequence attack scenarios against industrial control systems. Real Modbus, Manufacturing Message Specification and IEC 60870-5-104 traffic samples were used to test sequencing and modeling techniques for describing industrial control system communications. The models were then evaluated to verify the feasibility of identifying sequence attacks. The results create the foundation for developing "sequence-aware" intrusion detection systems.Keywords: Industrial control systems, sequence attacks, intrusion detection IntroductionCritical infrastructure assets such as power plants, electric grids and water treatment facilities have used control systems for many decades; however, until the turn of the century, they were primarily standalone systems. The Internet and network convergence have brought about many changes to critical infrastructure assets, the most important being their transformation from standalone systems to highly interconnected systems. This transformation has introduced advantages and disadvantages. On one hand, it facilitates the remote monitoring and management of industrial processes. On the other hand, traditional information technology attacks can be launched from afar, includ-50 CRITICAL INFRASTRUCTURE PROTECTION IX ing over the Internet, to compromise industrial control systems and the critical infrastructure assets they manage. This is the case of denial-of-service and distributed denial-of-service attacks. These attacks can target a specific device in an industrial control network and flood it with a massive number of packets until it is no longer able to operate normally. This can reduce or eliminate operator situational awareness and eventually impact the coordination and control of infrastructure assets, potentially affecting the larger infrastructure and connected infrastructures, leading to serious consequences to industry, government and society.Another example involves semantic attacks. Unlike standard cyber attacks, semantic attacks exploit knowledge of specific control systems and physical processes to maximize damage. Stuxnet [4,16] is probably the most wellknown attack of this type. Meanwhile, numerous reports from the U.S. ICS-CERT have described exploits on industrial devices, such as programmable logic controllers and SCADA servers, that are triggered by carefully-crafted messages (see, e.g., [9]). Sequence attacks are a type of semantic attack. Instead of using modified message headers or pa...

show abstract

Section: Related Workmentioning

confidence: 99%

Modeling Message Sequences for Intrusion Detection in Industrial Control Systems

Caselli

Zambon

Petit

et al. 2015

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

show abstract

“…Although there has been a substantial amount of research in the area, most of the emphasis has been placed on either stages prior to the alignment [3], [40] or on challenges such as the inference of state machines (once packet types have been identified) [9], [10], [23], [24], [42]. The underlying algorithm that is used to align packets to identify their structure tends to be the same for most techniques -the Needleman-Wunsch algorithm [31].…”

Section: Introductionmentioning

confidence: 99%

Using Segment-Based Alignment to Extract Packet Structures from Network Traces

Esoul

Walkinshaw

2017

2017 IEEE International Conference on Software Quality, Reliability and Security (QRS)

View full text Add to dashboard Cite

Abstract-Many applications in security, from understanding unfamiliar protocols to fuzz-testing and guarding against potential attacks, rely on analysing network protocols. In many situations we cannot rely on access to a specification or even an implementation of the protocol, and must instead rely on raw network data "sniffed" from the network. When this is the case, one of the key challenges is to discern from the raw data the underlying packet structures -a task that is commonly carried out by using alignment algorithms to identify commonalities (e.g. field delimiters) between packets. For this, most approaches have used variants of the Needleman Wunsch algorthm to perform byte-wise alignment. However, they can suffer when messages are heterogeneous, or in cases where protocol fields are separated by long variable fields. In this paper, we present an alternative alignment algorithm known as segment-based alignment. We show how this technique can produce accurate results on traces from several common protocols, and how the results tend to be more intuitive than those produced by state-of-the-art techniques.

show abstract

“…We show that it is particularly relevant, but not limited, to automatabased algorithms. This class of algorithm has been successfully applied in traffic analysis and malware detection [10], [11], [12] and is used as the basis to apply our clustering technique on IP flow records.…”

Section: Introductionmentioning

confidence: 99%

Behavioral clustering of non-stationary IP flow record data

Christian

Marchal

State

et al. 2016

2016 12th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

Abstract-Automated network traffic analysis using machine learning techniques plays an important role in managing networks and IT infrastructure. A key challenge to the correct and effective application of machine learning is dealing with non-stationary learning data sources and concept drift. Traffic evolves overtime due to new technology, software, services being used, changes in user behavior but also due to changes in network graphs like dynamic IP address assignment. In this paper, we present an automatic online method to detect changepoints in network traffic based on IP flow record analysis. This technique is used to segment an observed behavior into smaller consecutive behaviors differing one from another. The segmented traffic is used to learn small communication profile characterizing accurately the activities present between two observed changepoints. We validate our method using synthetic data and outline a real-world application to botnet hosts behavior modeling.

show abstract

Learning stateful models for network honeypots

Cited by 56 publications

References 27 publications

Modeling Message Sequences for Intrusion Detection in Industrial Control Systems

Modeling Message Sequences for Intrusion Detection in Industrial Control Systems

Using Segment-Based Alignment to Extract Packet Structures from Network Traces

Behavioral clustering of non-stationary IP flow record data

Contact Info

Product

Resources

About