Performance improvement of deep packet inspection for Intrusion Detection

Parvat, Thaksen J.; Chandra, P.

doi:10.1109/gcwcn.2014.7030883

Cited by 9 publications

(5 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Peneltian yang dilakukan oleh [8] medeteksi jenis traffic dengan menggunakan DPI pada jaringan nirkabel. Selain itu DPI juga dapat digunakan mendeteksi paket jenis data yang masuk dan keluar [9]…”

Section: Trafik Internetunclassified

Network Forensik Untuk Menganalisa Trafik Data Game Online

Tasmi¹,

Antony²,

Ubaidillah³

2022

Klik

View full text Add to dashboard Cite

Network forensics adalah salah satu cara dalam menganalisi jenis trafik dalam sebuah jaringan adalah dengan menggunakan file log dengan merecord aktifitas pada jaringan. File log disetiap sistem sering dipakai untuk media melihat aktifitas pada sebuah sistem, terkhusus pada sebuah router dan server file ini sangat diperlukan proses investigasi analisis forensik jaringan dengan menggunakan metode Generic Network Forensics Process Model yang merupakan ilmu digital forensik yang berkaitan dengan tahap-tahap untuk menemukan sumber serangan dan mendapatkan bukti-bukti serangan yang bersumber dari file log. Tujuan dari penelitian ini dapat menerapkan model network forensic dalam memonitoring trafik games-online dan dapat menghasil satu sistem yang dapat menentukan prioritas memberian bandwidth, dan juga dapat dijadikan sebagai salah satu dasar pengambilan keputusan dalam membagian bandwidth. Hasil penelitian yang telah dilakukan telah mampu menganalisi jenis trafik game online dengan menggunakn tool wireshark untuk sniffing packet data serta membaguan sebuah sistem autentikasi untuk memvalidasin user pengguna jaringan. Pada tahap awal penelitian ini hasil investigasi forensik jaringan. Berdasarkan hasil pengujian tersebut dapat dinyatakan hasil sudah sesuai dengan tujuan yang diharapkan, sehingga dapat disimpulkan penelitian ini berhasil berjalan dengan baik

show abstract

Section: Trafik Internetunclassified

Network Forensik Untuk Menganalisa Trafik Data Game Online

Tasmi¹,

Antony²,

Ubaidillah³

2022

Klik

View full text Add to dashboard Cite

show abstract

“…For example, Gu et al [23] implemented BotHunter, which is a DPI-based passive network monitoring system that models typical malware behavior and interprets communications exhibiting strong associations with such behavior as evidence of malware contamination. Other studies have discussed efforts to improve the performance of DPI-based detection [24,25]. However, in a recent cybersecurity report [26], Cisco Systems noted that more than 50% of current Internet communications are encrypted and that approximately 70% of all malware programs encrypt their communications.…”

Section: Related Workmentioning

confidence: 99%

A Word-Level Analytical Approach for Identifying Malicious Domain Names Caused by Dictionary-Based DGA Malware

et al. 2021

View full text Add to dashboard Cite

Computer networks are facing serious threats from the emergence of malware with sophisticated DGAs (Domain Generation Algorithms). This type of DGA malware dynamically generates domain names by concatenating words from dictionaries for evading detection. In this paper, we propose an approach for identifying the callback communications of such dictionary-based DGA malware by analyzing their domain names at the word level. This approach is based on the following observations: These malware families use their own dictionaries and algorithms to generate domain names, and accordingly, the word usages of malware-generated domains are distinctly different from those of human-generated domains. Our evaluation indicates that the proposed approach is capable of achieving accuracy, recall, and precision as high as 0.9989, 0.9977, and 0.9869, respectively, when used with labeled datasets. We also clarify the functional differences between our approach and other published methods via qualitative comparisons. Taken together, these results suggest that malware-infected machines can be identified and removed from networks using DNS queries for detected malicious domain names as triggers. Our approach contributes to dramatically improving network security by providing a technique to address various types of malware encroachment.

show abstract

“…The paper [61] suggests a new model to improve the performance of intrusion detection systems by using in/out-based attributes of records. It takes comparatively less time and has better accuracy than the existing classifiers.…”

Section: Related Research On Network Traffic Analysis and Anomaly Detmentioning

confidence: 99%

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Song

Beshley

Przystupa

et al. 2020

Sensors

View full text Add to dashboard Cite

In this paper, to solve the problem of detecting network anomalies, a method of forming a set of informative features formalizing the normal and anomalous behavior of the system on the basis of evaluating the Hurst (H) parameter of the network traffic has been proposed. Criteria to detect and prevent various types of network anomalies using the Three Sigma Rule and Hurst parameter have been defined. A rescaled range (RS) method to evaluate the Hurst parameter has been chosen. The practical value of the proposed method is conditioned by a set of the following factors: low time spent on calculations, short time required for monitoring, the possibility of self-training, as well as the possibility of observing a wide range of traffic types. For new DPI (Deep Packet Inspection) system implementation, algorithms for analyzing and captured traffic with protocol detection and determining statistical load parameters have been developed. In addition, algorithms that are responsible for flow regulation to ensure the QoS (Quality of Services) based on the conducted static analysis of flows and the proposed method of detection of anomalies using the parameter Hurst have been developed. We compared the proposed software DPI system with the existing SolarWinds Deep Packet Inspection for the possibility of network traffic anomaly detection and prevention. The created software components of the proposed DPI system increase the efficiency of using standard intrusion detection and prevention systems by identifying and taking into account new non-standard factors and dependencies. The use of the developed system in the IoT communication infrastructure will increase the level of information security and significantly reduce the risks of its loss.

show abstract

Performance improvement of deep packet inspection for Intrusion Detection

Cited by 9 publications

References 11 publications

Network Forensik Untuk Menganalisa Trafik Data Game Online

Network Forensik Untuk Menganalisa Trafik Data Game Online

A Word-Level Analytical Approach for Identifying Malicious Domain Names Caused by Dictionary-Based DGA Malware

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Contact Info

Product

Resources

About