Syntax, and semantics‐based signature database for hybrid intrusion detection systems

Abstract

Signature-based intrusion detection systems (IDSs) have the advantages of producing a lower false alarm rate and using less system resources compared to anomaly based systems. However, they are susceptible to obfuscation used by attackers to introduce new variants of the attacks stored in the database. Some of the disadvantages of signaturebased IDSs can be attributed to the fact that they are mostly purely syntactic and ignore the semantics of the monitored systems. In this paper, we present the design and implementation of a signature database that assists a Specificationbased IDS in a converged environment. Our design is novel in terms of considering the semantics of the monitored protocols alongside their syntax. Our protocol semantics awareness is based on the state transition analysis technique which models intrusions at a high level using state transition diagrams. The signature database is hierarchically designed to insure a balance between ease of use and fast retrieval in real time. The database prototype is tested against some implemented attacks and shows promising efficiency.hand is an approach to detect intrusions by first learning the characteristics of normal activity. Then systems are designed to detect anything that deviates from normal activity [2].A third technique that has been overtaking both previous approaches is intrusion detection by static program analysis which was first proposed by Wagner and Dean [3]. This technique performs a static analysis of the program to create an abstract automata model of the functions and system calls. The program's behavioral specifications are used to create the model SIGNATURE DATABASE FOR HYBRID INTRUSION DETECTION SYSTEMS 459 Extended Finite State MachinesA communication protocol can be modeled as an FSM that produces outputs on its state transitions after receiving inputs. However, FSMs are not powerful enough to model variables and operations based on variable values which form an important part of any protocol design. These limitations led to extending FSMs into EFSMs.

OSCIDS: An Ontology based SCADA Intrusion Detection Framework

“…However, the current generation of IDS systems in SCADA networks are often faced with several challenges. First, the majority of the existing systems, especially signaturebased, are purely syntactic and lack a clear description of intrusion behaviours and semantics of the monitored systems (Barry and Chan, 2009). This issue may result in missing the detection of sophisticated attacks (Hadžiosmanović et al, 2014) such as Stuxnet (Langner, 2011) that may exploit legitimate looking commands to cause damage on the system.…”

Using Container Architecture to Detect Intrusion for Multitier Web Application

“…Intrusion detection systems have been widely used to protect multitier web services, such as to detect known attacks by matching misused traffic patterns or signatures [7][8][9][10]. Individually, the web IDS and the database IDS can detect abnormal network traffic sent to either of them.…”

DoubleGuard: Detecting Intrusions in Multitier Web Applications

“…To protect multi-tiered web services, Intrusion detection systems (IDS) have been widely used to detect known attacks by matching misused traffic patterns or signatures [34], [30], [33], [22]. A class of IDS that leverages machine learning can also detect unknown attacks by identifying abnormal network traffic that deviates from the so-called "normal" behavior previously profiled during the IDS training phase.…”