Toward Sound-Assisted Intrusion Detection Systems

Abstract

Network intrusion detection has been generally dealt with using sophisticated software and statistical analysis, although sometimes it has to be done by administrators, either by detecting the intruders in real time or by revising network logs, making this a tedious and timeconsuming task. To support this, intrusion detection analysis has been carried out using visual, auditory or tactile sensory information in computer interfaces. However, little is known about how to best integrate the sensory channels for analyzing intrusion detection alarms. In the past, we proposed a set of ideas outlining the benefits of enhancing intrusion detection alarms with multimodal interfaces. In this paper, we present a simplified sound-assisted attack mitigation system enhanced with auditory channels. Results indicate that the resulting intrusion detection system effectively generates distinctive sounds upon a series of simple attack scenarios consisting of denial-of-service and port scanning.

Sonification in Security Operations Centres: What do Security Practitioners Think?

“…Researchers have reported the ability to hear attacks using a range of mappings from network traffic features to parameters of sound [5], [28]. Qi et al mapped network-traffic parameters to sound, and stated that a range of attack scenarios were distinguishable [28].…”

“…Researchers have reported the ability to hear attacks using a range of mappings from network traffic features to parameters of sound [5], [28]. Qi et al mapped network-traffic parameters to sound, and stated that a range of attack scenarios were distinguishable [28]. Ballora et al sonified network traffic with a view to aiding anomaly detection, and reported the ability to hear patterns associated with port-scanning and distributed denial-of-service (DDoS) attacks [5].…”

“…We drew on existing literature in developing ideas for tentative use-cases for sonification in SOCs [35], [36], [5], [37], [14], [38], [7], [39], [28], [12], [40], [15]. From this, we identified areas requiring validation, and constructed questions on these aspects.…”

SensorTune

“…people with a music background) [19] or experts in the application domain, such as computer network experts [8,13,20]. Therefore mapping strategies generally leverage users' advanced knowledge or ability to detect sound qualities to provide a rich output that displays multiple data dimensions at the same time, associating each of them to different audio synthesis parameters such as pitch, loudness, duration and timbre.…”

“…The Peep [8] and NeMoS [13] systems provide a framework for associating different network traffic conditions and events to the generation of sound, while Qi and others [20] focus on intrusion detection and denial-of-service attacks. All of them differ from what we propose in the present paper in that they are targeted at advanced users -network administrators-rather than nonexperts.…”