Using CLIPS to Detect Network Intrusions

Abstract

We describe how to build a network intrusion detection sensor by slightly modifying NASA's CLIPS source code introducing some new features. An overview of the system is presented emphasizing the strategies used to inter-operate between the packet capture engine written in C and CLIPS. Some extensions were developed in order to manipulate timestamps, multiple string pattern matching and certainty factors. Several Snort functions and plugins were adapted and used for packet decoding and preprocessing. A rule translator was also built to reuse most of the Snort's attack signatures. Despite some performance drawbacks, results prove that CLIPS can be used for real-time network intrusion detection under certain conditions. Several attack signatures using CLIPS rules are showed in the appendix. By mixing CLIPS with Snort features, it was possible to introduce flexibility and expressiveness to network intrusion detection.

Integral Misuse and Anomaly Detection and Prevention System

“…Thereby, Snort 1 (a rule-based state of the art Misuse Detection System, see (Roesch, 1999), has been integrated to improve the training procedure to increase the accuracy of ESIDE-Depian. Following a strategy proven successful in this area, (Alipio et al, 2003), the reasoning engine we present here is composed of a number of Bayesian experts working over a common knowledge representation model. The Bayesian experts must cover all possible areas where a menace may rise.…”

Bayesian Networks for Network Intrusion Detection

“…Please note that this sequence only applies for the standard generation process followed by the Packet Header Parameter Analysis experts (see Figure 2). We have divided the network traffic according to its type (TCP-IP, UDP-IP and ICMP-IP) and created three Bayesian networks (experts) to analyse their respective packet headers (which is an strategy already proven successful in this area (Alípio et al, 2003)). Moreover, in order to cover all possible kind of menaces, we also have to take into account the payload (i.e.…”

“…Different approaches to develop network misuse detectors include expert systems (Alípio et al, 2003), intent-specification languages (Doyle et al, 2001), intelligent agent systems (Helmer et al, 2003) or rule-induction systems (Kantzavelou & Katsikas, 1997) (in (Kabiri & Ghorbani, 2005) the reader can obtain a detailed analysis of related work in this area).…”

Bayesian-Networks-Based Misuse and Anomaly Prevention System

“…Thereby, Snort (a rule-based state of the art Misuse Detection System (Roesch, 1999)), has been integrated to improve the training procedure to increase the accuracy of ESIDE-Depian. Following a strategy proven successful in this area (Alipio et al, 2003), the reasoning engine we present here is composed of a number of Bayesian experts working over a common knowledge model. The Bayesian experts must cover all possible areas where a menace may rise.…”

“…Anomaly Detection Systems, however, cannot compete with Misuse Detection ones when it comes to detect wellknown attacks; therefore, each approach fails when it comes to the other's area of expertise. Now, several paradigms have been used to develop diverse NIDS approaches (a detailed analysis of related work in this area can be found for instance in (Kabiri and Ghorbani, 2005)): Expert Systems (Alipio et al, 2003), Finite Automatons (Vigna et al, 2000), Rule Induction Systems (Kantzavelou and Katsikas, 1997), Neural Networks (Mukkamala et al, 2005), Intent Specification Languages (Doyle et al, 2001), Genetic Algorithms (Kim et al, 2005), Fuzzy Logic (Chavan et al, 2004) Support Vector Machines (Mukkamala et al, 2005), Intelligent Agent Systems (Helmer et al, 2003) or Data-Mining-based approaches (Lazarevic et al, 2003). Still, none of them tries to combine anomaly and misuse detection and, fail when applied to either well-known or zero-day attacks.…”