https://scholars.lib.ntu.edu.tw/handle/123456789/456091
標題: | Cross-level behavioral analysis for robust early intrusion detection | 作者: | Hsiao, S.-W. YEALI SUN Chen, M.C. Zhang, H. |
關鍵字: | Anomaly detection; Attack assessment; Cross-level behaviorial analysis; Finite state machine; Network protocol | 公開日期: | 2010 | 起(迄)頁: | 95-100 | 來源出版物: | 2010 IEEE International Conference on Intelligence and Security Informatics: Public Safety and Security | 摘要: | We anticipate future attacks would evolve to become more sophisticated to outwit existing intrusion detection techniques. Existing anomaly analysis techniques and signature-based detection practices can no longer effective. We believe intrusion detection systems (IDSs) of the future will need to be capable to detect or infer attacks based on more valuable information from the network-related properties and characteristics. We observed that even though the signatures or traffic patterns of future stealthy attacks can be modified to outwit current IDSs, certain behavioral aspects of an attack are invariant. We propose a novel approach that jointly monitors network activities at three different levels: transport layer protocols, (vulnerable) network services, and invariant anomaly behaviors (called attack symptoms). Our system, SecMon, captures the network behaviors by simultaneously performing cross-level state correlation for effective detection of anomaly behaviors. For the most part, the invariant anomaly behavior has not been fully exploited in the past. A probabilistic attack inference model is also proposed for attack assessment by correlating the observed attack symptoms to achieve the low false alarm rate. The evaluations demonstrate our prototype system is efficient and effective for sophisticated attacks, including polymorphism, stealthy, and unknown attack. © 2010 IEEE. |
URI: | https://scholars.lib.ntu.edu.tw/handle/123456789/456091 | DOI: | 10.1109/ISI.2010.5484768 | SDG/關鍵字: | Analysis techniques; Anomaly detection; Attack assessment; Behavioral analysis; False alarm rate; Finite state machines; Inference models; Intrusion Detection Systems; Network activities; Network behaviors; Network services; Prototype system; Traffic pattern; Transport layer protocols; Computer crime; Contour followers; Information science; Network protocols; Network security; Intrusion detection |
顯示於: | 資訊管理學系 |
在 IR 系統中的文件,除了特別指名其著作權條款之外,均受到著作權保護,並且保留所有的權利。