SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Network Security: Statistical-Based Intrusion Detection System (IDS) Development

garron avatar
garron
14 diapositives · 292 Views · Oct 26, 2012

Statistical-Based Intrusion Detection System (IDS) that effectively detects multiple types of network attacks, including Denial of Service (DoS) attacks and port scans. Leveraging the DARPA98 dataset, we focus on statistical methods to differentiate between benign and malicious traffic. Our approach employs Hidden Markov Models (HMM) and Double Gaussian Models for enhanced anomaly detection accuracy. By analyzing real traffic patterns and feature extraction methods, we strive to improve network security against evolving threats.

Network Security: Statistical-Based Intrusion Detection System (IDS) Development - slide 1
01 / 14Network Security: Statistical-Based Intrusion Detection System (IDS) Development
1 / 17

Télécharger la présentation

Network Security: Statistical-Based Intrusion Detection System (IDS) Development
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Statistical based IDS background introduction

  2. Statistical IDS background • Why do we do this project • Attack introduction • IDS architecture • Data description • Feature extraction • Statistical method introduction • Result analysis

  3. Project goals • Related work • Internet has various network attacks, including denial of service attacks and port scans, etc. • Overall traffic detection • Flow-level detection • Our goals • Detect both attacks at the same time • Differentiate DoS and port scans

  4. Attack introduction • TCP SYN flooding - An important form of DoS attacks - Exploit the TCP’s three-way handshake mechanism and its limitation in maintaining half-open connection - Feature: spoofed source IP - Recent reflected SYN/ACK flooding attacks

  5. Attack introduction • Port scan - horizontal scan - Vertical scan - Block scan Feature: real source IP address

  6. Statistical IDS architecture • Learning part • Detection part

  7. Data description • DARPA98 data • The first standard corpora for evaluation of network intrusion detection systems. • From the Information Systems Technology Group ( IST ) of MIT Lincoln Laboratory, • Under Defense Advanced Research Projects Agency ( DARPA ITO ) and Air Force Research Laboratory ( AFRL/SNHS ) sponsorship • Seven weeks of training data • Two weeks of detection data

  8. Data description • DARPA98 data format 897048008.080700 172.16.114.169.1024 > 195.73.151.50.25: S ACK 1055330111:1055330111(0) win 512 <mss 1460> - Time stamp: 897048008.080700 - Source IP address + port: 172.16.114.169.1024 - Destination IP address + port: 195.73.151.50.25 - TCP flag: S (maybe other : R, F, P) - ACK flag: ACK - Other part of packet header: 1055330111:1055330111(0) win 512 <mss 1460>

  9. Feature extraction • Calculate the metrics in every 5 minute traffic • Metrics • For example: SYN-SYN_ACK pair SYN-FIN + SYN-RSTactive pair traffic volume SYN packet volume …… Good Luck 

  10. Statistical method • Statistical based IDS Goals: Using statistical metrics and algorithm to differentiate the anomaly traffic from benign traffic, and to differentiate different types of attacks. - Advantage: detect unknown attacks - Disadvantage: false positive and false negative

  11. Hidden Markov Model (HMM) • HMM is a very useful statistical learning model. It has been successfully implemented in the speech recognition. - Advantage 1. analyzing sequence data (using observation probability and transition probability to represent) 2. unsurprised data training and surprised data training 3. high accuracy - Disadvantage comparatively long training time

  12. Double Gaussian model • Introduction - Two Gaussion distribution models are used to represent two classes of behaviors - Get the two probabilities of current behavior using different two-class Gaussian parameters - Compare them. The current behavior belongs to the larger probability class. • Training period - Get the two-class Gaussian parameters • Detection period - Use two-class Gaussian parameters to get probabilities and compare them

  13. Double Gaussian model • Advantage • Simple, easy to understand • Fast • Disadvantage • No sequence characteristic

  14. Result analysis • Evaluation - Important quantitative analysis: false positive + false negative - Looking at metric value, and finding the reasons - Repeating experiments