Enhancing byte-level network intrusion detection signatures with context

DMCA

Enhancing byte-level network intrusion detection signatures with context (2003)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Robin Sommer , Vern Paxson

Venue:	IN PROC. 10TH ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY
Citations:	126 - 6 self

BibTeX

@INPROCEEDINGS{Sommer03enhancingbyte-level,
    author = {Robin Sommer and Vern Paxson},
    title = {Enhancing byte-level network intrusion detection signatures with context},
    booktitle = {IN PROC. 10TH ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY},
    year = {2003},
    pages = {262--271},
    publisher = {}
}

OpenURL

Abstract

Many network intrusion detection systems (NIDS) use byte sequences as signatures to detect malicious activity. While being highly efficient, they tend to suffer from a high false-positive rate. We develop the concept of contextual signatures as an improvement of string-based signature-matching. Rather than matching fixed strings in isolation, we augment the matching process with additional context. When designing an efficient signature engine for the NIDS Bro, we provide low-level context by using regular expressions for matching, and high-level context by taking advantage of the semantic information made available by Bro’s protocol analysis and scripting language. Therewith, we greatly enhance the signature’s expressiveness and hence the ability to reduce false positives. We present several examples such as matching requests with replies, using knowledge of the environment, defining dependencies between signatures to model step-wise attacks, and recognizing exploit scans. To leverage existing efforts, we convert the comprehensive signature set of the popular freeware NIDS Snort into Bro’s language. While this does not provide us with improved signatures by itself, we reap an established base to build upon. Consequently, we evaluate our work by comparing to Snort, discussing in the process several general problems of comparing different NIDSs.

Keyphrases

byte-level network intrusion detection many network intrusion detection system byte sequence malicious activity established base bro language regular expression step-wise attack exploit scan signature expressiveness matching process bro protocol analysis contextual signature popular freeware nids snort present several example efficient signature engine process several general problem high-level context false positive comprehensive signature set scripting language string-based signature-matching nids bro low-level context different nidss additional context semantic information high false-positive rate

DMCA