improved detection of low profile probes
play

ImprovedDetectionofLow-ProfileProbes andDenial-of-ServiceAttacks * - PowerPoint PPT Presentation

ImprovedDetectionofLow-ProfileProbes andDenial-of-ServiceAttacks * WilliamW.Streilein RobK.Cunningham,SethE.Webster MITLincolnLaboratory WorkshoponStatisticalandMachineLearning


  1. Improved�Detection�of�Low-Profile�Probes� and�Denial-of-Service�Attacks * William�W.�Streilein Rob�K.�Cunningham,�Seth�E.�Webster MIT�Lincoln�Laboratory Workshop�on�Statistical�and�Machine�Learning� Techniques�in�Computer�Intrusion�Detection June,�2002 * This�work�was�sponsored�by�the�Department�of�the�Air�Force�under Air�Force�contract�F19628-00-C-0002.�Opinions,�interpretations,� conclusions,�and�recommendations�are�those�of�the�authors�and�are�not�necessarily�endorsed�by�the�United�States�Government MIT�Lincoln�Laboratory WWS� 1 6/12/02

  2. Outline • Motivation�and�Goals • Overall�System�Design • Data�Structure�Improvements The� Psplice Connection�Library • • Feature�Vector�Improvements – Feature�element�importance • Test�Results�on�1999�DARPA�Evaluation�Data – Methodology – Results:�Probe,�DoS,�Stealth�Detection • Data�Structure�Performance • Summary MIT�Lincoln�Laboratory WWS� 2 6/12/02

  3. Motivation • Network-based�intrusion�detection�remains�an�important� tool�in�detecting�Probes�and�DoS�attacks – More�complete�perspective�on�local�and�remote�network� activities�than�host-based�systems – Can�protect�multiple�devices�at�once – Stealthy�probes�common�precursor�to�attack • Stealthy�probes�use�techniques�designed�to�avoid�detection – DoS�attacks�increasing�in�number�and�distributed�nature • Machine�learning�for�Probe�and�DoS�detection – Learn�to�distinguish�attack�traffic�from�normal�traffic� • Actual�network�data�used�to�train�algorithm – Network�outputs�represent�probabilities�of�detection • Allows�choosing�an�appropriate�output�threshold MIT�Lincoln�Laboratory WWS� 3 6/12/02

  4. Goals • Enhance�Probe�and�DoS�detection�and�performance�of� original�system • Enhance�detection�feature�vector� – Reflect�closer�relationship�to�connection�events�and�improved� event�timing�available�from�Psplice • Detect�new�classes�of�Attacks – Expand�Protocol�Coverage:�ARP,�DHCP – Distributed�DoS,�Probe�attacks • Make�internal�data�structures�less�vulnerable�to�attack – Original�system�uses�hash�tables • Reduce�analyst�workload�through�alert�aggregation – Original�system�produces�new�alert�per�connection MIT�Lincoln�Laboratory WWS� 4 6/12/02

  5. System�Design • Multi-stage�processing�of� connection�events�for�attack� detection • Connection�processing�handled� by�Psplice�library • Feature�extraction�upon�event� time�and�characteristics • Neural�network�classifiers� produce�probability�of�attack • Distributed�attacks�recognized� through�alert�aggregation • Aggregation�of�alerts�reduces� Alert�Aggregation analyst�overload MIT�Lincoln�Laboratory WWS� 5 6/12/02

  6. Psplice • LL-Developed�library�for�tracking�TCP,UDP,�ICMP,�ARP�and�DHCP� connections • Utilizes�libpcap�packet�library • Operates�in�real-time�or�on�capture�file • Summarizes�packet�data�into�OPEN,�DATA�and�CLOSE�connection� events�for�calling�application • Delivers�connection�statistics�and�attribute�flags – ACK�flag,�FIN�flag,�etc. – N�bytes/pkts�to�src,�M�bytes/pkts�to�dest • Reliable�connection�tracking�algorithm�less�vulnerable�than� traditional�tracking�techniques�to�insertion�and�deletion�attacks� (c.f.�Ptacek,�Newsham) – Waits�for�host�response�to�determine�state�of�connection MIT�Lincoln�Laboratory WWS� 6 6/12/02

  7. Data�Structure�Enhancements • Support�new�detection�capability�and�general�functionality – Expanded�protocol�coverage:�ARP,�DHCP – Distributed�DoS,�Probe�attacks – Alert�aggregation • Balanced�Binary�Tree�based�data�structures�replace�hash� tables�and�linked�lists – Predictable�insertion�and�search�times� O(logN) – More�efficient�use�of�memory – Less�vulnerable�to�targeted�attack�from�knowledgeable� attacker MIT�Lincoln�Laboratory WWS� 7 6/12/02

  8. New�Data�Structures Data�Structure Functionality Anomaly�Table Determine�connection�likelihood Connection�probabilities ARP�Table Detect�ARP�Attacks MAC/IP�Addressing�Mapping DHCP�Table Detect�DHCP�Attacks Network�configuration DoS�Table Detect�Distributed�DoS Store/Aggregate�DoS�Alerts Probe�Table Detect�Distributed�Probe Store/Aggregate�Probe�Alerts Alert�Table Reduce�False�Alarms,�Aggregate� Store/Aggregate�All�Alerts Alert�Output MIT�Lincoln�Laboratory WWS� 8 6/12/02

  9. Feature�Vector�Elements Type Intuition/Purpose Capture�Individual�Packet� Single�Packet�Features Characteristics,�Invalid�IPs Protocol�(ICMP,�TCP,�UDP),� Strange/Inside�IP,�Flags�FIN,�ACK Connection�Open�Features Abnormal�number�of��OPENs�mark�� DoS�and�fast�scans #�Same�Host,�#�Same�SVC Connection�Close�Features Capture�anomalous�connections,� Abnormal�connection�counts #�Same�Host,�#�Same�SVC,�#� Abnormal Connection�Destination�Features Capture�targeted�DoS,�broad� #�Same�SVC,�#�Diff�SVC service�probe Connection�Source�Features Find�active�single�attack�source #�Diff�Pings�from�source Connection�Timing�Features DoS�have�small�inter�connection� event�interval Open�Interval,�Close�Interval MIT�Lincoln�Laboratory WWS� 9 6/12/02

  10. Feature�Importance OPEN #�ECHOS� CLOSE #�OPENS� INSIDE #�DIFF STRANGE ICMP� Interval� Interval� IP� SVCs� IP/PORT� Feature�Name • Backward�feature�selection�on�training�set�of�Probe�and�DoS�attacks • Performance�falls�off�after�CLOSE�interval�timing�is�removed • Best�feature:�“#�of�different�services�connected�to” MIT�Lincoln�Laboratory WWS� 10 6/12/02

  11. Most�Important�Feature�Elements Type Reason Capture�Individual�Packet� Single�Packet�Features Characteristics,�Invalid IPs Protocol�(ICMP,�TCP,�UDP),� Strange/Inside�IP,�Flags�FIN,�ACK Connection�Open�Features Abnormal�number of��OPENs�mark� of�DoS�and�fast�scan #�Same�Host,#�Same�SVC Connection�Close�Features Capture�anomalous�connections,� Abnormal�connection�counts #�Same�Host,�#�Same�SVC,�#� Abnormal Capture�targeted�DoS,�broad� Connection�Destination�Features service�scan #�Same�SVC,�#�Diff�SVC Connection�Source�Features Find�active�single�attack�source #�Diff�Pings�from�source DoS�and�Stealth�scans�have� Connection�Timing�Features small�inter�event�interval Open�Interval,�Close�Interval MIT�Lincoln�Laboratory WWS� 11 6/12/02

  12. DARPA�Intrusion�Detection�Evaluation DARPA�Intrusion�Detection�Evaluation Simulation�Network�Overview Simulation�Network�Overview 1000’s�Hosts,�100’s�Users Normal and�Attack Traffic Primary�Services/Protocols • http • X Inside • smtp • SQL/Telnet Eyrie AF�Base • pop3 • DNS • FTP • finger • IRC • snmp R�o�u�t�e�r • Telnet • UNIX�Workstations • time • CISCO�Router Packet�Sniffer Outside Internet MIT�Lincoln�Laboratory WWS� 12 6/12/02

  13. Training/Testing�Methodology • 1998�and�1999�DARPA�Evaluation�Corpus – Several�weeks�of�attack-free�and�attack-laden�network�data • Probes,�DoS,�User�to�Root,�Remote�to�Local�attacks • Note:�Does�NOT�contain�DHCP�or�distributed�Probes/DoS�attacks – Used�by�other�researchers�for�IDS�development • Well�over�200�downloads�to�date,�~50�citations�(citeseer) • Focus�on�stealthy�Probe�and�flow-based�DoS�attacks – Flow-based�attacks�exhaust�network/computing�resources • Train�on�all�1998�data�attacks�(train�and�test)�and�1999�training� data – 22�Probes,�27�DoS�attacks • Test�on�1999�test�data • Develop�individual�attack�classifiers�trained�to�recognize�self�from� normal�AND�non-self�attacks MIT�Lincoln�Laboratory WWS� 13 6/12/02

  14. Results:�Probe�Detection Detection�rate�of�82%� with�<�1�false�alarm/day False�Alarm�Per�Emulated�Day • Tested�on�variety�of�IP�address�and�ports�scans • Slight�improvement�over�original�system�due�to�better� connection�tracking�and�timing MIT�Lincoln�Laboratory WWS� 14 6/12/02

  15. Results:�Denial-of-Service�Attacks Detection�rate�of�68%� with�<�1�false�alarm/day False�Alarm�Per�Emulated�Day • Tested�on�smurf,�neptune,�PoD • Slight�improvement�of�FA�rate�due�to�output�alert� aggregation MIT�Lincoln�Laboratory WWS� 15 6/12/02

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend