Mining Regular Expression Rules based on q-grams
5
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
Signature-based intrusion systems use intrusion detection rules for detecting intrusion. However, writing intrusion detection rules is difficult and requires considerable knowledge of various fields. Attackers may modify previous attempts to escape intrusion detection rules. In this paper, we deal with the problem of detecting modified attacks based on previous intrusion detection rules. We show a simple method of reporting approximate occurrences of at least one of the network intrusion detection rules, based on q-grams and the longest increasing subsequences. Experimental results showed that our approach could detect modified attacks, modeled with edit operations.
Abstract
Signature-based intrusion systems use intrusion detection rules for detecting intrusion. However, writing intrusion detection rules is difficult and requires considerable knowledge of various fields. Attackers may modify previous attempts to escape intrusion detection rules. In this paper, we deal with the problem of detecting modified attacks based on previous intrusion detection rules. We show a simple method of reporting approximate occurrences of at least one of the network intrusion detection rules, based on q-grams and the longest increasing subsequences. Experimental results showed that our approach could detect modified attacks, modeled with edit operations.
참고문헌 (24)
- US Department of Defense Cyber Strategy, "US Department of Defense", 2~8 (2015)
- "Linux IP Firewalling Chains"[URL]
- "Netfilter: firewalling, NAT, and packet mangling for Linux"[URL]
- K. Wang, "Recent Advances in Intrusion Detection", Springer
- R. Perdisci, "McPAD : A Multiple Classification System for Accurate Payload-based Anomaly Detection", Computer Networks, Special Issue on Traffic Classification and Its Applications to Modern Networks, 5(6), pp.864~881 (2009)
- "AV-TEST: Malware statistics"[URL]
- 이경환, "무인항공기 보안 취약점 개선을 위한 연구", 스마트미디어저널, 7(3), pp.64~71 (2018), (사)한국스마트미디어학회[DOI]
- 조우진, "네트워크 보안 관제를 위한 로그 시각화 방법", 스마트미디어저널, 7(4), pp.70~78 (2018), (사)한국스마트미디어학회[DOI]
- 배성일, "인 메모리 악성코드 인젝션 기술의 언 패킹기법", 스마트미디어저널, 8(1), pp.19~26 (2019), (사)한국스마트미디어학회[DOI]
- "Snort: Network intrusion detection and prevention system"[URL]
- "The Bro Network Security Monitor"[URL]
- "Suricata: Open IDS / IPS / NSM engine"[URL]
- G. Navarro, "A guided tour to approximate string matching", ACM Computing Surveys, 33(1), pp.31~88 (2001)
- E. W. Myers, "A Four Russians Algorithm for Regular Expression Pattern Matching", Journal of ACM, 39(2), pp.430~448 (1992)
- D. Belazzougui, "Approximate regular expression matching with multi-strings", Journal of Discrete Algorithms, 18, pp.14~21 (2013)
- H. Altwaijry, "Automatic SNORT Signatures Generation by using Honeypot", Journal of Computers, 8(12), pp.3280~3286 (2013)
- B. Rice, "Automated Snort Signature Generation", Masters, pp.2014
- S. Ashfaq, "Efficient rule generation for cost-sensitive misuse detection using genetic algorithms", Proc. of CIS, pp.282~285 (2006)
- H.A. Kim, "Autograph: Toward automated, distributed worm signature detection", USENIX Security Symposium, pp.271~286 (2004)
- C. Schensted, "Longest increasing and decreasing subsequences", Canadian Journal of Mathematics, 13, pp.179~191 (1961)
- R.M. Karp, "Efficient randomized pattern-matching algorithms", IBM Journal of Research and Development, 31(2), pp.249~260 (1987)
- "Sniffles: Capture Generator for IDS and Regular Expression Evaluation"[URL]
- M. Shao, "Grammar-Driven Workload Generation for Efficient Evaluation of Signature-Based Network Intrusion Detection Systems", IEICE Transactions on Information and Systems, 99-D(8), pp.2090~2099 (2016)
- "tcpdump and libpcap"[URL]