research-article

Enhancing interoperability and stateful analysis of cooperative network intrusion detection systems

Authors:

Michele Colajanni,

Mirco MarchettiAuthors Info & Claims

ANCS '07: Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems

Pages 165 - 174

https://doi.org/10.1145/1323548.1323576

Published: 03 December 2007 Publication History

Abstract

A traditional Network Intrusion Detection System (NIDS) is based on a centralized architecture that does not satisfy the needs of most modern network infrastructures characterized by high traffic volumes and complex topologies. The of decentralized NIDS based on multiple sensors is that each of them gets just a partial view of the network traffic and this prevents a stateful and fully reliable traffic analysis. We propose a novel cooperation mechanism that the previous issues through an innovative state management and state migration framework. It allows multiple decentralized sensors to share their internal state, thus accomplishing innovative and powerful traffic analysis. The advanced functionalities and performance of the proposed cooperative framework for network intrusion detection systems are demonstrated through a fully operative prototype.

References

[1]

M. Andreolini, M. Colajanni, and M. Nuccio. Scalability of content-aware server switches for cluster-based web information systems.In Proc. of the 12th International World Wide Web Conference (WWW2003)Budapest, Hungary, May 2003.

[2]

V. Cardellini, E. Casalicchio, M. Colajanni, and P. S. Yu. The state of the art in locally distributed web-server systems. ACM Computing Surveys 34(2):263--311, 2002.

Digital Library

[3]

C. J. Coit, S. Staniford, and J. McAlerney. Towards faster string matching for intrusion detection or exceeding the speed of snort. In Proc. of the DARPA Information Survivability Conference and Exposition 2001.

[4]

M. Colajanni and M. Marchetti. A parallel architecture for stateful intrusion detection in high traffic networks. In Proc. of the IEEE/IST Workshop on "Monitoring, attack detection and mitigation" (MonAM 2006)Tuebingen, Germany, September 2006.

[5]

A. Constantine and R. Stadler. Adaptable sevrer cluster with QoS constraints. In Proc. of the 9th IFIP/IEEE International Symposium on Integrated Network Management Nice, France, May 2005.

[6]

H. Dreger, A. Feldmann, V. Paxson, and R. Sommer. Operational experiences with high-volume network intrusion detection. In Proc. of the 11th ACM conference on Computer and communications security 2004.

Digital Library

[7]

IETF Intrusion Detection Working Group. The intrusion detection message exchange format, 2006.

[8]

C. Kruegel, F. Valeur, G. Vigna,and R. Kemmerer. Stateful intrusion detection for high-speed networks. In Proc. of the IEEE Symposium on Research on Security and Privacy Oakland, CA,USA, May 2002.

Digital Library

[9]

R. Lippmann, J. W. Haines, D. J. Fried, J. Korba, and K. Das. Analysis and results of the 1999 darpa off-line intrusion detection evaluation. In Proc. of the Third International Workshop on Recent Advances in Intrusion Detection Toulouse, France, October 2000.

Digital Library

[10]

D. S. Milojičić, F. Douglis, Y. Paindaveine, R. Wheeler, and S.Zhou.Process migration. ACM Comput. Surv.32(3): 241--299, 2000.

Digital Library

[11]

V. A. Pham and A. Karmouch. Mobile software agents: An overview. IEEE Communication Magazine 36(7):16--37, 1998.

[12]

P. Porras, D. Schnackenberg, S. Staniford-Chen, Davis, M. Stillman, and F. Wu. The common intrusion detection framework architecture, 1999.

[13]

T. H. Ptacek and T. N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection. Technical report,Secure Networks,Inc., Suite 330, 1201 5th Street S. W, Calgary, Alberta, Canada, T2R-0Y6, 1998.

[14]

L. Schaelicke, T. Slabach, B. Moore, and C. Freeland. Characterizing the performance of network intrusion detection sensors. In Proc. of the Sixth International Symposium on Recent Advances in Intrusion Detection Pittsburgh, PA, USA, September 2003.

[15]

L. Schaelicke, K. Wheeler, and C. Freeland. Spanids: a scalable network intrusion detection loadbalancer. In Proc. of the 2nd conference on Computing frontiers Ischia, Italy, May 2005.

Digital Library

[16]

R. Sommer and V. Paxson. Exploiting independent state for network intrusion detection. In Proc. of the 21st Annual Computer Security Applications Conference Tucson, AZ, USA, December 2005.

Digital Library

[17]

N. Tuck, T. Sherwood, B. Calder, and G. Varghese. Deterministic memory-efficient string matching algorithms fo intrusion detection. In Proc. of the IEEE Conference on Computer Communication Hong Kong, China, March 2004.

[18]

D. Winer. XMLRPC, 2007.

[19]

K. Xinidis, I. Charitakis, S. Antonatos, K. G. Anagnostakis, and E. P. Markatos. An active splitter architecture for intrusion detection and prevention. IEEE Transactions on Dependable and Secure Computing 03(1):31--44,2006.

Digital Library

Cited By

Pierazzi FApruzzese GColajanni MGuido AMarchetti M(2017)Scalable architecture for online prioritisation of cyber threats2017 9th International Conference on Cyber Conflict (CyCon)10.23919/CYCON.2017.8240337(1-18)Online publication date: May-2017
https://doi.org/10.23919/CYCON.2017.8240337
Stabili DMarchetti MColajanni M(2017)Detecting attacks to internal vehicle networks through Hamming distance2017 AEIT International Annual Conference10.23919/AEIT.2017.8240550(1-6)Online publication date: Sep-2017
https://doi.org/10.23919/AEIT.2017.8240550
Marchetti MStabili D(2017)Anomaly detection of CAN bus messages through analysis of ID sequences2017 IEEE Intelligent Vehicles Symposium (IV)10.1109/IVS.2017.7995934(1577-1583)Online publication date: Jun-2017
https://doi.org/10.1109/IVS.2017.7995934
Show More Cited By

Index Terms

Enhancing interoperability and stateful analysis of cooperative network intrusion detection systems
1. Networks
  1. Network services
    1. Network monitoring

Recommendations

Exploiting timed automata based fuzzy controllers for designing adaptive intrusion detection systems
Special Issue on Fuzzy Ontologies and Fuzzy Markup Language Applications

Network intrusion detection systems (NIDSs) are pattern recognition problems that classify network traffic patterns as either ‘normal’ or ‘abnormal’. Precisely, the main aim of intrusion detection is to identify unauthorized use, misuse, and abuse of ...
Network intrusion detection

Intrusion detection is a new, retrofit approach for providing a sense of security in existing computers and data networks, while allowing them to operate in their current "open" mode. The goal of intrusion detection is to identify unauthorized use, ...
A Survey on Intrusion Detection and Prevention Systems
Abstract
In the digital world, malicious activities that violate the confidentiality, integrity, or availability of data and devices are known as intrusions. An intrusion detection system (IDS) analyses the activities of a single system or a network to ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

ANCS '07: Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems

December 2007

212 pages

ISBN:9781595939456

DOI:10.1145/1323548

General Chair:
Raj Yavatkar
Intel Corporation, USA
,
Program Chairs:
Dirk Grunwald
University of Colorado, USA
,
K. K. Ramakrishnan
AT&T Labs Research, USA

Copyright © 2007 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 03 December 2007

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

ANCS07

Sponsor:

ANCS07: Symposium on Architecture for Networking and Communications Systems

December 3 - 4, 2007

Florida, Orlando, USA

Acceptance Rates

ANCS '07 Paper Acceptance Rate 20 of 70 submissions, 29%;

Overall Acceptance Rate 88 of 314 submissions, 28%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

10
Total Citations
View Citations
534
Total Downloads

Downloads (Last 12 months)3
Downloads (Last 6 weeks)1

Reflects downloads up to 28 Sep 2024

Other Metrics

View Author Metrics

Citations

Cited By

Pierazzi FApruzzese GColajanni MGuido AMarchetti M(2017)Scalable architecture for online prioritisation of cyber threats2017 9th International Conference on Cyber Conflict (CyCon)10.23919/CYCON.2017.8240337(1-18)Online publication date: May-2017
https://doi.org/10.23919/CYCON.2017.8240337
Stabili DMarchetti MColajanni M(2017)Detecting attacks to internal vehicle networks through Hamming distance2017 AEIT International Annual Conference10.23919/AEIT.2017.8240550(1-6)Online publication date: Sep-2017
https://doi.org/10.23919/AEIT.2017.8240550
Marchetti MStabili D(2017)Anomaly detection of CAN bus messages through analysis of ID sequences2017 IEEE Intelligent Vehicles Symposium (IV)10.1109/IVS.2017.7995934(1577-1583)Online publication date: Jun-2017
https://doi.org/10.1109/IVS.2017.7995934
Somu VKamesh DSastry JSitara S(2017)Snort Rule Detection for Countering in Network AttacksProceedings of the 5th International Conference on Frontiers in Intelligent Computing: Theory and Applications10.1007/978-981-10-3153-3_57(573-583)Online publication date: 17-Mar-2017
https://doi.org/10.1007/978-981-10-3153-3_57
Ferretti LColajanni MMarchetti M(2016)Implementation of Verified Set Operation Protocols Based on Bilinear AccumulatorsCryptology and Network Security10.1007/978-3-319-48965-0_41(626-636)Online publication date: 28-Oct-2016
https://doi.org/10.1007/978-3-319-48965-0_41
Onizawa NGross WHanyu T(2013)A Low-Energy Variation-Tolerant Asynchronous TCAM for Network Intrusion Detection SystemsProceedings of the 2013 IEEE 19th International Symposium on Asynchronous Circuits and Systems10.1109/ASYNC.2013.16(8-15)Online publication date: 19-May-2013
https://dl.acm.org/doi/10.1109/ASYNC.2013.16
Colajanni MZotto LMarchetti MMessori M(2011)Defeating NIDS evasion in Mobile IPv6 networksProceedings of the 2011 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks10.1109/WoWMoM.2011.5986488(1-9)Online publication date: 20-Jun-2011
https://dl.acm.org/doi/10.1109/WoWMoM.2011.5986488
Chen HChen YSummerville D(2011)A Survey on the Application of FPGAs for Network Infrastructure SecurityIEEE Communications Surveys & Tutorials10.1109/SURV.2011.072210.0007513:4(541-561)Online publication date: 2011
https://doi.org/10.1109/SURV.2011.072210.00075
Colajanni MDal Zotto LMarchetti MMessori M(2011)The Problem of NIDS Evasion in Mobile Networks2011 4th IFIP International Conference on New Technologies, Mobility and Security10.1109/NTMS.2011.5721046(1-6)Online publication date: Feb-2011
https://doi.org/10.1109/NTMS.2011.5721046
D'Antonio SFormicola VMazzariello COliviero FRomano S(2010)Performance assessment of a distributed intrusion detection system in a real network scenario2010 Fifth International Conference on Risks and Security of Internet and Systems (CRiSIS)10.1109/CRISIS.2010.5764922(1-8)Online publication date: Oct-2010
https://doi.org/10.1109/CRISIS.2010.5764922

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents