A faster intrusion detection method for high-speed computer networks

Download

index.pdf

Date

2011

Author

Tarım, Mehmet Cem

Metadata

Show full item record

Item Usage Stats

196
views

202
downloads

The malicious intrusions to computer systems result in the loss of money, time and hidden information which require deployment of intrusion detection systems. Existing intrusion detection methods analyze packet payload to search for certain strings and to match them with a rule database which takes a long time in large size packets. Because of buffer limits, packets may be dropped or the system may stop working due to high CPU load. In this thesis, we investigate signature based intrusion detection with signatures that only depend on the packet header information without payload inspection. To this end, we analyze the well-known DARPA 1998 dataset to manually extract such signatures and construct a new rule set to detect the intrusions. We implement our rule set in a popular intrusion detection software tool, Snort. Furthermore we enhance our rule set with the existing rules of Snort which do not depend on payload inspection. We test our rule set on DARPA data set as well as a new data set that we collect using attack generator tools. Our results show around 30% decrease in detection time with a tolerable decrease in the detection rate. We believe that our method can be used as a complementary component to speed up intrusion detection systems.

Subject Keywords

Computer networks

URI

http://etd.lib.metu.edu.tr/upload/12613246/index.pdf
https://hdl.handle.net/11511/20563

Collections

Graduate School of Natural and Applied Sciences, Thesis

Suggestions

OpenMETU
Core

Improving performance of network intrusion detection systems through concurrent mechanisms Atakan, Mustafa; Şener, Cevat; Department of Computer Engineering (2003) As the bandwidth of present networks gets larger than the past, the demand of Network Intrusion Detection Systems (NIDS) that function in real time becomes the major requirement for high-speed networks. If these systems are not fast enough to process all network traffic passing, some malicious security violations may take role using this drawback. In order to make that kind of applications schedulable, some concurrency mechanism is introduced to the general flowchart of their algorithm. The principal aim is...
A simple and effective mechanism for stored video streaming with TCP transport and server-side adaptive frame discard Gurses, E; Akar, Gözde; Akar, N (Elsevier BV, 2005-07-15) Transmission control protocol (TCP) with its well-established congestion control mechanism is the prevailing transport layer protocol for non-real time data in current Internet Protocol (IP) networks. It would be desirable to transmit any type of multimedia data using TCP in order to take advantage of the extensive operational experience behind TCP in the Internet. However, some features of TCP including retransmissions and variations in throughput and delay, although not catastrophic for non-real time data...
A new approach for the scalable intrusion detection in high-speed networks Şahin, Ümit Burak; Schmidt, Şenan Ece; Department of Electrical and Electronics Engineering (2007) As the networks become faster and faster, the emerging requirement is to improve the performance of the Intrusion Detection and Prevention Systems (IDPS) to keep up with the increased network throughput. In high speed networks, it is very difficult for the IDPS to process all the packets. Since the throughput of IDPS is not improved as fast as the throughput of the switches and routers, it is necessary to develop new detection techniques other than traditional techniques. In this thesis we propose a rule-ba...
A Graph Based Big Data Model for Wireless Multimedia Sensor Networks Küçükkeçeci, Cihan; Yazıcı, Adnan (2016-10-08) Wireless multimedia sensor networks are of interest to researchers from different disciplines and many studies have been proposed in a wide variety of application domains, such as military surveillance systems, environmental monitoring, fault monitoring and distributed smart cameras in the last decade. In a wireless sensor network, a large number of sensors can be deployed to monitor target areas and autonomously collect sensor data. This produces a large amount of raw data that needs to be stored, processe...
Architectural design of an access control system for enterprise networks Kirimer, Burak; Özgit, Attila (2007-11-09) Client computers in enterprise networks have the potential to be the source of serious security problems, especially when their hardware and software components are out of physical administrative control. Besides, services in the network may have client configuration requirements. We propose a system composed of a policy management and enforcement server and client agents, which authenticates the client users and checks their computer configurations before allowing their access to services. The information ...

Citation Formats

M. C. Tarım, “A faster intrusion detection method for high-speed computer networks,” M.S. - Master of Science, Middle East Technical University, 2011.