Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should I consider? Should I consider the network anomaly papers or intrusion-based papers?

As I learned, there are papers considering detecting network anomalies (link outage, large file transfers,... as well as DoS, Probe attacks) and there are papers considering detection of intrusions (DoS, Probe, U2R, and R2L attacks).

Are the former papers the special case of latter ones? I mean the feature space used for them are a subset of the latter one?

share|improve this question
    
If this is more than a toy research project, you need to seriously look into performance. Even signature based IDS have troubles processing > 100 Mbps. When anomaly checking comes in, you'll be choking on 10Mbps or lower. –  Vitaly Osipov Nov 22 '12 at 23:39

1 Answer 1

up vote 2 down vote accepted

First response, please don't flame :-)

If I understand your question correctly then yes you could think of attacks as a sub-set of anomalies. In some cases this is useful, but not terribly. If, for example, you have a very quiet network segment that never sees any traffic and all of a sudden you get slammed. The traffic change is an anomaly that could be an intentional DoS, or maybe you just put your website on search-engine-x and it finally got some traffic. The reality of the situation is contextual, one of the reasons that tuning your firewalls/ips/ids/etc is so important. It would be my advice to look at both independently and also consider them holistically. Tune, adjust, refine.

From an analysis point of view you would even say that consistent attacks, ie the standard, which suddenly disappear would also raise a red flag. Posit: your network has been getting low level probes from a specific IP range for a month straight. These types of nuisance scans are often over-looked but today, for no reason that you can tell, they stop. This is an anomaly for the network traffic patterns, but is it a good or a bad thing?

As to the last part; malignant network activity (DoS, Probes) and intrusion detection (looking at u2r/r2l/etc activities) are two different classes of detection analysis.

There is a decent paper on this at http://cs.fit.edu/~mmahoney/dist/ although it's a little dated I think it is still salient to your question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.