Efficient Statistics Based Framework for Network Intrusion Detection

Transcription

1 Iteratoal Joural of Soft Coutg ad Egeerg (IJSCE) ISSN: , Volue-3, Issue-, March 203 Effcet Statstcs Based Fraework for Network Itruso Detecto uo-che Lee, Zh-Ju Hsu, L Lu Astract Due to the growg threat of etwork attacks, detectg ad easurg etwork ause are creasgly ortat. Network truso detecto s oe of the ost frequetly deloyed aroaches. Most detecto systes oly rely o sgature atchg ethods ad, therefore, they suffer fro ovel attacks. Ths vgato resets a sle yet effcet data-g fraework (SID) that costructs a statstcs ased ausve traffc detecto syste ased o etwork flows. We show that SID ca accurately ad autoatcally detect exstg ad ew alcous etwork attets. Exeretal results valdate the feaslty of usg SID to detect etwork aoaly trusos. I artcular, we show that, sly eloyg four asc features of etwork flows, SID ca yeld a accuracy of over 97% wth a false ostve rate of 0.03% the tg dataset. Idex Ters Data Mg, Itruso Detecto, Network Securty, Mache Learg. I. INTRODUCTION Itruso detecto (ID) techques are fudaetal cooets of securty frastructures whch are adoted to detect ad the lock truders. ID techques are covetoally classfed to two categores: suse detecto ad aoaly detecto. Msuse detecto (also called sgature-ased detecto) strves to detect well-kow attacks y atchg cog traffc to exstg sgatures or rules. Msuse detectos geeral have a low false alar rate ut they suffer fro a a drawack: they caot detfy ew attacks wthout re-defed sgatures or rules. I cotrast, a aoaly detecto fraework, the syste creates oral user rofles ad the ay devato fro the oral user rofles s regarded as a aoaly attack. Ths aroach ca detect ew attacks ut t suffers fro ore false alars tha suse detectos. Sce etwork attacks/ause crease radly, detectg ad easurg these alcous actvtes ecoe ore ad ore ortat. As a result, a vast varety of detecto systes have ee roosed to allevate ths role []-[7],[2],[22-24]. Because sgature ased systes, e.g. [24], caot detect ovel attacks, several aoaly ased truso detecto systes are roosed to allevate ths role. As etoed earler, ecause aoaly detecto systes use oral user Mauscrt receved March 0, 203. uo-che Lee, Deartet of Electrcal Egeerg, Natoal Tawa Uversty, Tae Tawa (R.O.C.). Zh-Ju Hsu, R&D deartet, Dgcode Tech. Ltd., Tae Tawa (R.O.C.). L Lu, Graduate Isttute of Boedcal Iforatcs, Tae Medcal Uversty, Tae Tawa (R.O.C.) rofles to detfy aoaly suscos, creatg correct user rofles s a key factor to ther erforace. Aog varous techques, data g techque s a wdely used ethod to extract rules fro large datasets ad the use these rules to detfy suscous staces. The costructo of such systes s sle ad straghtforward: It starts wth a learg hase: rug a roalstc aer wth a gve set of trag data alog wth ther class laels. Afterwards, the redcto/detecto erod, the syste uses derved a osteror roaltes alog wth desged classfers to classfy ew staces to corresodg classes [8]. Aog all classfers, Bayes ased ad threshold ased oes, e.g. [4]-[7], ca rovde sle yet effcet aroaches to classfy staces to ther categores. Further, otce that the two tyes of classfers ca lear/tra ether a atch ode,.e. all staces are gve at a te, or a creetal ode,.e. trag staces are added sequetally. Ths flexlty akes the favorale to use esecally today fast evolvg Iteret evroet. I ths aer we roose a Statstcal ased ausve Itruso Detecto fraework, called SID, whch exaes ortat ad useful features of etwork flows stead of vgatg ther cotets to detect aoaly attacks. Our teto s to rovde a sle yet effcet truso detecto fraework for large etworks. The a oectve of SID s detectg ausve/osy etwork trusos, such as DoS, rather tha hgh level alcato attacks, such as uffer overflow exlotg. I addto, we vgate two dfferet classfcato aroaches, ave Bayes classfer ad threshold ased classfer, to study how classfcato techques affect syste erforace. The ave Bayes classfers use the Bayes roalty odel to vgate the otal decso for ukow cog traffc. Ad, as dcated ts ae, the threshold classfers coare the value couted fro the costructed uckets wth a threshold to classfy ukow staces. I Secto III.D, we rovde a aalytcal odel to study how classfers are desged. Fally, to evaluate the erforace of SID, we reset a seres of corehesve exerets ased o a large set of truso trag ad t data. Further, we use a rad ew dataset collected fro real etwork. The r of ths aer s orgazed as follows. Secto II dscusses the related work truso detecto. Secto III resets SID detals, cludg the roosed data trag algorth ad the aalytcal odel of decso classfers. Secto IV resets the exeretal results, showg that SID s very accurate ad effectve. Coclusos are fally draw Secto V. 399

2 Effcet Statstcs Based Fraework for Network Itruso Detecto II. RELATED WOR Network truso detecto s tycally sgature ased,.e. suse detecto. SNORT [24] s oe of the ost reresetatve works ths socety. Rules to detfy alcous coectos ca e easly wrtte SNORT. However, sce oe caot wrte rules for future attacks ad t s dffcult to kee the rules/sgatures udated, ths aroach s vulerale to ovel attacks. As a result, a alteratve aroach, aoaly truso detecto, s roosed to detfy suscous traffc/actvtes. Varous techques have ee roosed for odelg aoaly truso detecto systes. These systes, such as NIDES [22], SADE [23], HAD [], ALAD [2] ad SVM [3], frst create oral user rofles ad the geerate a alar whe a devato fro the oral rofles s detected. They dffer fro oe to aother the way that how they select useful features, how to choose roer algorths to derve oral rofles, ad how the algorths ake decsos. I ror work, ost features are otaed fro the acket headers. I artcular, SADE, ALAD, ad NIDES use the dstruto of the source ad dato I addresses, ort uers, ad the TC coecto state. HAD, a te-deedet odel, adoted 34 attrutes otaed fro the acket headers of Etheret, I, TC, UD, ad ICM ackets to detect truso. Lakha et al. roosed usg etroy as a easure of dstrutos of acket features to detfy ad classfy aoaly etwork traffc volues [9]. Cardeas et al. [0] roosed a fraework for IDS evaluato y vewg t as a ult-crtera otzato role. Srvas et al. tred to detfy ortat features for aoaly truso detecto systes [] ad Stolfo et al. roosed usg cro odels to satze trag dataset for aoaly detecto systes [2]. I [3], the data of each category was assged to k clusters through -eas clusterg ad tra the SVN y usg ew dataset whch cosst of oly ceters of cluster. The false alar values ca e reduced. Deste the large ody of work, there exsts o clear truso detecto fraework for large etworks. Bayes etwork s oe of the ost wdely adoted odels for resetg ucerta data [4]. It s a drected acyclc grah (DAG) whch vertces rereset evets, ad edges deote the relatos etwee evets. The uercal cooet quatfes the dfferet lks the DAG accordg to dstruto of the codtoal roalty of each ode the cotext of ts arets. Bayes etworks have ee wdely used to create odels for aoaly truso detecto. utt et al. [7] reseted a ehavor odel usg Bayes to ota the odel araeters. Golda [4] roosed a odel that sulates a tellget attacker usg Bayes etworks to geerate a la of goal-drected actos. ruegel et al. [5] descred a servce secfc truso detecto syste, whch coed the tye, legth, ad ayload dstruto of the requ as the features to calculate a aoaly score. Nave Bayes s a slfed Bayes etwork coosed of drected acyclc grahs wth oly oe root ode. A ave Bayes etwork s a rrcted etwork that has oly two layers. It assues that all attrutes are deedet. These rrctos result a tree-shaed etwork wth a sgle root ode, whch facltates classfer desg. Valdes et al. [6] develoed a syste that ales a ave Bayes etwork to erfor truso detecto o etwork evets. Seyala et al. [5] reseted a syste that detfes alcous executale code actve etworks. Sce large etworks oserve tos of ackets, flow ased detecto s favorale for aoaly detecto systes ractce [9]. Therefore, ths aer, we roose a sle yet effcet statstcs ased aoaly truso detecto fraework ased o oserved etwork flows, order to rovde a feasle fraework for large etworks. Although SID s slar to aforeetoed aoaly detecto systes, our work s dstgushed fro the that: we use oth oral ad aoalous data the trag rocedure whle covetoal aoaly detecto systes oly use oral data. Addtoally, SID cocetrates o ot oly correctess ut also o slcty, effcecy, ad feaslty. I artcular, we roose a heurstc learg/trag algorth for quck, flexle oral user/traffc rofles costructo. Further, ased o created rofles, we alsh two fast classfcato ethods, ave Bayes classfer ad threshold ased classfers, to detect aoaly actvtes ad to study how classfcato ethod affect erforace. Fally, we use two well-kow datasets, e.g. DARA 98 ad DD CU 99, ad data collected fro real etwork,.e. uversty caus, to evaluate the erforace of the roosed detecto fraework. We show that the roosed fraework ca acheve oth a hgh detecto rate ad a low false ostve rate y sly eloyg four asc features of etwork flows. Fg. Archtecture of SID. III. STATISTICS BASED INTRUSION DETECTION (SID). Garca-Teodoro et al. rovde a thoroughly troducto to aoaly ased etwork truso detecto systes (A-NIDS) [8]. SID has a slar archtecture fuctoalty to the aforeetoed geerc A-NIDS. However, cotrast wth geerc A-NIDS, SID utlzes ot oly alcous data ut also oral data the trag stage. Further, SID cocetrates o rovdg sle yet effcet 400

3 Iteratoal Joural of Soft Coutg ad Egeerg (IJSCE) ISSN: , Volue-3, Issue-, March 203 flow ased trag ad detecto algorths for otetal deloyet ackoe etworks. The detaled archtecture of SID s show Fg.. The data rerocessor oth trag ad tg rocedures extracts feature forato for further aalyss. I the trag rocedure, the syste uses the extracted data to tra/create oral user rofles. I the tg rocedure, the arrvg data are extracted as the trag rocedure ad the the extracted forato s fed to desged classfers to detere ts attrute. A. Characterzg Network Flows A etwork flow deotes a seres of I ackets exchaged etwee a source address/ort ad a dato address/ort. Flow states/features clude ut ot lted to flow tyes, e.g. tc, ud or c flows, flow durato, source/dato addresses ad orts, uer of ackets exchaged, uer of ytes trasferred, uer of ackets wth otos set. Although Srvas et al. tred to detfy ortat features for aoaly truso detecto [], the choce of ortat features s stll a oe challege aoaly truso detecto systes [8]. I ths aer we cocetrate o rovdg a sle, effcet fraework for ackoe etworks rather tha vgatg a otal feature selecto. Therefore, we roose a geerc flexle fraework, whch s caale to use varous features, to detect etwork trusos. Our exeretal results show that sly usg four features our fraework s suffcet to yeld outstadg erforace. I artcular, four of the followg fve features are used: durato, rotocol, servce, source ort uer, ad source yte. Durato s the elased te of the flow uder study ad rotocol s the Iteret rotocol uer of the flow, see [29]. Servce s the dato ort uer, e.g. HTT ort uer s 80, telet ort uer s 23, ad etc. Source yte s total uer of ytes that the source seds to the dato. Notce that each flow feature s a araeter wth varous values ragg aog a very large set. I [28] features are vewed as ether cotuous or dscrete accordg to a rage of the value of the feature uder study. For exale, source yte s cosdered cotuous ecause t s a 32-t usged teger wth a rage fro 0 to ad servce s also cosdered cotuous ecause t s a 6-t usged teger wth the rage fro 0 to rotocol s cosdered dscrete ecause t s a 8-t usged teger wth the rage fro 0 to 255. I SID, feature tyes are re-defed as recoeded [28]. I artcular, durato, servce, source ort, ad source yte are cotuous whle rotocol s dscrete. The reaso for dstgushg cotuous data tye fro dscrete data tye s for the sake of ractcal leetato. For a dscrete feature, a full-rak array, whch eas each array eleet reresets a sgle value of the feature, s allocated. However, t s feasle to allocate a array wth eleets for a 32-t feature, e.g. source yte. As a result, a extra trasforato rocedure, as we shall see soo, s erfored to hadle ths role. B. Data Trag I SID, after feature data s extracted, the syste wll detere whether t s cotuous. If the feature s dscrete, data s drectly laced to the arorate osto of the re-allocated array. Otherwse, a trasforato rocedure s erfored: The syste frst attets to lace the value to the re-arraged lst whch s aaged dyacally to accoodate trag forato. If o arorate seget s avalale for a ew value, the syste attets to create a addtoal seget for ths value. The feature extracto rocedure s erfored reeatedly utl all trag data are rocessed. Ad the, we costruct the traed uckets for detecto classfers. The detaled trag rocedure s show Fg. 2. To kee track of trag data for each feature cosdered the fraework, we create a data structure whch cotas two lsts, alcous lst (MLst) ad eg lst (BLst), ad a axu value, MaxValue, of the feature uder study, as show les -5 the DataTra() route of Fg. 2. Both lsts of a feature cosst of dsot segets that artto the etre rage of the feature uder study. Each seget records ts value, oudares, ad the statstcs of the trag data stored the seget. We rocess trag data sequetally, whch corresods to les 6-0 DataTra(). For each trag etry, we extract corresodg feature forato ad the accoodate the forato to corresodg segets. Ths task s descred y the FeatureAdd() route of Fg. 2. Whe we rocess a etry, we frst detfy whether the etry s alcous or eg order to accuulate extracted feature forato to the correct lst, whch s descred les -5 the FeatureAdd() route. Ad the, we have to udate the statstcs of the corresodg seget the chose lst, as show les 6-28 the FeatureAdd() route. As etoed earler, a feature ca e cosdered as ether cotuous or dscrete. For dscrete data, each seget cotas a sgle value ad the two lsts ca e easly leeted y two arrays. Therefore, extracted feature forato of a trag etry ca e drectly laced the corresodg osto y a sle ag. Tale ad Fg. 3 llustrate the detals the rocess. Assue the frst sx etres of a trag dataset are show Tale. Whe we rocess the frst etry, we fgure out that ths etry s a alcous TC coecto ad the rotocol uer of TC coectos s 6. Therefore, we crease the alcous cout of the eleet the rotocol Array dexed y TC rotocol uer 6. Ad the, we crease the alcous cout at osto 7 ecause the secod etry dcates that a UD coecto s alcous. After rocessg the frst sx etres, the cotet of the rotocol Array s show Fg. 3. However, the values of cotuous data could rage fro 0 to ad thus creatg a huge array for sle ag s ractcal. To overcoe ths role, cotuous values are trasfored to a set of dsot segets. For stace, a lst of the dato ort, say cossted of fve segets, could e {0-79, 80, 8-999, , }. To erfor ths trasforato, we roose a heurstc algorth order to erfor ths task quckly. The fudaetal dea s dvdg a seget to two dsot segets f a ewly serted data caot e stored curret segets. The seudo codes are show les 2-25 the FeatureAdd() route of Fg. 2. We aga use the etres Tale to llustrate the oeratos. We ca oserve fro the frst trag etry, the dato ort uer of ths 40

4 Effcet Statstcs Based Fraework for Network Itruso Detecto alcous coecto s 80. Because the alcous lst, MLst, s ety, we aed a seget the lst. The aeded seget sas the etre rage of the ort uer, wth value 80. The secod etry s also alcous ad thus we choose the alcous lst aga. Now, the extracted ort uer s whch s dfferet fro the value the curret seget of the alcous lst. cout: cout: 2 Beg cout: cout: 2 Malcous Fg. 3 The resultg seget lst for the rotocol feature. value:22 cout:2 value:80 cout: Beg value:80 cout: value:30000 cout: value:40000 cout: Malcous Fg. 2 Trag algorth Fg. 4 The resultg seget lst for the dato ort feature. Therefore, we eed to sert a ew seget to kee track of ths value. Because the ew value, 40000, s larger tha the old value, 80, we sert the ew seget after the curret seget. The start ot of the ew seget s the ddle ot etwee the old value ad ew value, whch s Further, we shrk the ed ot of the curret seget to ths ddle ot to ake the two segets o-overlaed. The aove oeratos corresods to les 6-20 the FeatureAdd() route. Let the resultg segets e: seget M, {0, 20040} wth value 80, ad seget M 2, {2004, 65535} wth value The thrd ad the fourth etres are eg ad these two etres reak the eg lst, BLst, to two segets: seget B, {0, 5} wth value 22, ad seget B 2, {5, 65565} wth value 80. The ffth etry s eg aga ad the ort uer s 22; thus we oly crease the cout of the seget B,.e. le 5 the seudo code. Fally, the sxth etry, we have to sert a ew value, 30000, to the alcous lst. Because the value s located seget M 2 ad the value s less tha the value of M 2,.e Therefore, we should sert a ew seget etwee M ad M 2. The oerato s descred les the FeatureAdd() route. After rocessg the frst sxth etres, the resultg lsts are show Fg. 4. C. Bucket Costructo After all etres the dataset are rocessed, each feature s characterzed y two arrays or lsts whch cotas trag Tale The frst sx etres of a sale trag dataset. data statstcs of the feature. It s easy to see that the all rotocol ort Source I D I Malcous TC(6) Yes UD(7) Yes TC(6) No UD(7) No UD(7) No UD(7) Yes segets the two arrays of a dscrete feature, e.g. rotocol, are alged, whch ca e also easly oserved fro Fg. 4. Therefore, the two arrays ca e easly coed to costruct uckets for detecto classfers. However, sce the segets the two lsts for cotuous features aye ot alged,.e. they ght have dfferet oudares, a erge rocedure s roosed to costruct uckets for cotuous features. The dea s ergg two adacet segets, f they have close statstcs, utl a ew seget wth dfferet statstcs ecoutered. Note that the ergg codto used ths 402

5 aer s the alcous to eg rato of a seget. However, the codto ca e very extesve ad flexle. All segets whch have close statstcs are coed to a ucket ad the ew seget s the start of the ext ucket. We terate oth lsts utl all segets are rocessed. The detaled seudo codes are show Fg. 5. Iteratoal Joural of Soft Coutg ad Egeerg (IJSCE) ISSN: , Volue-3, Issue-, March 203 fro the lot, there are four ad two segets the eg ad alcous lsts resectvely. Let the four segets the eg lst are B, {0,0000} wth value 80, B 2, {000, 20000} wth value 6000, B 3, {2000, 30000} wth value 24000, ad B 4, {3000, 65535} wth value Deote y M, {0, 20000} wth value 24000, ad M 2, {2000, 65535} wth value 24000, the two segets the alcous lst. To erge the two lsts, we start fro the u seget, the seget wth the u value, ad the ove toward the axu seget. The SegM() route of Fg. 5 s roosed to dscover the u seget etwee the two lsts. value:6000 value:80 cout:2000 cout:3000 value:24000 cout:000 value:38000 cout:3000 Beg value:24000 cout:3000 value:36000 cout:6000 Malcous Bcout:5000 Mcout:0 Bcout:0 Costructed Mcout:6000 Buckets Bcout:000 Bcout:3000 Mcout:3000 Mcout: Fg. 6 A ucket costructo exale. Fg. 5 Bucket costructo algorth. For a feature of ter, gve BLst ad MLst, Fg. 6 deostrates how uckets are costructed fro the two geerated lsts of a cotuous feature. As we ca oserve It s easy to see that the u seget etwee the two lsts Fg. 6 s seget B. Sce the ucket lst s ety ow, we start wth a ew ucket, say L, ad store statstcs forato B to L, whch corresods to les 6-0 the CreateBucket() route of Fg.5. The ext u seget s B 2. Sce all the staces B 2 are eg whch s the sae as L, we kow that ths seget ca e erged to ucket L,.e. accuulate statstcs of B 2 to L. The ext u seget cossts of B 3 ad M ecause they have the sae value. Sce the statstcs of ths seget s dfferet fro ucket L, we have to close ucket L ad create a ew ucket, say L 2 for ths seget. The teratg ot of L ad the statg ot of L 2 s the ddle ot etwee the value of B 2 ad the value of B 3 (or M ),.e The oeratos are descred y les 6-20 the CreateBucket() route. Now, we kow that uckets L starts fro 0 to wth 5000 eg staces ad o alcous stace ad that the ew ucket, L 2, starts fro 2000, recordg 000 eg staces ad 3000 alcous staces. The ext u seget s M 2 ecause ts value s saller tha the value of B 4. Sce all staces of ths seget are alcous, t s dfferet fro L 2 where oly 75% staces are alcous. As a result, slar oeratos descred les 6-20 the CreateBucket() route are erfored aga. Now, L 2 s closed at the ddle ot etwee ad 36000, ad L 3 starts fro 3000 to accoodate M 2. Note that L 2 sas fro 2000 to wth 000 eg couts ad

6 Effcet Statstcs Based Fraework for Network Itruso Detecto alcous couts. Fally, B 4 s added to the uckets. Aga, t caot e erged wth L 3 ad thus a ew ucket L 4 s created. The colete costructed uckets, L L 4, are show Fg. 6. D. Classfers ad Detecto As show Fg., the detecto rocedure s quet slar to the trag rocedure. After feature forato of a stace,.e. a cog flow or a tg data, s extracted, the forato s fed, alog wth the traed uckets, to decso classfers to detere whether the stace s alcous ased o the feature forato of the stace. I ths secto we costruct ad aalyze two decso classfers: the threshold classfer ad the ave Bayes classfer. Before we roceed, we troduce the otatos used ths secto. Deote y M ad B the roorto of alcous ad eg staces of the trag dataset resectvely. Let F F,..., F e the set of features cosdered the fraework, where s the uer of features cosdered. Assue the traed uckets of feature cotas N uckets, B B,..., B. Let, ad, e the deoted y N uer of eg ad alcous staces ucket of feature resectvely ad let, ad, e the ratos of eg ad alcous staces ucket of feature resectvely. That s, ad. Now, cosder feature deote y, ad, the ratos of eg ad alcous staces located ucket resectvely. It s easy to see that ad, N N. Fally, let X e the stace uder study ad let x e the forato extracted fro feature of ths stace. E. Threshold Classfer As dcated ts ae, threshold classfers use a threshold to classfy staces. Oe of the ost reresetatve threshold classfers s a -t slcer, or aalog to dgtal coverter (ADC), whch dgtzes a aalog sgal to a {0, } dgt. I our fraework, for exale, f we oly cosder two features ad the statstcs of oth feature show that a stace s alcous wth a hgh roalty, t s very lkely that the stace s alcous. To quatfy hgh roalty, defg a roalty threshold, say th, s oe of the sl aroaches. Let e the roalty ate that the stace s alcous fro the vewot of feature. That s f x ad feature wll sugg that X s alcous f B. Based o the oservato fro the th features cosdered, to ate how lkely a stace s alcous, we ca coute the alcous ate,, of X as the su of the roalty ate of all features. That s F F. I ths aer, we eloy a etaorhoss of aorty rule to detere whether a stace s alcous. (Note that threshold classfers could e very varat. Other reforato of rules or thresholds ca e also aled SID.) I artcular, we cla that a stace s alcous f the alcous ate s larger tha the u roalty that all features cla that the stace s alcous. Further, the atheatcal forulato of the threshold classfer ca e exressed as follows: X s Malcous f th () Beg otherwse F. Nave Bayes Classfer Nave Bayes assues that all cosdered features of a stace are codtoally deedet. The deedece assuto les that the coutato of ave Bayes classfers ca e couted ore effcetly tha the exoetal colexty of o-ave Bayes aroaches, sce t does ot cosder coatos classfers. Cosder N dsot ossle classfer results (or decsos), C,, C N, that arttos the sale sace. Gve a stace X ad ts features {x }, we ca coute the roalty that X elogs to a artcular result y the followg equato. X C F x,, F x F x,, F x C C F x,, F x Uder the assuto that all features are deedet, the aove equato ca e rewrtte as follows: X C F x,, F x C F x C F x,, F x Now, t s easy to see that the otal decso for X s gve y C ot F x C (2) arg ax C (3) C I SID, we cosder two ossle decsos: Malcous ad Beg. We ca coute the osteror roaltes that X s alcous ad eg, deoted y ad resectvely, y (4) ad (5). x B x M, (4), x B B B,, x B Fally, otce that the deoators of the aove two equatos are detcal. As a result, to exedte coutato, the ave Bayes decso classfer ca e costructed as follows: X s Malcous f M B, (6) Beg otherwse A. Dataset Descrto IV. EVALUATION (5) We use three datasets to deostrate that SID ca acheve 404

7 Iteratoal Joural of Soft Coutg ad Egeerg (IJSCE) ISSN: , Volue-3, Issue-, March 203 a hgh detecto rate wth a low false alar rate. The frst two of the are wdely used IDS erforace evaluato ad the last oe s ewly collected fro real etwork. To show that SID ca detfy ukow aoaly actvtes, the t dataset cotas several ew trusos that are ot reseted the trag dataset. The frst dataset used s the DARA 98 [25] dataset whch orgates fro MIT Lcol Laoratory ad has ee develoed for IDS evaluatos y DARA. It collects traffc fro a real etwork, eg lasted wth ultle attacks. The dataset cossts of tcdu fles, whch record all etwork ackets, ad lst fles, whch record corresodg sessos/flows of the dued fles. Each le a lst fle corresods to a dvdual sesso/flow, as descred Secto III, ad a le cossts of e felds, whch detfes the flow, followed y a attack dcator ad a otoal attack tye. The etre dataset cossts of data of fve-week oservato. We use the data collected the frst three weeks as the trag dataset ad use the data collected the last two weeks as the tg dataset. The trag dataset cossts aroxately oe llo data staces ad the tg dataset cotas aout 66,000 staces. The secod dataset we used s the DD CU 999 dataset [28], whch extracts varous quattatve ad qualtatve features fro the trace of DARA 98 dataset. I artcular, the trag dataset s coosed of aroxately 4,900,000 data staces ad each stace cossts of 4 dscrete or cotuous features alog wth a attack lael ad a attack tye. I addto to the trag dataset, DD CU 999 also rovdes a tg dataset for tg urose. I oth trag ad tg datasets, the attacks are classfed to four categores, Deal of Servce attacks (DoS), User-to-Root attacks (U2R, uauthorzed access to root rvlege), Reote-to-Local attacks (R2L, uauthorzed access fro reote aches) ad rog. I addto to the etre dataset, the trag ad tg data are sltted to four su-datasets ased o the aforeetoed four attack categores (DoS, U2R, R2L ad roe). For stace, the trag ad t datasets for DoS clude all DoS attacks, ad all oral cases the orgal trag ad t data. Although t s well kow that the two aforeetoed datasets are sytheszed, t s ortat to eto that the datasets ca e cosdered as the ase le of a NIDS related research. The datasets are wdely acceted as echark datasets ad referred y ay researchers [7]-[20]. As a result, we frst use the two datasets to study the erforace of SID ad the we coare the results wth the results of SID real etwork, whch s dscussed ext. The thrd dataset we used s collected fro real etwork,.e. uversty caus. There are ore tha,000 couters coected to our gateway. We collect etwork traffc va tcdu [30]. After raw ackets are catured, we grous the to etwork flows accordace wth the flow classfcato ethods used the lterature [2], [26], [27]. The collecto sas over 20 days ad the resultg dataset cotas aout 2 llo staces. We erfor several exerets ased o the etre dataset. Each exeret sales 2 llo staces as the trag dataset ad llo staces as the tg dataset. B. Exerets I ths secto we reset the exeretal results, showg that SID ca acheve outstadg erforace for oth datasets. To deostrate SID s very flexle, we choose dfferet features for the two datasets ad show that oth choces ca result excellet erforace. I artcular, we adot durato, rotocol, ad servce for all datasets. We choose source ort the DARA 98 dataset whle we select source yte the DD ad the real etwork dataset. Notce that the reaso of choosg ths coato coes fro our tuto ad exerece as well as the results of ror work. Further, we also erfor several exerets usg dfferet coatos of selected features. Sce slar results are oserved these exerets, we do ot reset the results the aer. Dscoverg the otal choce of features s out of the scoe of ths aer. We refer ter readers to []. C. DARA Dataset We frst use the DARA dataset to study how the threshold, th, affects the ehavor of a threshold classfer ad thus chages syste erforace. The results are show Fg. 7. Frst, we ca oserve fro the lot that the false ostve rate, derved as the ercetage of oral staces classfed as alcous, ad the detecto rates, otaed as the ercetage of alcous staces detected, are hgh whe th s sall. Ths ca e exlaed as follows: Whe th s sall, we classfy a suscous stace whch has slghtly errat ehavor as a alcous stace. As a result, we ca detect all ossle alcous staces ad thus acheve a hgh detecto rate. However, at the sae te, t s ore lkely that the decso classfer ay classfy eg staces as alcous staces. Further, we ca oserve that the false ostve ad detecto rates decrease as th creases. Ths s ecause th reresets how coservatve a classfer s: As th creases, the classfer ecoes coservatve ad thus the false ostve rate decreases. Meawhle, t s ore lkely that a alcous stace caot e detected ecause the classfer s ot cofdet eough to declare the stace alcous. As a cosequece, the detecto rate decreases. Addtoally, slar results ca e also oserved for the DD dataset. Fg. 7 Syste erforace v.s. threshold. 405

8 Effcet Statstcs Based Fraework for Network Itruso Detecto DARA dataset s show Fg. 8. As we have dscussed Fg. 7, the erforace of threshold classfers chages as th chages. Therefore, the results of the threshold classfer the lot corresod to dfferet values of th. Addtoally, we also reset the result of the ave Bayes classfer the lot. As we ca oserve fro (6), the ave Bayes classfer does ot deed o ay cofgurale varale. Therefore, the result of the ave Bayes classfer cossts of oly a sgle ot, as we ca oserve fro the lot. Fally, otce that usg the roosed fraework, oth classfers ca acheve a hgh detecto rate, hgher tha 97%, whle keeg the false ostve rate as low as 0.03%. Fg. 8 ROC lot for the DARA dataset. Fg. 9 ROC lot for DD DoS dataset. D. DD CU Dataset The secod exeret volved the DD dataset. We cosder the followg three dfferet su datasets: ) DoS dataset: cludg etue, surf, teardro, lad, od, ack ad oral data. 2) Network dataset: addto to the aforeetoed DoS dataset, t adds the rog dataset, cludg swee, ortswee, sat, ad oral data. 3) Etre dataset: all attack categores ad oral data reseted the DD dataset. The results for DoS, etwork, ad etre datasets are show Fg. 9, 0, ad resectvely. We ca ake the followg terg oservatos. Frst, SID aga erfors very well all three datasets. I artcular, the threshold classfer ca acheve 99%, 94%, 90% detecto rate wth 0.06%, 0.3%, 0.48% false ostve rate for DoS, etwork, ad etre dataset resectvely. Further, as we ca oserve fro the lots, the ave Bayes classfer ca acheve a slghtly lower detecto rate ut a lower false ostve rate tha the threshold classfer for all three datasets. Ths les that the ave Bayes classfer s ore accurate tha the threshold classfer ut t catches less aoaly staces tha the threshold classfer. Ths oservato s a t of dfferet fro the oservato Fg. 8 where the ave Bayes classfer erfors slghtly etter tha the threshold classfer. Detaled dscusso for the erforace coarso etwee these two classfers wll e addressed the ext secto. Fg. 0 ROC lot for DD etwork dataset. Recever Oeratg Characterstc (ROC) lot s oe of the ost reresetatve lots used to study the relatosh etwee the false ostve rate ad the detecto rates. I a ROC lot, the X-axs reresets the false ostve rate ad the Y-axs deotes the detecto rate. Notce that a data ot the uer left corer corresods to etter erforace, aely a lower false ostve rate wth a hgher detecto rate, tha a ot the lower rght lace. The ROC lot for the Fg. ROC lot for the etre DD dataset. 406

9 Fg. 2 ROC lot for the real etwork dataset. E. Real Network Exeret The fal exeret s ased o real etwork dataset collected fro uversty caus. As etoed earler, several exerets are erfored ased o the collected dataset: we sale the dataset to a su-dataset ad the dvde the su-dataset to trag ad tg dataset. Although the results of the exerets are ot detcal, all of the are rosg. Fg. 2 shows reresetatve result of the exerets. I Fg. 2, the trag data s saled fro the frst half of the etre dataset ad the tg data s collected fro the secod half of the etre dataset. Aga, we ca oserve fro the lots that SID also erfors well o the dataset collected fro real etwork. Fally, we ca dscover that the erforace of SID o the real etwork dataset s slghtly worse tha the DARA ad DD datasets. Ths ca e exlaed as follows: recet advace etwork attacks has colcated the ehavor/atter/sgature of attacks. Sce SID s ased o ror kowledge ad statstcs to detect aoaly. The olyorhs ad colcated ehavor of advaced attacks degrade the erforace of SID o real etworks. F. Rearks Before we coclude, we hghlght soe terg rearks. Frst, as we have oserved fro Fg. 8-, the erforace of the ave Bayes classfers s slar to the otal erforace of the threshold classfers. Further, the erforace of threshold classfers deeds o how to coute the evaluato etrc ad how to setu the threshold. More ortat, there exsts o exlctly aswer to these two quos. I cotrast, the desg of ave Bayes classfer s ore straghtforward ad sler, deedet of other factors. It sees that the ave Bayes classfer s the favorte choce. However, threshold classfers ca e used to costruct ROC lot of a detecto syste to study syste sestvty. I addto, threshold classfers geeral are coutatoal sler tha ave Bayes classfers. As a result, choosg a roer classfer s a tradeoff etwee desg colexty ad coutato colexty. The exeretal results show that SID erfors very well for DARA, DD DoS, ad DD etwork datasets. But t suffers slghtly erforace degeerato for the DD etre Iteratoal Joural of Soft Coutg ad Egeerg (IJSCE) ISSN: , Volue-3, Issue-, March 203 dataset. Ths ca e exlaed as follows. Because the urose of ths work s to costruct a aoaly ased etwork truso detecto fraework for large etworks, we oly cosder sle features whch ca e easly extracted fro the otored etwork, e.g. rotocol ad servce. Sce the selected features ca characterze ad thus detfy the attacks covered the DoS ad etwork dataset, the erforace s as good as exected. However, the etre DD dataset cludes ore varat attacks, e.g. the R2L ad U2R, whch caot e fully characterzed y the selected features. Thus the erforace degrades. Nevertheless, as etoed earler, SID s so flexle that t ca e easly exteded to cororate other colcated features, e.g. statstcs a two secod wdow the DD dataset, to detect these aoaly actvtes. Fally, t s easy to see that SID ca e easly leeted. I artcular, as we ca oserve fro the roosed algorths, there s o colcated oerato ether the trag rocedure or the detecto rocedures. More ortat, SID ca ru a creetal ode as we ca coclude fro Secto III. The trag uckets ca e easly udated y cotuously keeg track of,,, ad corresodg roaltes whle the decso classfers use udated forato to detfy aoaly susects. Coared wth other colcated systes, e.g. SVM [3], ths sealess ole udate akes SID favorale, artcular for ackoe etworks. Tale 2 erforace coarso. Category Metrc SID DD SVM DoS Detecto Rate(%) False ostve Rate(%) N/A R2L Detecto Rate(%) False ostve Rate(%) N/A UD(7) Detecto Rate(%) False ostve Rate(%) N/A Tale 3 Colexty coarso. Category SID Geerc SVM SVM worst case Trag 2 f N N f f Detecto 2 S f fn S S f G. Coarso wth Other Fraeworks I Secto IV.B, we have show that SID ca effcetly detect our target attacks,.e. ausve ad osy oes. To further deostrate that SID s ale to ractcal deloyet, we coare SID wth two reresetatve ror work: the wg etry DD CU 99 [3], deoted y DD, ad the SVM fraework [3]. Tale 2 ad 3 show the coarso results ters of syste erforace ad algorth colexty resectvely. Frst, we ca oserve fro Tale 2 that SID outerfors the DD CU 99 wer etry all asects. The results sly ly SID erfors etter tha the wer etry of DD CU 99. Further, we ca oserve that SID ca atch the erforace of SVM excet a lower detecto rate the "R2L" category. Notce that, as etoed earler, a hgh detecto rate ca e acheved y sufferg a hgh false ostve rate. However, the false 407

10 Effcet Statstcs Based Fraework for Network Itruso Detecto ostve rate SVM s ot rovded [3] ad thus the results show Tale 2 does ot exlctly eas that SVM erfors etter tha SID the "R2L" category. More ortatly, as we ca oserve fro Tale 3, SID has lower colexty tha SVM oth trag ad detectg algorths. I Tale 3, we show the trag ad detectg (for oe stace) colexty of SID, geerc SVM, ad SVM worst case, where f deotes the uer of features selected, deotes the uer of etres the trag dataset, ad N s s the uer of suort vectors. The colexty of SID ca e oserved fro Fg. 2 ad 5 as well as () ad (6). The results of the colexty of SVM are cted fro [2]. We refer tered readers to t for the detaled dscusso. Notce that the worst case scearo, N s could e as large as ad ths s how the results the SVM worst case colu are derved. As we ca oserve fro the tale, the worst case, SVM s uch ore colex tha SID. Further, the detecto colexty deeds o the uer of etres of the trag dataset. (To ota good traed rofles, the uer of trag data geeral wll e too large to e gored.) Ths drawack also rohts the SVM fraework fro utlzg hardware accelerate sklls realzato such as ele ad suer scale (arallels). I cotrast wth SVM, SID does ot suffer fro ths role. Based o the aove coarso, t s easy to see that SID s ore ractcal tha SVM leetg detecto systes large scale etworks. V. CONCLUSIONS I ths aer we reset a effcet statstcs-ased ausve truso detecto fraework. SID cossts of a trag susyste ad a tg/detecto susyste. The trag susyste creates user rofles,.e. traed uckets, y trasforg ad aggregatg the feature felds. The detecto susyste develos two classfers, threshold ad ave Bayes, to detect aoaly staces. A seres of evaluatos have ee erfored o SID. The exeretal results show that SID ca effectvely detect etwork attacks. It ca acheve a accuracy of 97% wth a false ostve rate of 0.03% for the DARA 98 dataset, 99% detecto rate wth a 0.06% false ostve rate for DD DoS dataset, ad 89% detecto rate wth a 5% false ostve rate for real etwork. Coared wth covetoal sgature ased aroaches ad exstg aoaly ased detecto systes, t has a rosg hgh accuracy ad low false ostve rate wth a sle leetato. Sce SID oly sects soe flow features, t has a low detecto cost for large etworks,.e. ackoe etworks. [6] C. ruegel, D. Mutz, W. Roertso, F. Valeur, Bayesa Evet Classfcato for Itruso Detecto. roceedgs of the 9th Aual Couter Securty Alcatos Coferece, [7] R. utt Z. Marrakch L. Me, Bayesa Classfcato Model for Real-Te Itruso Detecto. roceedgs of 22d Iteratoal Worksho o Bayesa Iferece ad Maxu Etroy Methods Scece ad Egeerg, [8]. Garca-Teodoroa, J. Daz-Verdeoa, G. Maca-Feradeza, E. Vazquez, Aoaly-ased etwork truso detecto: Techques, systes ad challeges. Elsever Couters ad Securty, [9] A. Lakha, M. Crovella, C. Dot, Mg aoales usg traffc feature dstrutos. ACM SIGCOMM, [0] A. Cardeas, J.S. Baras,. Seao, A Fraework for the Evaluato of Itruso Detecto Systes. IEEE Syosu o Securty ad rvacy, [] S. Mukkaala, A.H. Sug, Idetfyg Sgfcat Features for Network Foresc Aalyss Usg Artfcal Itellget Techques. Itl. Joural of Dgtal Evdece, [2] G.F. Cretu, A. Stavrou, M.E. Locasto, S.J. Stolfo, Castg out Deos: Satzg Trag Data for Aoaly Sesors. I roceedgs of IEEE Syosu o Securty ad rvacy, [3] C.F. Tsa C.Y. L, A tragle area ased ear eghors aroach to truso detecto. atter Recogto, 200. [4] R. Golda, A Stochastc Model for Itrusos. roceedgs of Syosu o Recet Advaces Itruso Detecto, [5] C. ruegel, T. Toth, E. rda, Servce Secfc Aoaly Detecto for Network Itruso Detecto. roceedgs of Syosu o Aled Coutg, [6] A. Valdes,. Sker, Adatve, Model-ased Motorg for Cyer Attack Detecto. roceedgs of RAID, [7] C. Thoas, N. Balakrsha, Iroveet Itruso Detecto Wth Advaces Sesor Fuso. IEEE Trasactos o Iforato Forescs ad Securty, [8] C.M. Che, Y.L. Che, H.C. L, A Effcet Network Itruso Detecto. Couter Coucatos, 200. [9] R.S. Rtu, G. Neetesh,. Shv, To Reduce the False Alar Itruso Detecto Syste usg self Orgazg Ma, 20. [20] Z. Muda, W. Yass, M.N. Sulaa, N.I. Udzr, A -Meas ad Nave Bayes Learg Aroach for Better Itruso Detecto, 20. [2] J.C. Burges, A Tutoral o Suort Vector Maches for atter Recogto. Data Mg ad owledge Dscovery, 998. [22] H.S. Javts, A. Valdes, The NIDES statstcal cooet: Descrto ad ustfcato. SRI Iteratoal Couter Scece Laoratory, 993. [23] J. Hoaglad, SADE. Slca Defese, [24] Sort - lghtweght truso detecto for etworks, htt:// [25] Massachusetts Isttute of Techology Lcol Laoratory, 998 dara truso detecto evaluato dataset overvew, [26]. Thoas,. ostata, BLINC: Multlevel Traffc Classfcato the Dark. roceedgs of ACM SIGCOMM, [27] M. Crott M. Dus F. Grgol ad L. Salgarell: Traffc Classfcato through Sle Statstcal Fgerrtg. Couter Coucatos Revew, [28] DD99 CU dataset. htt://kdd.cs.uc.edu/dataases/ kddcu99/kddcu99.htl, [29] Iteret Assged Nuers Authorty (IANA), Assged Iteret rotocol Nuers, [30] TCDUM. htt:// [3] DD CU 999: Results. htt:// org/kddcu/dex.h?secto=999\&ethod=res, REFERENCES [] M. Mahoey,.. Cha, Learg Nostatoary Models of Noral Network Traffc for Detectg Novel Attacks. roceedgs of ACM SIGDD, [2] M. Mahoey, Network Traffc Aoaly Detecto Based o acket Bytes. roceedgs of ACM SAC, [3] S. Mukkaala, G. Jaosk A.H. Sug, Itruso Detecto Usg Neural Networks ad Suort Vector Maches. roceedgs of IEEE It'l Jot Cof. o Neural Networks, [4] F.V. Jese, Itroducto to Bayese etworks. UCL ress, 996. [5] A.A. Seyala, T. Oluke L. Sacks, Actve latfor Securty through Itruso Detecto Usg Nave Bayesa Network for Aoaly Detecto. Lodo Coucatos Syosu,