Testing CAB-IDS through Mutations: on the Identification of Network Scans

Transcription

1 Testng CAB-IDS through Mutatons: on the Identfcaton of Network Scans Emlo Corchado, Álvaro Herrero, José Manuel Sáz Department of Cvl Engneerng, Unversty of Burgos, Span {escorchado, ahcoso, Abstract. Ths study demonstrates the ablty of powerful vsualzaton tools (based on the use of connectonst models) to dentfy network ntruson attempts n an effectve and relable manner. It presents a novel technque to test and evaluate a prevously developed network-based ntruson detecton system (IDS). Ths technque apples mutant operators and s ntended to test IDSs usng numercal data sets. It should be made clear that some mutatons were dscarded as they dd not all provde real lfe stuatons. As an applcaton example of the proposed testng model, t has been specally appled to the dentfcaton of network scans and mutatons of these. The tested Connectonst Agent-Based IDS (CAB-IDS) s used as a method to nvestgate the traffc whch travels along the analysed network, detectng anomalous traffc patterns. The specfc tests performed n ths study were based on the mutaton of one or several varables analysed by CAB-IDS. 1 Introducton Intruson Detecton Systems (IDSs) are tools desgned to montor and analyse computer system or network events n order to detect suspect patterns that may relate to a network or system attack. An IDS that analyses packets travellng over an entre network s referred to as a network-based IDS. Vsualzaton technques are startng to be appled n the feld of IDSs [1], [2], [3], [4], [5], [6] and they are generally appled to numerc data. However, n the feld of Computer Securty, traffc data sets normally have a categorcal and/or textual nature and ther converson nto a data type to whch vsualzaton technques (such as scatter plot or proectonst models) may be appled s not always obvous. Prevous attempts are presented n [1], [4], [5], [6]. IDS evaluaton s not a clear cut task [7]. Prevous works have presented several technques to test and evaluate msuse detecton models for network-based IDSs. Some of these technques were based [8] on a mechansm that generates a large number of varatons on a known explot by applyng mutant operators to ts template. In ths study, a method s proposed to apply such a mutaton technque for vsualzaton technques usng numercal data sets. In ths case, the method s used to analyse the response of CAB-IDS (Connectonst Agent-Based IDS) [4], [5], [6] n the detecton of a network scan. The ablty to detect such scans can help to dentfy wder and potentally more dangerous threats to a

2 network. The man advantage of ths testng model s that t allows analyss of IDSs based on numercal data sets. A port scan may be defned as seres of messages sent to dfferent port numbers to gan nformaton on ts actvty status. These messages can be sent by an external agent attemptng to access a host to fnd out more about the network servces ths host s provdng. A port scan provdes nformaton on where to probe for weaknesses, for whch reason scannng generally precedes any further ntrusve actvty. Ths work focuses on the dentfcaton of network scans, n whch the same port s the target for a number of computers. A network scan s one of the most common technques used to dentfy servces that mght then be accessed wthout permsson [3]. The prncpal research nterest and novelty of ths work les n the development of a testng method. The man goal of ths method s to prove the effectveness and capablty of any IDS based on numercal data to confront unknown attacks. In ths partcular study t has been used to test CAB-IDS. 2 CAB-IDS CAB-IDS (Connectonst Agent-Based Intruson Detecton System) s a tool that has prevously been descrbed [4], [5] and can be defned as an IDS formed of dfferent software agents [9] that work n unson [6] n order to detect anomalous stuatons by takng full advantage of an unsupervsed connectonst model. To detect anomalous stuatons, CAB-IDS conssts of dfferent knds of agents: Snffer Agent (S-A): ths type of agent "controls" each segment (n whch the network s dvded). IDS Agent (IDS-A): there s only one agent of ths knd, whch s n charge of processng the nformaton sent by S-As and alertng the network admnstrator. The dfferent functons performed by these agents are: 1 st step.- Network Traffc Capture: captures packets travellng over the network segments where S-As are located. 2 nd step.- Data Pre-processng: the captured data s selected, pre-processed and sent to the IDS-A. A set of packets and features contaned n the headers of the captured data s selected from the raw network traffc. 3 rd step.- Data Analyss: once the IDS-A receves the pre-processed data, a connectonst model (see Sect. 2.1) s appled to analyse the data and dentfy anomalous patterns. 4 th step.- Vsualzaton: the proectons are presented to the network admnstrator. 2.1 The Unsupervsed Connectonst Model The data analyss task performed by the IDS-A s based on the use of a neural Exploratory Proecton Pursut (EPP) [10], [11] model called Cooperatve Maxmum Lkelhood Hebban Learnng (CMLHL) [12], [13], [14]. It was ntally appled n the feld of Artfcal Vson [12], [13] to dentfy local flters n space and tme. In CAB-

3 IDS t s appled n the feld of Computer Network Securty. CMLHL s based on Maxmum Lkelhood Hebban Learnng (MLHL) [15], [16] addng lateral connectons [12], [13] whch have been derved from the Rectfed Gaussan Dstrbuton [17]. The resultant net can fnd the ndependent factors of a data set but does so n a way that captures some type of global orderng n the data set. Consderng an N-dmensonal nput vector ( x ), an M-dmensonal output vector ( y ) and wth W beng the weght (lnkng nput to output ), CMLHL can be expressed [12], [13], [14] as: 1. Feed-forward step: 2. Lateral actvaton passng: 3. Feedback step: 4. Weght change: y y N = W = 1 x,. ( t + ) = [ y (t) + τ( b Ay) ] + 1. (2) e = x M = 1 W y,. p 1 ( e ) e ΔW = η. y. sgn. (4) Where: η s the learnng rate, τ s the "strength" of the lateral connectons, b p a parameter related to the energy functon [13], [15], [16] and A bas parameter, symmetrc matrx used to modfy the response to the data. The effect of ths matrx s based on the relaton between the dstances among the output neurons. (1) (3) the a 3 A Mutaton Testng Model for Numercal Data Sets Testng an IDS tool s the only way to establsh ts effectveness. In order to test CAB-IDS, t was decded to measure ts results confrontng unknown anomalous stuatons. Furthermore, t was decded to compare t alongsde other models such as Prncpal Component Analyss (PCA) [18] or MLHL [10], [11] as no other IDS, as far as the authors are aware, shares smlar characterstcs. It s notceable that few unsupervsed methods have been appled to the feld of IDSs. Examples nclude PCA [1], EPP [4], [5] and Self-Organzng Maps (SOM) [19], [20]. Proectonst models such as PCA, EPP, MLHL or CMLHL have one mportant advantage over SOM n the feld of computer network securty n that they use tme as a key varable when analysng the evoluton of the packets n the traffc data set. Msuse IDSs based on sgnatures rely on models of known attacks. The effectveness of these IDSs depends on the "goodness" of ther models. Ths s to say, f a model of an attack does not cover all the possble modfcatons, the performance of the IDS wll be greatly mpared.

4 Our mutaton testng model s nspred by prevous testng models [8], [21], but ths s the frst one for IDSs based on numercal data sets. In general, a mutaton can be defned as a random change. In keepng wth ths dea, the testng model modfes dfferent features of the numercal nformaton extracted from the packet headers. The modfcatons created by ths model may nvolve changes n aspects such as: attack length (amount of tme that each attack lasts), packet densty (number of packets per tme unt), attack densty (number of attacks per tme unt) and tme ntervals between attacks. The mutatons can also concern both source and destnaton ports, varyng between the dfferent three ranges of TCP/UDP port numbers: well known (from 0 to 1023), regstered (from 1024 to 49151) and dynamc and/or prvate (from to 65535). Tme s another fascnatng ssue of great mportance when consderng ntrusons snce the chance of detectng an attack ncreases n relaton to the duraton of t. There are therefore two man strateges: Drastcally reduce the tme used to perform a scan. Spread the packets out over tme, whch s to say, reduce the number of packets sent per tme unt that are lkely to slp by unnotced. It should be taken nto account and wll be explaned further on that any of the possble mutatons may be meanngless such as a sweep of less than 5 hosts n the case of a network scan. Several tests have been desgned to verfy the performance of CAB-IDS. Each test s related to a data set obtaned by mutatng the orgnal one (see Sect. 4). Changes were made to the traffc related to the sweeps to take the followng ponts nto account: Number of sweeps n the scan (that s, number of scanned ports). Destnaton port numbers at whch sweeps are amed. Tme ntervals when sweeps are performed. Number of packets (densty) formng the sweeps (number of scanned hosts). Takng these ssues nto account, the collecton of data sets desgned for the research (see Sect. 4) covers the maorty of the dfferent scan-related stuatons wth whch a network mght be confronted. Despte the fact that ths technque s unable to provde a formal evaluaton, t represents n our opnon a good approxmaton. 4 Data Sets and Tests It was prevously ndcated that the proposed CAB-IDS [4], [5], [6] s able to dentfy a network scan contaned n a data set wth the followng attrbutes: Three dfferent sweeps to several hosts. Each sweep amed at port numbers 161, 162 and A tme dfference between the frst and the last packet ncluded n each sweep of ms for port number 161, ms for port number 162 and ms for port number An MIB (Management Informaton Base) nformaton transfer event. Ths anomalous stuaton and ts potental rsks are fully descrbed n [4], [5].

5 As prevously explaned, several testng data sets contanng the followng key features were presented to CAB-IDS followng ther mutaton n order to measure the performance of CAB-IDS: Case 1 (modfyng both the amount of sweeps and the destnaton ports): Data set 1.- only one sweep: port Data set 2.- two sweeps: ports 161 and 162. Data set 3.- only one sweep: port Data set 4.- two sweeps: ports 4427 and Case 2 (modfyng both tme and the number of sweeps): Data set 5.- three tme-expanded sweeps: ports 161, 162 and Data set 6.- three tme-contracted sweeps: ports 161, 162 and Data set 7.- one tme-expanded sweep: port Case 3 (modfyng both the amount of packets and the destnaton ports): Data set 8.- two 5-packet sweeps: ports 4427 and Data set 9.- two 30-packet sweeps: ports 1434 and The frst ssue to consder s the amount of sweeps n the scan. Data sets contanng 1 sweep (Data sets 1, 3 and 7), 2 sweeps (Data sets 2, 4, 8 and 9) or 3 sweeps (Data sets 5 and 6) have been used. Each sweep s amed at a dfferent port number. The mplcatons are crystal clear; hackers can check the vulnerablty of as many servces/protocols as they want. The number of sweeps (rangng from 1 to ) can be modfed from one scan to another. A scan attemptng to check port protocol/servce can be amed at any port number (from 0 to 65535). The data sets contan sweeps amed at port numbers such as 161 and 162 (well known ports assgned to Smple Network Management Protocol), 1434 (regstered port assgned to Mcrosoft-SQL-Montor, the target of the W32.SQLExp.Worm), 3750 (regstered port assgned to CBOS/IP ncapsalaton), 4427 and 4439 (regstered ports, as yet unassgned) and (dynamc or prvate port). In order to check our system n relaton to the tme-related strateges, data sets 5, 6 and 7 were used. Data set 5 was obtaned by spreadng the packets contaned n the three dfferent sweeps (161, 162 and 3750) over the captured sesson. In ths data set, there s a tme dfference of ms between the frst (n the sweep amed at port 161) and the last scan packet (n the sweep amed at port 3750). The duraton of the captured sesson (all the packets contaned n the data set) s ms, whereas n the orgnal data set the scan lasts ms. In the case of data set 7, the same mutaton has been performed but only for packets relatng to the sweep amed at port On the other hand, the strategy of reducng the tme was used to obtan data set 6. In ths case, the tme dfference between the frst and the last packet s about ms. Fnally, the number of packets contaned n each sweep was also consdered. In the case of a network scan, each packet means a dfferent host ncluded n the scan. Data sets 8 and 9 were desgned wth ths ssue n mnd. Data set 8 contans low-densty sweeps gven that they have been reduced to only 5 packets. It was decded that a sweep scannng less than 5 hosts should not consttute a network scan. Ths s a fuzzy lower lmt because t could also be set as 4 or 6 packets. On the other hand, data set 9 contans medum-densty sweeps. In ths case, each one of them has been extended to 30 packets. Ths s also a fuzzy upper lmt.

6 Apart from dentfyng the mutated sweeps, the detecton of the MIB nformaton transfer contaned n all the data sets also represented a serous test for the performance of CAB-IDS. The expermental results obtaned for these data sets are shown n the followng secton. 5 Results and Comparson All the results were obtaned by tranng the connectonst model for each new data set. The applcaton of our model to the dfferent scenaros (see Sect. 4) led to the results that are shown n Fgs.1 to 6. Only fgures for the most representatve cases are presented. Through these fgures, t may be seen how CAB-IDS s able to dentfy the dfferent mutated anomalous stuatons, even though some are dentfed wth greater clarty than others. Apart from traffc related to the scan, these fgures also show packets nterrelated wth the rest of the traffc. Stuatons are labelled anomalous whenever they tend not to resemble parallel and smooth drectons (normal stuatons). In Fg. 1 two anomalous stuatons are hghlghted (MIB nformaton transfer and the network scan), both dentfed by CMLHL. As prevously explaned n [4], [5], [6], those stuatons are dentfed by CMLHL as anomalous by takng account of such aspects as traffc densty or "anomalous" traffc drectons. Consderable experence s requred to dentfy the sweep n the case of the proecton for data set 7 (Fg. 2). Conversely, the other anomalous stuaton (the MIB nformaton transfer) s dentfed wth far greater clarty than n any of the other cases. Fg. 1. CMLHL proecton for data set 5 Fg. 2. CMLHL proecton for data set 7 When sweeps contan only 5 packets (Data set 8 Fg. 3), an expert s once agan requred to dentfy the anomalous scan stuatons. On the other hand, CAB-IDS very clearly detects hgh-densty sweeps (Fg. 4).

7 Fg. 3. CMLHL proecton for data set 8 Fg. 4. CMLHL proecton for data set 9 For comparson purposes, we have also appled PCA to the prevous mutated data. As t can be seen n Fg. 5, the best PCA proecton (Factor par 1-3) s capable of dentfyng the 3-sweep scan but t s not capable of dentfyng the MIB nformaton transfer. The proecton of the two frst prncpal components (Factor par 1-2) obtaned by applyng PCA s unable to detect these anomalous stuatons. On the other hand, Fg. 6 shows how CMLHL s capable of dentfyng both stuatons. Fg. 5. PCA proecton for data set 6 Fg. 6. CMLHL proecton for data set 6 6 Conclusons and Future Work Ths paper has ntroduced a novel mutaton testng model for IDSs orented to analyse numercal traffc data sets. It was used to test CAB-IDS and demonstrate ts ablty to dentfy most of the anomalous stuatons t confronted. The dentfcaton of these mutated scans can, n broad terms, be explaned by the generalzaton capablty of the connectonst model appled n ths work. That s to say, through the use of one of these models, the IDS s capable of dentfyng not only the real anomalous stuatons contaned n the data sets (known) but also the mutated (unknown) ones whch may be real. Ths generalzaton capablty of CAB-IDS represents ts man advantage over the maorty of sgnature-based IDSs. Future work wll be based on the applcaton of new learnng rules to mprove CMLHL.

8 Acknowledgments Ths research has been supported by the MCyT proect TIN and the proect BU008B05 of the JCyL. References 1. Goldrng, T.: Scatter (and Other) Plots for Vsualzng User Proflng Data and Network Traffc. ACM Workshop on Vsualzaton and Data Mnng for Computer Securty (2004) Muelder, Ch., Ma, K-L., Bartolett: Interactve Vsualzaton for Network and Port Scan Detecton. 8th Internatonal Symposum on Recent Advances n Intruson Detecton (RAID). Lecture Notes n Computer Scence, Vol Sprnger-Verlag, Berln Hedelberg New York (2005) Abdullah, K., Lee, Ch., Cont, G., Copeland, J.A.: Vsualzng Network Data for Intruson Detecton. IEEE Workshop on Informaton Assurance and Securty (2002) Herrero, A., Corchado, E., Sáz, J.M.: Identfcaton of Anomalous SNMP Stuatons Usng a Cooperatve Connectonst Exploratory Proecton Pursut Model. Internatonal Conference on Intellgent Data Engneerng and Automated Learnng (IDEAL). Lecture Notes n Computer Scence, Vol Sprnger-Verlag, Berln Hedelberg New York (2005) Corchado, E., Herrero, A., Sáz J.M.: Detectng Compounded Anomalous SNMP Stuatons Usng Unsupervsed Pattern Recognton. Internatonal Conference on Artfcal Neural Networks (ICANN). Lecture Notes n Computer Scence, Vol Sprnger-Verlag, Berln Hedelberg New York (2005) Corchado, E., Herrero, A., Sáz, J.M.: A Feature Selecton Agent-Based IDS. Frst European Symposum on Nature-Inspred Smart Informaton Systems (2005) 7. Ranum, M.J.: Experences Benchmarkng Intruson Detecton Systems. NFR Securty (2001) 8. Vgna, G., Robertson, W., Balzarott, D.: Testng Network-Based Intruson Detecton Sgnatures Usng Mutant Explots. ACM Conference on Computer and Communcaton Securty (ACM CCS) (2004) Wooldrdge, M.: Multagent Systems: A Modern Approach to Dstrbuted Artfcal Intellgence, Gerhard Wess (1999) 10.Fredman J., Tukey. J.: A Proecton Pursut Algorthm for Exploratory Data Analyss. IEEE Transacton on Computers, Vol. 23 (1974) Hyvärnen A.: Complexty Pursut: Separatng Interestng Components from Tme Seres. Neural Computaton, Vol. 13(4) (2001) Corchado, E., Han, Y., Fyfe, C.: Structurng Global Responses of Local Flters Usng Lateral Connectons. Journal of Expermental and Theoretcal Artfcal Intellgence, Vol. 15(4) (2003) Corchado, E., Fyfe, C.: Connectonst Technques for the Identfcaton and Suppresson of Interferng Underlyng Factors. Internatonal Journal of Pattern Recognton and Artfcal Intellgence, Vol. 17(8) (2003) Corchado, E., Corchado, J.M., Sáz, L., Lara, A.: Constructng a Global and Integral Model of Busness Management Usng a CBR System. Frst Internatonal Conference on Cooperatve Desgn, Vsualzaton and Engneerng (CDVE). Lecture Notes n Computer Scence, Vol Sprnger-Verlag, Berln Hedelberg New York (2004) Corchado, E., MacDonald, D., Fyfe, C.: Maxmum and Mnmum Lkelhood Hebban Learnng for Exploratory Proecton Pursut. Data Mnng and Knowledge Dscovery, Vol. 8(3), Kluwer Academc Publshng (2004) Fyfe, C., Corchado, E.: Maxmum Lkelhood Hebban Rules. European Symposum on Artfcal Neural Networks (2002) Seung, H.S., Socc, N.D., Lee, D.: The Rectfed Gaussan Dstrbuton. Advances n Neural Informaton Processng Systems, Vol. 10 (1998) Oa, E.: Neural Networks, Prncpal Components and Subspaces. Internatonal Journal of Neural Systems, Vol. 1 (1989) Hätönen, K., Höglund, A., Sorvar, A.: A Computer Host-Based User Anomaly Detecton System Usng the Self-Organzng Map. Internatonal Jont Conference of Neural Networks (2000) Zanero, S., Savares, S.M.: Unsupervsed Learnng Technques for an Intruson Detecton System. ACM Symposum on Appled Computng (2004) Marty, R.: Thor: A Tool to Test Intruson Detecton Systems by Varatons of Attacks. ETH Zurch. Dploma Thess (2002)