A method for protecting a network from an attack includes measuring a property of traffic entering the network, and analyzing the property using at least one fuzzy logic algorithm in order to detect the attack.

Dynamic network protection

In recent years, the use of mobile ad hoc networks (MANETs) has been widespread in many applications, including some mission critical applications, and as such security has become one of the major concerns in MANETs. Due to some unique characteristics of MANETs, prevention methods alone are not sufficient to make them secure; therefore, detection should be added as another defense before an attacker can breach the system. In general, the intrusion detection techniques for traditional wireless networks are not well suited for MANETs. In this paper, we classify the architectures for intrusion detection systems (IDS) that have been introduced for MANETs. Current IDS ’s corresponding to those architectures are also reviewed and compared. We then provide some directions for future research.

/pdf/a-survey-on-intrusion-detection-in-mobile-ad-hoc-networks-4koz271abm.pdf

A Survey on Intrusion Detection in Mobile Ad Hoc Networks

An analytical virtual machine (AVM) analyzes computer code using a software processor including a register that stores behavior flags indicative of behaviors identified by virtually executing the code within the virtual machine. The AVM includes a sequencer that stores the sequence in which behavior flags are set in the behavior flags register. The AVM analyzes machine performance by emulating execution of the code being analyzed on a fully virtual machine and records the observed behavior. When emulation and analysis are complete, the AVM returns the behavior flags register and sequencer to the real machine and terminates.

Analytical virtual machine

Intrusion detection complements prevention mechanisms, such as firewalls, cryptography, and authentication, to capture intrusions into an information system while they are acting on the information system. Our study investigates a multivariate quality control technique to detect intrusions by building a long-term profile of normal activities in information systems (norm profile) and using the norm profile to detect anomalies. The multivariate quality control technique is based on Hotelling's T/sup 2/ test that detects both counterrelationship anomalies and mean-shift anomalies. The performance of the Hotelling's T/sup 2/ test is examined on two sets of computer audit data: a small data set and a large multiday data set. Both data sets contain sessions of normal and intrusive activities. For the small data set, the Hotelling's T/sup 2/ test signals all the intrusion sessions and produces no false alarms for the normal sessions. For the large data set, the Hotelling's T/sup 2/ test signals 92 percent of the intrusion sessions while producing no false alarms for the normal sessions. The performance of the Hotelling's T/sup 2/ test is also compared with the performance of a more scalable multivariate technique-a chi-squared distance test.

/pdf/multivariate-statistical-analysis-of-audit-trails-for-host-4puz31h4mm.pdf

Multivariate statistical analysis of audit trails for host-based intrusion detection

Forcing all IP packets to carry correct source addresses can greatly help network security, attack tracing, and network problem debugging. However, due to asymmetries in today's Internet routing, routers do not have readily available information to verify the correctness of the source address for each incoming packet. In this paper we describe a new protocol, named SAVE, that can provide routers with the information needed for source address validation. SAVE messages propagate valid source address information from the source location to all destinations, allowing each router along the way to build an incoming table that associates each incoming interface of the router with a set of valid source address blocks. This paper presents the protocol design and evaluates its correctness and performance by simulation experiments. The paper also discusses the issues of protocol security, the effectiveness of partial SAVE deployment, and the handling of unconventional forms of network routing, such as mobile IP and tunneling.

/pdf/save-source-address-validity-enforcement-protocol-1v0g0jgvcl.pdf

SAVE: source address validity enforcement protocol

This paper presents the design, implementation, and experimentation of the JiNao intrusion detection system (IDS) which focuses on the protection of the network routing infrastructure. We used the open shortest path first (OSPF) routing protocol as an implementation example to illustrate our IDS design. However, the system architecture is generic enough that the JiNao IDS can be used for protecting other protocols. The system features attack prevention and intrusion detection with tightly integrated network management components. The prevention module functions like a firewall which consists of a small set of rules. Both misuse (protocol analysis) and anomaly (statistical based) approaches are implemented as detection mechanisms in order to handle both known and unknown attacks. Four OSPF attacks (i.e., MaxSeq, MaxAge, Seq++, and LSID attacks) have been developed for evaluating JiNao's detecting capability. Furthermore, an SNMP based network management interface has been designed and implemented such that the JiNao IDS can be easily integrated with existing network management systems.

Design and implementation of a scalable intrusion detection system for the protection of network infrastructure

A real-time knowledge-based network intrusion-detection model for a link-state routing protocol is presented for the OSPF protocol. This model includes three layers: a data process layer to parse packets and dispatch data; and event abstractor to abstract predefined real-time events for the link-state routing protocol; and an extended timed finite state machine to express the real-time behavior of the protocol engine and to detect intrusions by pattern matching. The timed FSM, called the JiNao Finite State Machine (JFSM) is extended from the conventional FSM with timed states, multiple timers, and time constraints on state transitions. The JFSM is implemented as a generator that can create and FSM by constructing the configuration file only. The results show that this approach is very effective for detecting real-time intrusions. Our approach can be extended for use in other network protocol intrusion-detection systems, especially for those with known attacks.

/pdf/real-time-protocol-analysis-for-detecting-link-state-routing-210dxhgjey.pdf

Real-time protocol analysis for detecting link-state routing protocol attacks

DECIDUOUS is a security management framework for identifying the sources of network-based intrusions. The first key concept in DECIDUOUS is dynamic security associations, which efficiently and collectively provide location information for attack sources. DECIDUOUS is built on top of the IETF's IPSEC/ISAKMP infrastructure, and it does not introduce any new network protocol for source identification in a single administrative domain. It defines a collaborative protocol for inter-domain attack source identification. The second key concept in DECIDUOUS is the management information integration of the intrusion detection system (IDS) and attack source identification system (ASIS) across different protocol layers. For example, in DECIDUOUS, it is possible for a network-layer security control protocol (e.g., IPSEC) to collaborate with an application-layer intrusion detection system module (e.g., IDS for the SNMP engine). In this paper, we present the motivations, design, and prototype implementation of the DECIDUOUS framework.

DECIDUOUS: decentralized source identification for network-based intrusions

DECIDUOUS is a security management framework for identifying the "true" sources of network-based intrusions. As in IPv4, normally the source IP address field of an IP packet is untrusted. Therefore, DECIDUOUS utilizes the IPSec security associations as "trapdoors" to derive possible network paths that an attack packet has traveled to reach the target victim. In (Chang et al., 1999), we illustrated the architecture and design of the DECIDUOUS framework. In this paper, we describe our prototype implementation and experimental results.

Design and implementation of a real-time decentralized source identification system for untrusted IP packets

A method and system of assigning paths through an interconnection network ( 100 ) consisting of a plurality of switching elements ( 102:165 ) and a plurality of links coupling the switching elements ( 102:165 ) are provided. Physical restrictions of the interconnection network ( 100 ) are used to arrive at a logical representation of an architecture of the interconnection network ( 100 ). Traffic patterns of the interconnection network ( 100 ) are determined to balance the data traffic through the links coupling the switching elements ( 102:165 ). The logical representation and traffic patterns of the interconnection network ( 100 ) are used to setup virtual channel identifiers that determine paths through the switching elements and links so that data traffic is more evenly distributed through the interconnection network ( 100 ).

Ho-Yen Chang

Papers

Design and implementation of a scalable intrusion detection system for the protection of network infrastructure

Real-time protocol analysis for detecting link-state routing protocol attacks

DECIDUOUS: decentralized source identification for network-based intrusions

Design and implementation of a real-time decentralized source identification system for untrusted IP packets

Methods and system of virtual circuit identification based on bit permutation of link numbers for multi-stage elements