This paper presents a taxonomy of intrusion detection systems that is then used to survey and classify a number of research prototypes The taxonomy consists of a classification first of the detection principle, and second of certain operational aspects of the intrusion detection system as such The systems are also grouped according to the increasing difficulty of the problem they attempt to address These classifications are used predictively, pointing towards a number of areas of future research in the field of intrusion detection

/pdf/intrusion-detection-systems-a-survey-and-taxonomy-11rzpm9dz3.pdf

Intrusion Detection Systems: A Survey and Taxonomy

This paper presents a brief survey of current research in intrusion detection for wireless ad-hoc networks. In addition to examining the challenges of providing intrusion detection in this environment, this paper reviews current efforts to detect attacks against the ad-hoc routing infrastructure, as well as detecting attacks directed against the mobile nodes. This paper also examines the intrusion detection architectures that may be deployed for different wireless ad-hoc network infrastructures, as well as proposed methods of intrusion response.

Challenges in intrusion detection for wireless ad-hoc networks

This paper presents the first wide-scale study of correlated attacks, i.e., attacks mounted by the same source IP against different networks. Using a large dataset from 1700 intrusion detection systems (IDSs), we show that correlated attacks are prevalent in the current Internet; 20% of all offending sources mount correlated attacks and they account for more than 40% of all the IDS alerts in our logs. We also reveal important characteristics of these attacks. Correlated attacks appear at different networks within a few minutes of each other, indicating the difficulty of warding off these attacks by occasional offline exchange of lists of malicious IP addresses. Furthermore, correlated attacks are highly targeted. The 1700 IDSs can be divided into small groups with 4-6 members that do not change with time; IDSs in the same group experience a large number of correlated attacks, while IDSs in different groups see almost no correlated attacks. Our results have important implications on collaborative intrusion detection of common attackers. They show that collaborating IDSs need to exchange alert information in realtime. Further, exchanging alerts among the few fixed IDSs in the same correlation group achieves almost the same benefits as collaborating with all IDSs, while dramatically reducing the overhead.

http://nms.lcs.mit.edu/~sachin/papers/caceimc.pdf

Collaborating against common enemies

As the frequency of attacks faced by the average host connected to the Internet increases, reliance on manual intervention for response is decreasingly tenable. Operating system and application based mechanisms for automated response are increasingly needed. Existing solutions have either been customized to specific attacks, such as disabling an account after a number of authentication failures, or utilize harsh measures, such as shutting the system down. In contrast, we present a framework for systematic fine grained response that is achieved by dynamically controlling the host's exposure to perceived threats. This paper introduces a formal model to characterize the risk faced by a host. It also describes how the risk can be managed in real-time by adapting the exposure. This is achieved by modifying the access control subsystem to let the choice of whether to grant a permission be delegated to code that is customized to the specific right. The code can then use the runtime context to make a more informed choice, thereby tightening access to a resource when a threat is detected. The running time can be constrained to provide performance guarantees. The framework was implemented by modifying the Java Runtime. A suite of vulnerable Jigsaw servlets and corresponding attacks was created. The following were manually added: code for dynamic permission checks; estimates of the reduction in exposure associated with each check; the frequencies with which individual permissions occurred in a typical workload; a global risk tolerance. The resulting platform disrupted the attacks by denying the permissions needed for their completion.

RheoStat: Real-time risk management

As the frequency of attacks faced by the average host connected to the Internet increases, reliance on manual intervention for response is decreasingly tenable. Operating system and application based mechanisms for automated response are increasingly needed. Existing solutions have either been customized to specific attacks, such as disabling an account after a number of authentication failures, or utilize harsh measures, such as shutting the system down. In contrast, we present a framework for systematic fine grained response that is achieved by dynamically controlling the host’s exposure to perceived threats.

/pdf/rheostat-real-time-risk-management-4g6nxs7lo4.pdf

Vdo Pooch

Papers

Refereed paper: Cooperating security managers: Distributed intrusion detection systems