Packet Anomaly Intrusion Detection PAID Constantine Manikopoulos and Zheng Zhang New Jersey Center for Wireless Networking and Security (NJWINS) at NJIT George Mason University September 24-26, 2003

The HIDE/PAID Project NJWINS – US Army SBIR Phase II Research and Development Effort Prototype and Evaluate an Intrusion Detection System for the Tactical Internet of the Digital Battlefield

System Architecture Components –Probe –Event preprocessor –NN classifier –Post processor

System Architecture

Multi-layer Detection

PDF Representation Binned PDF Representation S be the sample space of a random variable events E 1­, E 2,…, E k a mutually exclusive partition of S P i is the expected probability of the occurrence of the event E i P i ’ be the frequency of the occurrence of E i during a given time interval

Similarity Measuring Algorithms  2 -like test. Kolmogorov-Smirnov test. Anderson-Darling’s statistic. Kupier’s statistic. Others.

Similarity Measuring Algorithms p i is the expected probability of event E i. P i ’ is the observed probability of event E i during a time interval. f(N) is a function that takes into account the total number of occurrences during a time window.

Reference Model Updating Reference Model Updating Algorithm p old is the reference model before updating P new is the reference model after updating  is a programmable predefined adaptation rate s is a learning rate determined by the outputs of the neural network

HIDE/PAID: User Interface

Two-Dimensional Scatter Plots

Two-dimensional Scatter Plots

Sample Visualization Normal Attack traffic

Data Description DARPA’98 Intrusion Detection Evaluation Data Set –Seven weeks of training data –Two weeks of testing data (not used because the attack truth is not available) –Categories of the simulated attacks: DOS, Probe, R2L, U2R

System Configuration Only Non-stealthy DOS attacks are tested: –Neptune (SYN flooding), –Pod (Ping-of-Death), –Smurf (ICMP flooding), –Teardrop (Pathetic IP Fragmentation) PDF Observation Time Window: 30s. Classifier: Backpropagation with 4 hidden neurons

Detection Results on y98w1d3 # of Samples1970 # of Attacks2 # of True Positives2 # of True Negatives1968 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w3d4 # of Samples2520 # of Attacks104 # of True Positives104 # of True Negatives2416 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w4d2 # of Samples1769 # of Attacks15 # of True Positives14 # of True Negatives1742 # of False Positives12 # of False Negatives1 # of Misclassifications13

Detection Results on y98w4d3 # of Samples1649 # of Attacks2 # of True Positives2 # of True Negatives1647 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w5d1 # of Samples926 # of Attacks64 # of True Positives64 # of True Negatives862 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w5d2 # of Samples2335 # of Attacks3 # of True Positives3 # of True Negatives2332 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w5d4 # of Samples519 # of Attacks176 # of True Positives171 # of True Negatives343 # of False Positives0 # of False Negatives5 # of Misclassifications5

Detection Results on y98w5d5 # of Samples2315 # of Attacks108 # of True Positives108 # of True Negatives2207 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w6d1 # of Samples4911 # of Attacks11 # of True Positives11 # of True Negatives4885 # of False Positives15 # of False Negatives0 # of Misclassifications15

Detection Results on y98w6d2 # of Samples2438 # of Attacks1 # of True Positives1 # of True Negatives2437 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w6d3 # of Samples2504 # of Attacks107 # of True Positives107 # of True Negatives2397 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w6d4 # of Samples1202 # of Attacks284 # of True Positives284 # of True Negatives912 # of False Positives6 # of False Negatives0 # of Misclassifications6

Detection Results on y98w6d5 # of Samples1297 # of Attacks54 # of True Positives53 # of True Negatives1242 # of False Positives1 # of False Negatives0 # of Misclassifications1

Detection Results on y98w7d2 # of Samples2438 # of Attacks1 # of True Positives1 # of True Negatives2437 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w7d3 # of Samples1897 # of Attacks1 # of True Positives0 # of True Negatives1895 # of False Positives1 # of False Negatives1 # of Misclassifications2

Detection Results on y98w7d4 # of Samples5154 # of Attacks4 # of True Positives4 # of True Negatives5150 # of False Positives0 # of False Negatives0 # of Misclassifications0

Detection Results on y98w7d5 # of Samples1369 # of Attacks119 # of True Positives111 # of True Negatives1250 # of False Positives0 # of False Negatives8 # of Misclassifications8

Summary (1) Total # of Samples39015 Total # of Attacks1060 Total # of Misclassifications50 Total # of False Positives35 Total # of False Negatives15 Misclassification Rate0.128% False Positive Rate0.0898% False Negative Rate1.42%

Summary (2) Attack# of Samples# of False Negatives False Negative Rate Neptune % Pod2400 Smurf26600 Teardrop9222.2%