Intrusion and Anomaly Detection in Network Traffic Streams: Checking and Machine Learning Approaches ONR MURI area: High Confidence Real-Time Misuse and Anomaly Detection Sampath KannanWenke Lee Insup LeeDiana Spears Oleg SokolskyWilliam Spears Linda Zhao

Misuse & Anomaly Misuse: Unauthorized behavior specified by known message patterns called signatures. Anomaly: Large deviations from specified or statistical expected behavior.

Our Goals Stronger misuse detection and misuse prediction. Combining statistical and specification-based anomaly detection. Space and time-efficient algorithms to process large streams of traffic. A systems architecture to incorporate and facilitate our approaches (other poster).

Misuse Detection The most significant open problem in misuse detection: False negatives, i.e., errors of omission Our MURI objectives: Learn models of intruders and also of legitimate users Apply the models for misuse detection Use the models to predict future intruder behavior

Misuse Detection: Approach 1 Model network traffic with Hidden Markov Models (HMMs) From interleaved sequences of observations, infer the parameters of individual Markov chains in order to model several users If there is an intruder, one of the Markov chains will capture his/her behavior Challenges: Minimizing complexity and data needed Use of prior knowledge

Misuse Detection: Approach 2 Apply Case-Based Reasoning (CBR) to maximize the flexibility for matching the model to the observations, thereby reducing errors of omission CBR will consist of: Maintaining a library of prior attack signatures and other background knowledge Flexible matching of signatures to detect new intrusions Prediction of future intrusion behavior Learning and storing new signatures in the library

Misuse Detection: Evaluation Will test the hypothesis that combined application of our two approaches results in fewer errors of omission than the leading alternative approaches

Anomaly Detection Two main approaches Specification-based Detect events that directly violate specifications of normal operations Statistics-based Use normal profiles to detect anomalous events that are statistical and temporal in nature Need both

Specification- Based Detection Specification-based detection Normal events can be modeled, e.g., as extended finite state machines (EFSMs) An intrusion detection system (IDS) checks events against specification detects violation, e.g., if EFSM is used Verify if the current state is legitimate Verify if pre-conditions and post- conditions of transition are met Verify if the new state matches the expected transition

Statistics-Based Approach Statistical and temporal deviation detection Select and construct statistical features of normal operations, e.g., statistics on the states and transitions of the EFSMs Apply statistical (machine) learning tools to learn normal profiles, e.g., of the important EFSM states and transitions Use the profiles to detect anomalies

Our MURI Objectives A general framework to generate specification-based model and statistics-based model, and to combine the two models What events/models to specify What statistical/temporal features Which anomalies are covered by each model

Approach Start with a taxonomy of basic events of the target system Any operation is some combination of basic events Anomalies can be detected if their anomalous basic events are detected. Investigate What is the proper granularity for basic events Completeness of taxonomy

Approach (cont ’ d) Model normal operations according to system/protocol specification Construct extended finite state machines (EFSMs) in terms of basic events Investigate Tools for constructing and validating the models

Approach (cont ’ d) Construct statistical and temporal features of the normal basic events Apply learning algorithms to generate normal profiles Detect statistical anomalies that are not detectable by specification-based approach Investigate Automated feature construction and selection Optimization of the tradeoffs of model accuracy and efficiency

Validation Case studies using representative network protocols (e.g., smtp, http) Comparative studies using COTS and intrusion detection algorithms from this research

Data Stream Model Properties of Network IDS Real time operation Memory much smaller than the number of packets processed Data Stream Model formalizes this scenario. Goal: Use algorithm design techniques for this model to solve ID problems. Example: Can detect large anomalies in day-to-day behavior of some sites.