Presentation by : Samad Najjar Enhancing the performance of intrusion detection system using pre-process mechanisms Supervisor: Dr. L. Mohammad Khanli

OutLine Introduction Problem in NIDS Background & Related Work Proposed method expected conclusion 2

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 3 Three basic security concerns : Confidentiality Integrity Availability Intrusion detection is the detection of actions that attempt to compromise the integrity, confidentiality, or availability of a resource.

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 4

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 5 Packet Capture Engine Alarm Engine Detection Engine NIDS High-volume traffic Drop a large number of incoming packets To mitigate this problem Efficient algorithm for pattern matching Load balancing, splitting, or processing of traffic (i.e. distributed/parallel execution based approach) Hardware based approach such as using graphics processing units or field-programmable gate array (FPGA) devices

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 6 A fast string searching algorithm (1977) compares the target string with the input content beginning with the rightmost character of the string and uses two heuristics to reduce the number of searches in the matching process. Boyer and Moore algorithm Practical fast searching in strings (1980) Improved the Boyer–Moore algorithm by using only the bad-character heuristic with the purpose of achieving a more efficient implementation Horspool algorithm Efficient string matching: an aid to bibliographic search (1975) preprocesses the patterns to construct a deterministic finite automaton (DFA) aiming to search for all strings at the same time. Aho–Corasick algorithm Agrep— A fast approximate pattern-matching tool (1992) created the UNIX tool agrep Wu–Manber Algorithm Fast Pattern Matching Approach for Intrusion Detection Systems (2014) Aho–Corasick algorithm + Wu–Manber Algorithm M. Manjunath Hua et al. (2009), Bremler-Barr et al. (2010), Ďurian et al. (2010), Vespa et al. (2011), Choi et al. (2011), Kim et al. (2011), Cantone et al. (2012)andPao and Wang (2012). ETC. Algorithm for pattern matching:

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 7 Load balancing, splitting, or processing of traffic: Packet Pre-filtering for Network Intrusion Detection (2006) combining the header matching with a small prefix match Sourdis et al. Network Intrusion Detection System Based on SOA (NIDS-SOA): Enhancing Interoperability Between IDS (2013) Loiola Costa et al. D-SCIDS: Distributed soft computing intrusion detection system (2005) Ajith Abraham et al. EFM: Enhancing the Performance of Signature-based Network Intrusion Detection Systems Using Enhanced Filter Mechanism (2014) Weizhi Meng et al. Adaptive blacklist-based packet filter with a statistic-based approach in network intrusion detection (2013) Yuxin Meng et al. Auld et al. (2007), Faezipour and Nourani (2009), Wang (2009), Alagu Priya and Lim (2010), Song and Turner (2011), Lim et al. (2012)and Neji and Bouhoula (2012). ETC.

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 8 A novel hybrid intrusion detection method integrating anomaly detection with misuse detection (2014).

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 9 Data mining for intrusion detection Clustering - Partition-based clustering - Fuzzy C-means - K-means Classification - Uses a training Data set - Bayesian - Naïve Bayesian - Decision tree classification

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 10 High level pre-process mechanisms system

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 11 The architecture and deployment Blacklist packet filter

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 12 Monitor engine in pervious work: monitoring the NIDS calculating the confidences of IP addresses Periodically updates the blacklist Weighted ratio-based blacklist generation Represents the total number of good packets The weight value Represents the total number of bad packets

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion The results of average CPU load(ACL) for each day in pervious work 13 when using Snort with the packet filter when using Snort without the packet filter

Introduction Problems in NIDS Background & Related Work Proposed method expected conclusion 14 Blacklist-based packet filter is effective to reduce the burden of a signature-based NIDS without lowering network security. The packet filter shows an acceptable false positive rate and false negative rate Reduce the time consumption of signature matching

Question 15 Thanks for your attention