Host IDS Research Articles

Evaluation of Deep Learning Methods Efficiency for Malicious and Benign System Calls Classification on the AWSCTD

The increasing amount of malware and cyberattacks on a host level increases the need for a reliable anomaly-based host IDS (HIDS) that would be able to deal with zero-day attacks and would ensure low false alarm rate (FAR), which is critical for the detection of such activity. Deep learning methods such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs) are considered to be highly suitable for solving data-driven security solutions. Therefore, it is necessary to perform the comparative analysis of such methods in order to evaluate their efficiency in attack classification as well as their ability to distinguish malicious and benign activity. In this article, we present the results achieved with the AWSCTD (attack-caused Windows OS system calls traces dataset), which can be considered as the most exhaustive set of host-level anomalies at the moment, including 112.56 million system calls from 12110 executable malware samples and 3145 benign software samples with 16.3 million system calls. The best results were obtained with CNNs with up to 90.0% accuracy for family classification and 95.0% accuracy for malicious/benign determination. RNNs demonstrated slightly inferior results. Furthermore, CNN tuning via an increase in the number of layers should make them practically applicable for host-level anomaly detection.

A Host Intrusion Detection System architecture for embedded industrial devices

The integration of Cyber-Physical Systems in the industrial domain has become indispensable for Industry 4.0. Unfortunately, as the interconnectivity among them increases, so do the opportunities for malicious users to target them. Hence, it is necessary to increase the security of these systems and their components. A wide range of security solutions (e.g., industrial Firewalls) are already an integral part of Industrial Automation Systems, however, these are deployed at strategical system locations and might not be capable of identifying intrusions that target specific elements of embedded industrial devices. Host Intrusion Detection Systems (Host IDS) are one security solution that allow to detect such type of intrusions, as they analyze information related to specific host devices. This contribution presents a feasible Host IDS architecture for embedded industrial devices. This architecture takes into consideration features and capabilities of Host IDS from the IT domain. It also considers system-, environmental- and device-specific properties from the industrial domain. These properties are presented in the form of abstracted requirements and considerations that are contemplated for the conceptualization of the presented architecture. Furthermore, the feasibility of this architecture is validated through the implementation and evaluation of a prototypical Host IDS deployed in a Programmable Logic Controller (PLC) hosting a Real-Time Operating System (RTOS). This evaluation is achieved through the demonstration of a set of hypotheses derived from the abstracted requirements and supported by the evaluation of test scenarios. To the best of our knowledge, this is the first fully operational Host IDS to be deployed and evaluated on a PLC.

Beacon trust management system and fake data detection in vehicular ad‐hoc networks

A vehicular ad-hoc network is an emerged technology, where vehicles communicate with one another and Road Side Units. Vehicular ad-hoc networks are categorised as a sub-branch of mobile ad-hoc networks, and they help in enhancing traffic efficiency and safety. Vehicular ad-hoc networks facilitate communication by dissemination of messages relaying through vehicles. However, malicious nodes can propagate false safety alert in a network due to its malicious behaviour or selfishness. False messages in vehicular ad-hoc networks can change drivers behaviour and create a disastrous situation in the network. Therefore, it is more important to thwart these false messages. The article presents a beacon trust management system and fake data detection (BTMS-FDD) scheme. The trust management system uses speed and density information to establish a relationship with vicinity vehicles. The false safety event detection scheme uses relative safety and beacon messages to detect false safety event more accurately. For false safety events, a scheme uses position and speed information of beacon and safety-related messages. To analyse the performance of proposed detection scheme, it is compared with ELIDV and host IDS schemes. The simulation results demonstrate that proposed malicious data detection scheme is better in terms of true positive, false positive and overhead.

Management challenges in delivering an international sport and development program

Purpose – The primary purpose of this paper is to explore stakeholder perceptions of an international sport for development program so as to identify some of the management challenges within a strategic management framework. The secondary purpose is to provide recommendations for the focal organization’s leadership based on those stakeholder perceptions. Hence, participants in this study directly experienced the facilitation and implementation of the international sport for development program. Participant viewpoints are expressed in efforts to identify improvement opportunities in the delivery and operations of this sport for development program. Design/methodology/approach – In this qualitative research, a case study design was chosen to produce a detailed account of the Commonwealth Games Association of Canada’s (CGC) International Sport and Development (IDS) program. Interviews were conducted with 24 alumni of the IDS program, five CGC IDS administrators, and ten host IDS organization administrators from African and Caribbean regions. Findings – Findings demonstrated shared perspectives regarding the challenges and various management practices among the three stakeholder groups investigated. In particular, funding and human resource stress was found to be the largest obstacles of maintaining programming and achieving desired outcomes. Several strengths and limitations in the program design, monitoring and evaluation strategy, and program documentation of outcomes were found which can presumably be used to help formulate management strategy moving forward in efforts for continuous improvement. Research limitations/implications – The study does not take into account the stakeholder group of participants whom were deemed to be on the receiving end of the program and not responsible for the delivery and operations of the initiatives which were the focus of the study. Practical implications – Recommendations in lieu of present challenges and objectives are also offered and are based on information from the facilitators and implementers of the principal program of research and the results of the semi-structured interviews. Originality/value – This study examines three different stakeholders that are responsible for the facilitation and implementation of the design, delivery, and daily operations of sport for development projects within an international partnership context.

TOWARDS DATA MINING TEMPORAL PATTERNS FOR ANOMALY INTRUSION DETECTION SYSTEMS

A reasonably light-weight host and net-centric Network IDS architecture model is indicated. The model is anomaly based on a state-driven notion of “anomaly”. Therefore, the relevant distribution function need not remain constant; it could migrate from states to states without any a priori warning so long as its residency time at a next steady state is sufficiently long to make valid observations there. Only those intrusion events (basically DOS and DDOS variety) capable of triggering anomalous streams of attacks/response both near and/or far of target monitoring point(s) are considered at the first level of detection. At the next level of detection, the filtered states could be fine-combed in a batch mode to mine unacceptable strings of commands or known attack signatures.

Analysis of Intrusion Detection Response System (IDRS) In Cyber Physical Systems (Cps) Using Regular Expression (Regexp)

In this research we aim to design and validate Intrusion Detection Response System (IDRS) for a cyber physical system (CPS) comprising for controlling and protecting physical infrastructures. The design part includes host IDS, system IDS and IDS response designs. The validation part includes a novel model-based analysis methodology with simulation validation. Our objective is to maximize the CPS reliability or lifetime in the presence of malicious nodes performing attacks which can cause security failures. Our host IDS design results in a lightweight, accurate, autonomous and adaptive protocol that runs on every node in the CPS to detect misbehavior of neighbor nodes based on state-based behavior specifications. Our system IDS design results in a robust and resilient protocol that can cope with malicious, erroneous, partly trusted, uncertain and incomplete information in a CPS. Our IDS response design results in a highly adaptive and dynamic control protocol that can adjust detection strength in response to environment changes in attacker strength and behavior. The end result is an energy-aware and adaptive IDS that can maximize the CPS lifetime in the presence of malicious attacks, as well as malicious, erroneous, partly trusted, uncertain and incomplete information. We develop a probability model based on regular expression technique to describe the behavior of a CPS incorporating our proposed intrusion detection and response designs, subject to attacks by malicious nodes exhibiting a range of attacker behaviors, including reckless, random, insidious and opportunistic attacker models. We identify optimal intrusion detection settings under which the CPS reliability or lifetime is maximized for each attacker model. Adaptive control for maximizing IDS performance is achieved by dynamically adjusting detection and response strength in response to attacker strength and behavior detected at runtime.

Host-centric Proteomics of Stool: A Novel Strategy Focused on intestinal Responses to the Gut Microbiota

The diverse community of microbes that inhabits the human bowel is vitally important to human health. Host-expressed proteins are essential for maintaining this mutualistic relationship and serve as reporters on the status of host-microbiota interaction. Therefore, unbiased and sensitive methods focused on host proteome characterization are needed. Herein we describe a novel method for applying shotgun proteomics to the analysis of feces, focusing on the secreted host proteome. We have conducted the most complete analysis of the extracellular mouse gut proteome to date by employing a gnotobiotic mouse model. Using mice colonized with defined microbial communities of increasing complexity or a complete human microbiota ('humanized'), we show that the complexity of the host stool proteome mirrors the complexity of microbiota composition. We further show that host responses exhibit signatures specific to the different colonization states. We demonstrate feasibility of this approach in human stool samples and provide evidence for a "core" stool proteome as well as personalized host response features. Our method provides a new avenue for noninvasive monitoring of host-microbiota interaction dynamics via host-produced proteins in stool.

Introducing multi-ID and multi-locator into network architecture

The present-day Internet has no separate namespace for host IDs. It uses IP addresses as host IDs, which are in fact locators. This dual role is problematic for mobility, multihoming, security, and routing on the Internet. To solve these problems, research has recently begun on ID/locator split architectures. Some standardization activities based on this concept are also progressing in ITU-T Study Group 13 and in the IETF. We expect that introduction of the ID/locator split concept into the new generation network or future Internet architecture can bring about additional functions, such as heterogeneous network protocol support, multicast, QoS, resource or service discovery, and flexible human-network interaction. Toward realization of these functions, this article discusses some approaches to introducing multi-ID and multilocator support into the network architecture. This also lists items that have the potential to be investigated and standardized in ITU-T.

Secure and Robust Framework for ID/Locator Mapping System

The use of IP addresses as host IDs and locators in the present day Internet protocols imposes constraints on designing efficient solutions for mobility, multihoming, renumbering, and security. To eliminate the constraints, different approaches of introducing ID/locator split into future network architectures have been discussed recently. HIMALIS is such an architecture, which uses distinct sets of values for identifiers and locators and allows the network layer to change locators without requiring the upper layers to change identifiers. One of the major challenges of HIMALIS is the design and implementation of a distributed ID-to-locator mapping database system to efficiently store, update and provide the up-to-date mapping data to the network elements. For this purpose, this paper discusses the application of the Domain Trusted Entity (DTE) infrastructure to the HIMALIS architecture. It provides a unified manner to get locators from high level identifiers (names) with enhanced security, privacy, and trust, while maintaining all capabilities and full compatibility with the previous DNR, HNR, and IDR infrastructures found in HIMALIS.

HIMALIS: Heterogeneity Inclusion and Mobility Adaptation through Locator ID Separation in New Generation Network

The current Internet is not capable of meeting the future communication requirements of society, i.e., reliable connectivity in a ubiquitous networking environment. The shortcomings of the Internet are due to the lack of support for mobility, multihoming, security and heterogeneous network layer protocols in the original design. Therefore, to provide ubiquitous networking facilities to the society for future innovation, we have to redesign the future Internet, which we call the New Generation Network. In this paper, we present the Heterogeneity Inclusion and Mobility Adaptation through Locator ID Separation (HIMALIS) architecture for the New Generation Network. The HIMALIS architecture includes a new naming scheme for generating host names and IDs. It also includes a logical control network to store and distribute bindings between host names, IDs, locators and other information useful for providing support for network operation and control. The architecture uses such information to manage network dynamism (i.e., mobility, multihoming) and heterogeneity in network layer protocols. We verify the basic functions of the architecture by implementing and testing them using a testbed system.

Host identification in reliable distributed kernels

Acquisition of a host identifier (id) is the first and foremost network level activity initiated by a machine joining a network. It allows the machine to assume an identify in the network and build higher levels of abstraction that may be integrated with those on other machines. In order that the system may work properly, host ids must satisfy certain properties such as uniqueness. In recent years, distributed systems consisting of workstations connected by a high-speed local area network have become popular. Hosts in such systems interact with one another more frequently and in a manner much more complex than is possible in the long haul network environment. The kernels in such systems are called upon to support various inter-host operations, requiring additional properties for host ids. This paper discusses the implications of these properties with respect to distributed kernel reliability. A new scheme to generate and manage host ids satisfying the various properties is also presented. The scheme is distributed and robust, and works even under network partitioning.