Network Intrusion Prevention Systems Research Articles

Design of distributed network intrusion prevention system based on Spark and P2DR models

Design of distributed network intrusion prevention system based on Spark and P2DR models

Exploiting the Common Case When Accelerating Input-Dependent Stream Processing by FPGA

FPGAs have traditionally been successful in accelerating stream processing applications where the amount and type of work performed on each record&#x2014;e.g., image, packet&#x2014;do not depend on the record&#x0027;s contents. On the other hand, accelerating &#x2018;input-dependent&#x2019; stream processing on FPGAs presents a much more challenging problem where different records in the stream can require widely different operations. It is inefficient and unnecessary to support all operations at the same throughput when the distributions of the operations are skewed. In this paper, we examine the application of the &#x201C;make the common case fast&#x201D; strategy to efficiently accelerate &#x2018;input-dependent&#x2019; stream processing on FPGAs. In particular, we study the use of <i>fast-slow path</i> and <i>early-exit</i> techniques in the design of an FPGA-accelerated network intrusion prevention system (IPS). To avoid overfitting when common-case behavior is varied, we further examine <i>compile-time re-tuning</i> and <i>runtime adaptation</i> techniques. A quantitative analysis shows that fast-slow path and early-exit techniques can save an order of magnitude of resources compared to a common-case unaware IPS design. Compile-time re-tuning to specific conditions further achieves 30&#x0025; &#x2013; 94&#x0025; BRAM savings relative to a generalized design. Adding runtime adaptation improves the zero-loss throughput by 1.43 &#x2013; 2.75 &#x00D7; compared to a fixed design.

A Hybrid Adaptive Development Algorithm and Machine Learning Based Method for Intrusion Detection and Prevention System

Network Intrusion detection and prevention Systems (NIDPS) are employed in monitoring a network which safeguards user integrity, privacy thereby ensuring the data security and availability in a network. Such systems not only monitor the suspicious activities in a network but also used as control systems to eliminate the malicious users from the network. In this paper, a Hybrid Adaptive Development Algorithm and Machine Learning Algorithm (ADA-MLA) method is proposed to identify the malicious activities and eliminating them from the network. The deployment of honeypot-based intrusion is improved adaptive development algorithm. Machine learning algorithm has been employed in the Hybrid IDPS for learning the network data patterns which also identifies the maximum probable attacks in the network. The signatures for the DARPA 99 data set have been updated during the implementation of intrusion prevention system on a real-time basis. The hybrid method works on (i) classifying the attacks based on protocols and (ii) classifying the attacks on pre-determined threshold values. Hence, both known and unknown attacks can be easily captured in the proposed hybrid IDPS method which thereby achieves higher attack detection and prevention accuracy while compared to the conventional attack detection and prevention methodologies.

A novel network intrusion prevention system based on Android platform

With the popularity of wireless networks in recent years, the mobile phone users accounted for 95.1% in China. Meanwhile, the security issues cannot be ignored. The cost of wireless attacks is getting lower, and there are more frequent occurrence of wireless fishing, wireless crack and other security events. However, the current traditional intrusion prevention method can only cope with relatively simple attack scenarios. Therefore, the development of new intrusion prevention system is particularly important. In this paper, we design and implement a novel network intrusion prevention system, which uses VpnService and TcpDump to capture traffic as a data source, cooperates with the single-step attack rule signature database and the attack chain signature database to perform real-time intrusion detection, and combines intent analysis to detect intrusion intention-behaviour and output alarms. The results show that the system is effective in recognising typical wireless attacks.

A novel network intrusion prevention system based on Android platform

With the popularity of wireless networks in recent years, the mobile phone users accounted for 95.1% in China. Meanwhile, the security issues cannot be ignored. The cost of wireless attacks is getting lower, and there are more frequent occurrence of wireless fishing, wireless crack and other security events. However, the current traditional intrusion prevention method can only cope with relatively simple attack scenarios. Therefore, the development of new intrusion prevention system is particularly important. In this paper, we design and implement a novel network intrusion prevention system, which uses VpnService and TcpDump to capture traffic as a data source, cooperates with the single-step attack rule signature database and the attack chain signature database to perform real-time intrusion detection, and combines intent analysis to detect intrusion intention-behaviour and output alarms. The results show that the system is effective in recognising typical wireless attacks.

Industry 4.0‐Oriented Chipless RFID Backscatter Signal Variable Polarization Amplitude Deep Learning Coding

Due to the weak network security protection capabilities of control system network protocols under Industry 4.0, the research on industrial control network intrusion detection is still in its infancy. This article discussed and researched the intrusion prevention technology of industrial control networks based on deep learning. According to the electromagnetic scattering theory, the backscatter signal model of the chipless tag was established as a chipless tag structure. Polarized deep learning coding was used for the label; that was, deep learning coding was performed on the copolarization component and the cross‐polarization component at the same time, and a 16‐bit deep learning coding bit number was obtained. The wave crest deep learning coding was used for the split ellipse ring patch label, and the 6‐bit deep learning coding bit number was obtained. Then, the poles of the scattered signal of the tag were extracted to identify the tag. The variable polarization effect was achieved by adopting the dipole resonant unit with the two ends bent. Aiming at the problem of low detection rate caused by the shallow selection of feature classification of intrusion prevention systems, an industrial control network intrusion prevention model based on self‐deep learning encoders and extreme learning machines was proposed to extract features from industrial control network data through deep learning. For accurate classification, the theoretical judgment was also verified through simulation experiments, and it was proved that the detection rate of the model has also improved. It forms a set of industrial control network intrusion prevention system with complete functions and superior performance with data acquisition module, system log module, defense response module, central control module, etc. The matrix beam algorithm was used to extract the poles and residues for the late response, and the extracted poles and residues were used to reconstruct the signal. The reconstructed signal was compared with the scattered signal to verify the correctness of the pole extraction. Finally, the tags were processed and tested in the actual environment, and the measured results were consistent with the theoretical analysis and simulation results.

Denial of Firewalling Attacks (DoF): The Case Study of the Emerging BlackNurse Attack

Traditional Distributed Denial of Service (DDoS) attacks usually flood network targets with malicious traffic. Recently, new types of DDoS attacks have emerged and target specifically network security devices, mainly firewalls and intrusion prevention systems (IPS). In contrast to traditional DDoS attacks, these emerging attacks use a low volume of malicious traffic. This paper is concerned solely with an emerging denial of firewalling attack (DoF), called the BlackNurse attack. The attack uses specially formatted ICMP error messages to overwhelm targeted firewalls' CPUs. This paper offers detailed insights into the understanding of DoF attacks and classifying them according to the targeted firewall resources, traffic volume, and attack effect. This paper also concentrates on the BlackNurse attack principles, practical attack generation, and its general effect on impacted firewalls and the networks. The performance evaluations are conducted on commercial grades, namely, Juniper NetScreen SSG 20 and Cisco ASA 5540 firewalls. The pros and cons of the available attack mitigations are discussed. OS screening features on Juniper NetScreen SSG 20 are used, for an example, to test their effectiveness in thwarting the attack. Furthermore, this paper proposes a novel mechanism to defend against the BlackNurse attack using an early rejection rule with dynamic activity time duration that depends on current and previous attack statistics and severity parameters. The evaluation is conducted to simulate the proposed mechanism defense against novice and expert BlackNurse attackers.

Fast 2D filter with low false positive for network packet inspection

Deep packet inspection (DPI) represents the major process in network intrusion detection and prevention systems. In DPI each security threat is represented as a signature, and the payload of every incoming data packet is matched against the set of current signatures. Moreover, DPI is also used for other networking applications such as packet classification, quality of service techniques, protocol identification and so on. DPI exhausts extra central processing unit and memory resources, and as a result, several attempts have been proposed to improve this process. In this study, the authors proposed a fast two-dimensional (2D) filter with low false positive (FP) rate for DPI purposes. It consists of 2D array that employs single hash function and has very low FP rate. Using this filter as an identification tool in a DPI technique will result in more accurate and higher throughput than other systems that employ Bloom (BFs) and quotient filters (QFs). Our experiments show that the proposed solution has time improvement up to 94% over others that employ BFs or QFs and the achieved average throughput is 1.8 Gbps.

Design and Analysis of Real-time Network Intrusion Detection and Prevention System using Open Source Tools

detection and prevention is one of the most important and fundamental task in an organization's computer network. Commercially available intrusion detection and prevention systems are costly and overkill for small and medium sized organizations. This paper describes the design and analysis of a network intrusion detection system (NIDS) and network intrusion prevention system (NIPS) using open source tools. The study also describes an open source Database to store the alerts and an open source front end management console application to view the alerts and logs from the proposed Database in any of the modern day web browser. In this particular research Snort was used as an NIDS to detect intrusions and attacks. Snort is a popular open source NIDS with signature based rules for detecting thousands of known attacks. The rules are regularly updated by Snort team to include new attacks and intrusions. SnortSam was used as an NIPS to act upon the alerts detected by Snort. SnortSam blocks the intrusions by sending intruders and attacker's source IP addresses to firewall in real time. MySQL was used as the Database to store alerts and BASE (Basic Analysis and Security Engine) was chosen as the open source management console application. Juniper Networks switch EX-3200 and Firewall SSG-20 were used as the network devices for connectivity and working of the system. Any other vendor network devices can also effectively be used in design and configuration of the system. The design successfully detected and prevented network intrusions and same can be implemented in any small and medium sized organization for protection of their Computer Networks.

TCP/IP Reassembly in Network Intrusion Detection and Prevention Systems

Deep Packet Inspection DPI in Network Intrusion Detection and Prevention Systems NIDPS typically involves the matching of packet payloads against attack signatures in the form of fixed strings and ...

High-performance Architecture of Network Intrusion Prevention Systems

Software-based Network Intrusion Prevention Systems have difficulty in handling high speed links. Network processor (NP) is an emerging field of programmable processors that are optimized to implement network data. In this paper, a novel Network Intrusion Prevention scheme is designed based on a het

Intrusion Detection and Prevention Technology using Sensor Networks to Protect Firewall from Attacks

Intrusion Detection and Prevention Systems (IDPS’s) have more intelligence and are built to fill in the gaps left open by firewalls. An Intrusion Detection System is a device that monitors all network traffic. It analyzes the traffic in real-time to determine if someone is sending attacks or malicious traffic on your network. The analysis normally incorporates pattern matching and other techniques that are fast enough to analyze all packets on busy networks .With the growing number of applications allowed in from the Internet and the increased exposure to sophisticated network attacks, it’s ever more important for companies to safeguard their networks. Evasive methods of delivering exploits continue to increase and the problem is further compounded by the growing number of application and OS vulnerabilities, as well as the increasing speed with which new attacks are created to exploit these vulnerabilities. IDP Series Intrusion Detection and Prevention technology using sensor networks offer the latest capabilities in in-line network intrusion prevention system (IPS) functionality to manage the use of unwanted applications and protect the network from a wide range of attacks delivered by those allowed applications. IDP Series appliances deliver comprehensive threat coverage and industry leading response time for maximum protection of network resources.

Logical Circuits for Extended Content Matching in Hardware Based NIDPS

In this paper we present logical circuits for efficient detection of rolled out contents. As network speed increases and security matters there is a demand for implementation of hardware based Network Intrusion Detection and Prevention Systems (NIDPS). On the other hand hardware based NIDPS are lacking the flexibility of detection of so named "evasion" techniques. Here we present simple but efficient enhancement to content matching in hardware with minimal basic memory elements (flip-flops) used.

GPU Computation for Online Realtime Multi-Pattern Matching

Most applications of traditional full-text search, e.g., webpage search, are offline which exploit text search engine to preview the texts and set up related index. However, applications of online realtime full-text search, e.g., network Intrusion detection and prevention systems (IDPS) are too hard to implementation by using commodity hardware. They are expensive and inflexible for more and more occurrences of new virus patterns and the text cannot be previewed and the search must be complete realtime online. Additionally, IDPS needs multi-pattern matching, and then malicious packets can be removed immediately from normal ones without degrading the network performance. Considering the problem of realtime multi-pattern matching, we implement two sequential algorithms, Wu-Manber and Aho-Corasick, respectively over GPU parallel computation platform. Both pattern matching algorithms are quite suitable for the cases with a large amount of patterns. In addition, they are also easier extendable over GPU parallel computation platform to satisfy realtime requirement. Our experimental results show that the throughput of GPU implementation is about five to seven times faster than CPU. Therefore, pattern matching over GPU offers an attractive solution of IDPS to speed up malicious packets detection among the normal traffic by considering the lower cost, easy expansion and better performance.

Pattern overlap in bit-parallel implementation of regular expression repetition quantifiers

Deep Packet Inspection DPI in Network Intrusion Detection and Prevention Systems NIDPS typically involves the matching of packet payloads against attack signatures in the form of regular expressions regexes. Existing research into the handling of the constrained {min, max} repetition syntax used in many regexes mainly proposes the use of a counting mechanism which avoids inefficient unrolling of the repeated sub-expression. However, many regexes cannot be handled as their format makes them susceptible to the problem of counter overlap. In this paper, we present a memory-centric bit-parallel hardware architecture that overcomes the issue of counter overlap through the use of a bit serial First-In-First-Out FIFO queue. The memory-centric rather than logic-centric nature of the design has the advantage of allowing dynamic updates to individual attack signatures. The solution proposed in this paper is targeted at ASIC and FPGA platforms and we present experimental results for a proof-of-concept design.

The NADIA: A Network Acceleration System with Defense against Network Invasion and Attack

Information security plays a critical role in the design of high-speed network systems, and much attention is focused on the Network Intrusion Prevention System (NIPS) which combines both a firewall and a Network Intrusion Detection System (NIDS). However, the current generation of NIDS/NIPS has several limitations on performance and effectiveness. In this paper, we describe the Network Accelerator with Defense against Invasion and Attack (NADIA) architecture as a network security card. The NADIA system consists of NADIA hardware for network and security processing and NADIA software for a device driver and a management agent. The goal of the network acceleration hardware is to reduce the overhead of the host CPU for network processing. And, the security function hardware performs operations such as network ACL, DPI, DDoS blocking, and session control, in order to check whether the received packets are malicious or not. Based on the performance evaluation, we can confirm that NADIA can reduce the CPU overhead of the network and security processing by a factor of 5~14.

Effect of Network Traffic on IPS Performance

The importance of network security has grown tremendously and intrusion prevention/detection systems (IPS/IDS) have been widely developed to insure the security of network against suspicious threat. Computer network intrusion detection and prevention system consist of collecting traffic data, analyzing them based on detection rules and generate alerts or dropping them if necessary. However IPS has problems such as accuracy signature, the traffic volume, topology design, monitoring sensors. In this paper, we practically examine the traffic effect on performance of IPS. We first examine the detection of DOS attack on a web server by IPS and then we generate network traffic to see how the behavior of IPS has influenced on detection of DOS attack.

Design And Efficient Deployment Of Honeypot And Dynamic Rule Based Live Network Intrusion Collaborative System

The continuously emerging, operationally and managerially independent, geographically distributed computer networks deployable in an evolutionarily manner have created greater challenges in securing them. Several research works and experiments have convinced the security expert that Network Intrusion Detection Systems (NIDS) or Network Intrusion Prevention Systems (NIPS) alone are not capable of securing the Computer Networks from internal and external threats completely. In this paper we present the design of Intrusion Collaborative System which is a combination of NIDS,NIPS, Honeypots, software tools like nmap, iptables etc. Our Design is tested against existing attacks based on Snort Rules and several customized DDOS , remote and guest attacks. Dynamic rules are generated during every unusual behavior that helps Intrusion Collaborative System to continuously learn about new attacks. Also a formal approach to deploy Live Intrusion Collaboration Systems based on System of Systems Concept is Proposed.

Abnormal Policy Detection and Correction Using Overlapping Transition

Policy in security devices such as firewalls and Network Intrusion Prevention Systems (NIPS) is usually implemented as a sequence of rules. This allows network packets to proceed or to be discarded based on rule's decision. Since attack methods are increasing rapidly, a huge number of security rules are generated and maintained in security devices. Under attack or during heavy traffic, the policy configured wrong creates security holes and prevents the system from deciding quickly whether to allow or deny a packet. Anomalies between the rules occur when there is overlap among the rules. In this paper, we propose a new method to detect anomalies among rules and generate new rules without configuration error in multiple security devices as well as in a single security device. The proposed method cuts the overlap regions among rules into minimum overlap regions and finds the abnormal domain regions of rules' predicates. Classifying rules by the network traffic flow, the proposed method not only reduces computation overhead but blocks unnecessary traffic among distributed devices.

Exploiting heterogeneous multicore-processor systems for high-performance network processing

<para xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> In this paper, we examine two network-processing appliances, i.e., the IBM Proventia^® Network Intrusion Prevention System and the IBM WebSphere® DataPower® service-oriented architecture appliance, and the specific requirements they pose on emerging heterogeneous multicore-processor systems. We first describe the function and architecture of these applications. Next, we describe the computational requirements imposed on the applications as a result of the expectation that they operate at the maximum transmission rate on high-speed networks (i.e., on networks at speeds greater than 10 Gb/s) with minimal latency. Given that next-generation systems will provide on-chip and off-chip hardware acceleration functions, we identify and quantify the functions that can be offloaded onto hardware accelerators to provide latency reduction by more efficient execution, increased concurrence, or both. Referring to models of specific hardware accelerators, we estimate and quantify the impact on the performance of the applications. We conclude with a discussion of the modifications to these applications that are required to exploit the large number of hardware threads and accelerators available on emerging multicore-processor systems. </para>