TELKOM
NIKA
, Vol. 11, No. 10, Octobe
r 2013, pp. 6
258 ~ 6
266
ISSN: 2302-4
046
6258
Re
cei
v
ed Ma
y 27, 201
3; Revi
sed
Jul
y
1
7
, 2013; Acce
pted Jul
y
26,
2013
A Distributed Network Intrusion Detection System with
Active Surveillance Agent
Bin Zeng*, L
u
Yao, Rui Wang
Dep
a
rtment of Mana
geme
n
t, Naval U
n
iv
ersit
y
of Eng
i
ne
eri
n
g
JieF
an
g Roa
d
717,
w
u
ha
n, Hube
i, Ch
in
a, Ph./F
ax: +
86-02
783
44
315
8/83
443
54
4
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: zbtrueice
@1
63.com
A
b
st
r
a
ct
A distrib
u
ted
n
e
tw
ork intrusio
n detecti
on sys
tem (I
DS) c
a
ll
e
d
SA-NIDS is
prop
osed
bas
e
d
on t
h
e
n
e
t
wo
rk-b
a
s
ed i
n
tru
s
i
o
n de
te
cti
o
n a
r
chi
t
ectu
re
. It i
n
cl
u
des thr
e
e
bas
ic co
mpon
ent
s, Loca
l
Intru
s
io
n
Detectio
n Mon
i
tor (LIDM), Globa
l Intrusio
n Detectio
n Con
t
roller (GIDC), and Surve
ill
a
n
ce Age
n
t (SA).
Basica
lly, the L
I
DM is used to
do pack
e
ts ca
pturin
g,
packet
s
de-
multi
p
lex
i
ng, loc
a
l intrus
i
on d
e
tection
a
n
d
intrusi
on i
n
ferri
ng. T
he GIDC i
s
install
ed i
n
a
d
minist
rati
on c
enter for co
mmunic
a
ting
an
d ma
na
gin
g
LID
M
s,
it can
als
o
do t
he
intrusi
o
n
de
tection
an
d i
n
trusio
n i
n
ferrin
g
.
T
he SA
cont
ai
ns sev
e
ral
o
p
ti
ona
l functi
ons
for
infor
m
ati
on
gat
heri
ng. After a
n
attack b
e
h
a
vi
or is d
i
scov
e
re
d, the SA
may
be us
ed to
la
u
n
ch so
me ki
nd
s of
infor
m
ati
on g
a
t
heri
ng to th
e at
tacker, so that
the pr
o
pos
ed
SA-NIDS has t
he activ
e
surv
e
illa
nce
abi
lity. For
the intrusi
on i
n
ferrin
g
, the p
a
ttern matchin
g
and th
e
statistical a
ppro
a
c
h
are ap
pli
ed
in SA-NIDS. T
h
e
exper
imenta
l
results can sati
sfy the
needs o
f
netw
o
rk informati
on safety.
Ke
y
w
ords
: Information Secu
rity, Intrusion Detection System
, Mu
lti-Agent
System
, Pattern Matching
Copy
right
©
2013 Un
ive
r
sita
s Ah
mad
Dah
l
an
. All rig
h
t
s r
ese
rved
.
1. Introduc
tion
Information
secu
rity dep
en
ds o
n
the fiv
e
f
unctio
n
s:
data integ
r
ity, authenti
c
atio
n, non
-
repu
diation,
confid
entiality, and ac
ce
ss co
ntrol [1]
.
Unfortun
ate
l
y, it is difficult to achi
e
v
e
altogethe
r th
ese five
goal
s of the i
n
formation
se
curi
ty for the sake of ra
pid
growth of Inte
rnet.
Curre
n
t Internet is ba
sed
on TCP/IP ne
twork in
fra
s
tructures, it incl
ude
s hardwa
r
e, software
and
proto
c
ol
s. All the comp
one
nts have their own secu
rity proble
m
s. Even the
ent
ire
sy
st
em is
saf
e
,
the carele
ss
netwo
rk ma
n
agers may n
egle
c
t some
t
h
ing
so
that
the mali
ciou
s users
ca
n d
o
somethi
ng
ba
d to the
syst
em. The i
nhe
rent
cha
r
a
c
te
ristics of
the TCP/IP
net
work are that it
is
not originally desi
gned for se
cure comm
unication and has a lo
t of vulnerabilities [2-5].
Intrusio
n dete
c
tion is
defin
ed as th
e pro
c
e
s
ses to
id
e
n
tify the internal or exte
rn
al use
r
s
who i
n
tend t
o
do
somethi
n
g una
utho
rized ag
ain
s
t th
e co
mpute
r
system [6]. Identifying the I
D
S
by the monitoring ap
pro
a
ch use
d
, we can cate
gor
iz
e the IDS into
two types
, that is
Hos
t
-based
IDS (HIDS
)
and Net
w
o
r
k-based ID
S (NIDS) [7]. HIDSs have ag
ents that take the operati
ng
system’
s
vari
ous
audit trai
ls a
s
the
mai
n
data
so
urce. After a ce
ntral
colle
ctor assem
b
le
s
all
kind
s of log
s
from ea
ch a
g
ent, the anal
yzing ag
ent
d
oes the
actu
al intru
s
ion d
e
tection. NI
DSs
are
differe
nt from
HIDS
s
which
are d
e
si
gned
to
supp
ort only
a
sin
g
le h
o
st, mo
nitor p
a
cket
s
on
the netwo
rk
wire, take the
s
e net
work p
a
ckets a
s
the
data sou
r
ces and discover if an intruder is
attempting to
bre
a
k a
sy
stem. Fo
r th
e broad
ca
st
prop
erty of
some LA
N te
chn
o
logy
(e.
g
.,
Ethernet),
the
NIDS
sets it
s network
ada
pter to
the
promiscuo
u
s m
ode
and
ge
ne
rally
can
see
all
packet
s
on th
e same
seg
m
ent of network.
Identifying th
e IDSs by th
e intru
s
io
n in
feren
c
e
mod
e
s
or
dete
c
ting alg
o
rithm,
we
ca
n
c
a
tegoriz
e
the IDS into two types
, Statis
tic
a
l ID
S (SIDS) and
Rul
e
-ba
s
ed
IDS
(RIDS) [8]. SIDSs
use
statistica
l anomaly de
tection a
s
their dete
c
tion
approach. SIDSs build
u
p
profile
s of all
use
r
s,
su
bje
c
ts an
d obj
ect
s
in t
he h
o
st/
netwo
rk a
s
t
he hypot
hesi
s
of
normal b
ehaviors. SIDSs
define a set of paramete
r
s
such as t
he login fre
q
uen
cy, failure of login attempt, reso
u
r
ce
availability,
memory u
s
e
d
, unautho
rized file sy
ste
m
access at
tempt, and so on. Statistical
approa
che
s
a
r
e
used to
lo
ok fo
r
deviati
ons from
st
atistical
me
asures
or ex
istin
g
sy
stem p
r
ofil
es
to dete
c
t un
u
s
ual
be
haviors. To
infer whether a
su
sp
icious activity is an
attack
, a thres
h
old is
set up for e
a
c
h pa
ram
e
ter accordi
ng to
the system
profile. If the para
m
eter va
lue is hig
her
or
lowe
r than th
e thre
shold
(according to the paramete
r
type), we re
gard the
su
sp
iciou
s
a
c
tivity as
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NIKA
Vol. 11, No
. 10, Octobe
r 2013 : 625
8 –
6266
6259
an attack. In
RIDS
s, we
build u
p
an i
n
trusi
on sign
ature databa
se
a
bout
hi
storically kno
w
n
intrusi
on tech
nique
s an
d malicio
us b
eha
viors a
s
the rules. The
s
e
rules may be
a singl
e activi
ty,
seq
uen
ce
s of
activities, thresh
old
s
of ev
ents,
ge
ne
ral
comm
and
s o
r
syntax in
which
ope
rato
r is
allowed. RIDSs com
p
a
r
e the paramet
e
r
s in the rul
e
d
a
taba
se of t
he use
r
sessio
ns an
d the user
comm
and
s, a
nd data to ea
ch intrusi
on signature
in th
e databa
se. I
f
the informat
ion so
me
whe
r
e
or user com
m
ands mat
c
h the intrus
ion signature, the suspi
c
ious
activities will be
regarded as
at
t
a
ck
s.
2. The Propo
sed Me
thod
The
pro
p
o
s
e
d
SA-NIDS i
s
ba
sed
on
th
e net
wo
rk-ba
s
ed
intrusio
n
detectio
n
te
chniqu
es.
It is extende
d from the
a
r
chite
c
tu
re of
NSM [9
] an
d DIDS [1
0] develop
ed in
U.C. Davis
as
referen
c
e. The SA-NIDS
archite
c
tu
re
(see Fi
gur
e
1) pro
pose
d
in this pa
per is b
a
si
cally
comp
osed of
three
comp
onent
s: Loca
l
Intrusio
n Detection M
o
n
i
tor (LI
D
M),
Global Intrusi
on
Dete
ction Co
ntrolle
r (GIDC)
an
d Survei
llance Agent (SA).
Figure 1. The
archite
c
tu
re
of the propo
sed SA-NIDS
2.1. Architec
ture o
f
the P
r
opose
d
SA-NIDS
Gene
rally, there is u
s
ually
one GIDC i
n
the
central administratio
n netwo
rk of
a large
netwo
rk a
nd an LIDM in each seg
m
e
n
t. The GI
DC and LIDM
s se
cu
rely communi
cate i
n
the
client-se
r
ver
mode. The S
u
rveillan
c
e A
gent and
GIDC
p
h
ysi
c
all
y
resid
e
in the sam
e
ho
st with
different logi
cal function
s. The fun
c
tions of
each com
pone
nt are d
e
scrib
ed in d
e
tail belo
w
.
Local Intrusi
o
n Dete
ction
Monitor
An LIDM sta
nds
alone i
n
each se
gme
n
t
of LA
N. It is re
sp
on
sible
for the lo
cal
packet
captu
r
ing
an
d local intru
s
i
on dete
c
tion.
LIDM is
th
e
basi
c
a
nd th
e most im
portant part of the
prop
osed SA-NIDS. It has four mai
n
com
pone
nts:
- Packet Cat
c
he
r
- Pac
k
et Pars
er
- Intrusio
n Signature Data
base (ISD)
configurator,
and
- Primary Inferen
c
e En
gin
e
In an a
pprop
riately con
s
tru
c
ted to
pology
of
network, the Pa
cket Ca
tcher capture
s
mo
st
netwo
rk p
a
ckets flowin
g a
c
ro
ss the se
gment of
the
network. After capturi
ng the pa
ckets, the
Packet Catch
e
r p
a
sse
s
th
e pa
ckets to
the Pack
et P
a
rser. T
he P
a
cket Parse
r
doe
s the T
C
P/IP
demultiplexin
g to the pa
ckets for fu
rther pa
cket analyzi
ng an
d pattern m
a
tchin
g
intru
s
ion
detectio
n
by
the Prim
ary I
n
feren
c
e
Eng
i
ne. Th
e Pri
m
ary Infe
ren
c
e E
ngine
inf
e
rs
wheth
e
r l
o
ca
l
su
spi
c
iou
s
a
c
tivities discovered
by LIDM
is a
mali
ciou
s beh
avior. T
he ISD co
nfig
urato
r
man
a
g
e
s
the ISD th
at i
s
the
colle
ction of
seque
n
c
e
de
scri
ptio
ns
of the
net
work intru
s
io
ns. T
he
Net
w
ork
A
d
m
i
ni
s
t
r
a
t
i
on
ne
t
w
or
k
S
ubne
t
3
LI
D
M
3
Se
r
v
e
r
Wo
r
k
S
t
a
t
i
o
n
PC
S
ubne
t
1
Wo
r
k
S
t
a
t
i
o
n
PC
Se
r
v
e
r
LI
D
M
1
Ga
t
e
wa
y
o
r
Hu
b
S
ubne
t
2
Wo
r
k
S
t
a
t
i
o
n
LI
D
M
2
PC
Se
r
v
e
r
S
ubne
t
4
Se
r
v
e
r
PC
LI
D
M
4
Wo
r
k
S
t
a
t
i
o
n
Ga
t
e
wa
y
o
r
H
u
b
GI
D
C
a
n
d
Sur
v
e
i
l
l
a
nc
e
A
g
e
n
t
Ga
t
e
wa
y
o
r
H
u
b
In
t
e
r
n
e
t
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Distrib
u
ted
Network Intru
s
ion
Dete
ctio
n System
with Active Su
rveillan
c
e Agen
t (Bin Zeng)
6260
Secu
rity Officer (NSO
)
u
pdate
s
n
e
w
intrusi
o
n
sig
nature
s
whe
n
ne
w attack te
chni
que
s are
discovered.
Global Intru
s
i
on Dete
ction
Controlle
r
A GIDC is install
ed in
to the n
e
twork cente
r
t
o
commu
nicate with
LI
DMs an
d
admini
s
trate the entire net
work. For the
distribute
d
archite
c
tu
re, the NSO in network center
can
detect
attacks from th
e o
u
tside
o
r
in
si
de of
net
work afte
r
re
ceiv
ing the
info
rmation from
each
LIDM. A GIDC co
ntain
s
five comp
one
nts:
- Information Receiver
- Network
Fac
t
Databa
se (NFD) configu
r
ator
- Intrusio
n Signature Data
base (ISD)
co
nfigurato
r
- Advance
d
Inferen
c
e En
g
i
ne, and
- Alert Mana
ger
The Inform
ation Re
ceive
r
take
s ea
ch LI
DM’s
i
n
tru
s
io
n detectio
n
in
formation a
s
the input
and pa
sse
s
i
t
to the Advanced Infere
nce En
gine.
The Advan
c
e
d
Inferen
c
e
Engine d
e
ci
d
e
s
wheth
e
r the
su
spi
c
iou
s
a
c
tivity
is a maliciou
s
be
havior by obs
ervi
ng cu
rrent ne
twork fact
s a
n
d
comp
ari
ng th
e info
rmation
to the
GIDC
intrusi
on
sig
n
a
ture. T
he
NFD
ha
s the
knowl
edge
of t
h
e
topology a
n
d
con
s
tructio
n
of the enti
r
e
netwo
rk
that
the NSO
ad
ministrates. T
he ISD h
a
s the
kno
w
le
dge
of histo
r
ically known in
trusi
o
n sce
nari
o
s.
Whe
n
the
to
p
o
logy of the
n
e
twork
ch
ang
es
or n
e
w i
n
tru
s
i
on techniq
u
e
s
a
r
e di
scove
r
ed, t
he
NF
D
and ISD
co
nfigurato
r
dyn
a
m
ic u
pdate
s
t
h
e
config
uratio
n
databa
se. The Alert M
anag
er man
age
s the alert gene
rate
d by Advanced
Inferen
c
e En
gine.
Surveillan
c
e
Agent
Surveillan
c
e
is an o
p
tional
function in t
he
propo
sed
SA-NIDS. It is install
ed ph
ysically
on the
sam
e
host
with GIDC. It is comp
ose
d
of two
compon
ents:
Surveillan
c
e
Laun
chi
ng A
gent
and Surveill
ance functio
n
s. Surveilla
nce L
aun
ch
i
ng Agent is resp
on
sible
for the netwo
rk
information gathering and launch
i
ng the information gathering
process
with t
he Surveillance
techni
que
s specifie
d in variou
s Surveill
ance functio
n
s
.
Figure 2. Pro
c
ed
ure
s
of the system o
p
e
r
ation
Pa
c
k
e
t
c
a
pt
ur
i
n
g
R
e
q
u
e
s
t
f
o
r
a
u
t
h
e
n
t
i
c
a
t
.
V
e
ri
fy
t
h
e
id
e
n
ti
f
i
c
a
ti
o
n
o
f
GI
DC
In
fo
rm
a
t
i
o
n
e
n
c
r
y
p
tio
n
E
x
tr
a
c
t t
h
e
sessi
o
n
k
e
y
GI
DC
E
n
d
LI
D
M
En
d
LI
D
M
I
S
D
c
o
n
f
ig
u
r
a
tio
n
Pa
t
t
e
r
n M
a
t
c
h
te
s
t
i
n
g
Enc
r
y
pt
e
d
In
fo
rm
a
t
i
o
n
re
c
e
iv
e
d
NF
D
c
o
n
f
ig
u
r
a
tio
n
GI
D
C
I
S
D
c
o
nf
i
g
ur
a
t
i
o
n
Ad
v
a
n
c
e
d
in
tr
u
s
io
n
d
e
te
c
tio
n
Sur
ve
i
l
l
a
nc
e
la
u
n
c
h
in
g
Al
e
r
t
ma
n
a
g
e
me
n
t
TC
P
/
I
P
d
e
m
u
ltip
l
e
x
Se
s
s
i
o
n
ke
y
gen
e
r
a
t
,
an
d
en
cr
y
p
t
.
Si
g
n
ID
LI
D
E
a
nd
en
cr
y
p
t
t
h
e
si
g
n
a
t
u
r
e
P
r
im
a
r
y
i
n
tr
u
s
io
n
d
e
tc
tio
n
D
e
rc
ry
p
t
i
o
n
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NIKA
Vol. 11, No
. 10, Octobe
r 2013 : 625
8 –
6266
6261
2.2. Procedu
r
es of the SA-NIDS Op
er
ation
A block dia
g
ram is d
r
a
w
n i
n
Figu
re 2 to
sho
w
the p
r
o
c
ed
ure
s
of th
e SA-NIDS
o
peratio
n
and ea
ch o
p
e
r
ation is d
e
scribed b
e
lo
w:
Packet
Captu
r
ing
Some lo
cal
area
network techni
que
s
have t
he b
r
o
adcast p
r
op
e
r
ty that the netwo
rk
adapte
r
s
ca
n
be configu
r
e
d
and
set to run in the
p
r
o
m
iscuou
s m
o
de, whi
c
h all
o
ws the a
dap
ter
to
grab all of the packet
s
that it sees on the
network segment. The
packet
capturing capability is
the lo
we
st la
yer fun
c
tion
provide
d
by t
he Pa
cket
Catche
r in
an
LIDM. Pa
cket Cat
c
he
r u
s
e
s
a
frame
w
ork
of the
low-level netwo
rk moni
toring
to
provi
de an i
n
terfa
c
e for u
s
e
r-lev
el network ra
w
data ca
pturin
g.
TCP/IP
Dem
u
ltiplexing
After the Packet Cat
c
he
r capturin
g the moni
tori
ng ra
w data, it passes the raw data to
the Packet P
a
rser. T
he P
a
cket Pa
rser demultipl
exe
s
the
ra
w d
a
ta from th
e lo
w-level
net
work
proto
c
ol to the high layer
netwo
rk p
r
oto
c
ol an
d map
s
the raw data
to its correspondi
ng network
proto
c
ol he
ad
er and p
a
yloa
d informatio
n step by step.
Intrusio
n Sign
ature Databa
se (ISD) and
Ne
twork Fa
ct Databa
se
(NFD) Config
uration
Histo
r
ically known network intru
s
ion
s
a
nd t
heir
scen
ario
s techniq
ues
can b
e
regulate
d
to se
que
nces of event
s. Int
r
usi
on
sig
nat
ure
s
are
atta
cki
ng
profile
s that a
r
e
de
scription
s
of
the
s
e
seq
uen
ce
s of
events. The ISD contai
ns li
sts an
d
coll
ections of these
kno
w
n intru
s
i
on sig
natures.
The NS
O u
s
es the ISD
configurator to
update t
he I
S
D freq
uently
to reflect the
new di
scove
r
ed
vulnerabilities or network i
n
trus
i
on techniques. Every
LIDM
has it
s own ISD suitable for its own
netwo
rk
environment. Accordin
g to ea
ch ISD, the
NSO can i
n
ference the p
r
im
ary inform
atio
n of
the netwo
rk i
n
trusi
on of ea
ch LAN.
NFD, resi
des in the GIDC, is the topology
and t
he se
cu
rity informatio
n of current
netwo
rk. It contain
s
the
netwo
rk
com
pone
nt in
formation an
d how they a
r
e con
n
e
c
ted
each
other. Su
ch
as the
ho
st IP address a
nd net
ma
sk, the su
bnet I
P
address a
nd netma
sk, the
Internet serve
r
locatio
n
, the serv
e
r
ope
ra
ting system type and
so on.
The GIDC al
so ha
s its ISD suitabl
e for the
entire ne
twork topolo
g
y
. Different from each
LIDM int
r
u
s
io
n si
gnatu
r
e,
the GIDC int
r
usi
on
si
g
nat
ure
emph
asi
z
e
s
the
attacking
profiles
of
entire
net
work (compo
se
d
of several segm
ents
of
networks). For exampl
e,
the distri
but
ed
netwo
rk atta
ck sh
ould b
e
formul
ated in
GIDC intrus
i
o
n sign
ature f
o
r the ch
aracteristics that the
distrib
u
ted attack co
uld not
be discovere
d
simply by each LI
DM.
The
NSO u
s
e
s
the
NF
D co
nfigurato
r
to f
i
gur
e
and
mo
dify the NF
D
whe
n
the top
o
logy of
the network
chang
ed. The
same
proced
ure
s
a
s
in
ea
ch LI
DM’
s
ISD configu
r
ato
r
, the NSO
al
so
use
s
the ISD configu
r
ato
r
to update th
e ISD to
refl
ect the ne
w
discovered v
u
lnerabilitie
s
or
netwo
rk int
r
u
s
ion te
chni
qu
es freq
uently.
Pattern Matching In
tr
us
io
n D
e
te
c
t
ion
Each LIDM compa
r
e
s
the proto
c
ol layer info
rmation
with the LIDM intrusi
on si
gnatures
to see
if so
me of the li
sts of the int
r
usio
n
si
gnatu
r
e mat
c
h
so
mewh
ere in t
he p
r
oto
c
ol l
a
yer
informatio
n. If it does, th
e p
r
otocol laye
r i
n
format
io
n is
forwa
r
d
ed to
the GIDC for
further
pattern
matchin
g
intrusio
n dete
c
ti
on. If it does
not, the pr
oto
c
ol laye
r info
rmation is di
scarde
d o
r
log
g
e
d
into the LIDM
’s file system
for further
a
nalyz
in
g. Some intru
s
ion
behavio
rs
ca
n be inve
stigated
only by the LIDM. If such i
n
trusi
on b
eha
viors a
r
e
di
scovered i
n
the
segm
ent, the
informatio
n will
also b
e
forwa
r
ded to the GI
DC to ge
nera
t
e the
alert or do laun
ch th
e Surveillan
c
e pro
c
e
ss.
The GIDC ta
ke
s the proto
c
ol informatio
n
received from each LIDM as the inp
u
t and
passe
s it to the list
s
of th
e GIDC intru
s
ion
sig
nat
ure to se
e if so
me of the li
sts of the int
r
u
s
ion
sign
ature
s
m
a
tch
so
me
wh
ere
in th
e p
r
otocol
laye
r i
n
formatio
n. If it doe
s, th
e
protocol lay
e
r
informatio
n is forwa
r
d
ed to
the Infere
nce Engine.
If it doe
s not, th
e proto
c
ol l
a
yer info
rmatio
n is
discarded o
r
l
ogge
d into the GIDC’
s f
ile system for fu
rther analy
z
in
g.
Secu
re
Com
m
unication
s
In the propo
sed SA-NIDS,
We woul
d like to
establi
s
h a secure chann
el betwe
en each
LIDM an
d GIDC, so that the se
nsitive i
n
formatio
n wi
ll be encrypt
e
d
. To form a
se
cure chann
el,
the crypto
gra
phy-ba
s
e
d
m
e
ch
ani
sms
su
ch a
s
auth
ent
ication a
nd id
entification a
r
e applie
d. Th
us
no o
ne
can
e
a
vesd
rop
the
se
nsitive inf
o
rmatio
n du
ri
ng tra
n
smissi
on. Also
ea
ch LIDM
ne
ed
s to
verify the identification of the GIDC to
prevent othe
rs
from sp
oofing
the GIDC.
Inferen
c
e an
d
Alert Manag
ement
After pattern
matchi
ng i
s
don
e by LI
DM a
nd
GIDC, th
e an
a
l
yzed
proto
c
ol layer
information will be passed
to the Inference Engine.
Accordi
ng to the NFD in GIDC, the histori
c
al
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Distrib
u
ted
Network Intru
s
ion
Dete
ctio
n System
with Active Su
rveillan
c
e Agen
t (Bin Zeng)
6262
events a
nd t
he security knowl
edge
kn
own
by NS
O,
the Infere
nce Engine
de
cides
wh
ether
the
su
spi
c
iou
s
a
c
tivity is an intrusi
on be
havi
o
r. If it does, GIDC g
ene
rates some al
ert and p
a
sses
the alert to the Alert Manage
r for th
e alert information man
a
gement. The
Alert Mana
ger
manag
es the
alert
s
in
the
file syste
m
, a
nd the
n
mail
s them to
the
NSO. Th
e al
erts al
so
can
be
sent to the NFD configu
r
at
or and ISD
co
nfi
gurato
r
in
GIDC fo
r upd
ating co
nfiguration.
Surveillan
c
e
Laun
chi
n
g
After the Inferen
c
e
Engi
ne di
scovers som
e
a
ttack
s fr
o
m
the o
u
t
s
i
de
or in
s
i
de
.
Surveillan
c
e
Laun
chi
ng A
gent take
s th
e proto
c
ol
a
d
d
re
ss
of the intrude
r an
d the Surveilla
n
c
e
function
s as
input.
T
h
e
Surveillan
c
e
Agent
la
un
ching
slig
ht n
e
twork Surv
eillan
c
e
su
ch
as
WHOIS lookup, TCP/UDP service in
formation
p
r
obing, an
d
the ope
ratin
g
system ty
pe
investigating.
3. Rese
arch
Metho
d
The
reliabilit
y and n
e
two
r
k fe
atures a
r
e the
mo
st
importa
nt factors fo
r I
D
S, in the
prop
osed SA-NIDS, the UNIX oper
atin
g system
s are cho
s
e
n
. T
he SA-NIDS will be develop
ed
on Lin
u
x (Re
dhat-6.0
), Fre
e
BSD-3.4,
an
d SunOS
-
5.
x/Solari
s2.x. Howeve
r, the
SA-NIDS
can
be
eas
ily modified to port to other UNIX s
ystems
.
3.1. LIDM Patter
n
Matchi
ng Mecha
n
is
ms
The
LIDM IS
D h
a
s thre
e
main
com
pon
ents: the
intru
s
ion
type, the
intru
s
ion
he
a
der,
and
the intru
s
io
n
option
s
. {I
ntrusi
on type
, Intrus
io
n h
eade
r, Intru
s
ion optio
n} f
o
rm
s the
LIDM
intrusi
on
sign
ature. Intru
s
i
on type is th
e cate
gor
i
z
ati
on of current
netwo
rk i
n
trusio
n techniq
ues
that have bee
n discovered.
Now the
r
e a
r
e six categ
o
ri
es of intru
s
io
n type. They are info
rmati
o
n
gatheri
ng, tri
v
ial attempts,
buffe
r ove
r
flow, b
a
ckd
oor driving,
web
probing,
an
d
DoS
attacki
ng.
All network in
trusio
n tech
ni
que
s will
be
categori
z
e
d
into these
six types.
Each i
n
tru
s
io
n type maint
a
ins
a two
-
d
i
mensi
on lin
ked list of l
o
gical
structu
r
e. One
dimen
s
ion
is the intrusi
o
n
head
er. Ea
ch intru
s
io
n h
eade
r h
andl
e
s
the
othe
r d
i
mensi
on li
nked
lists, the i
n
trusio
n optio
n. Intrusi
on
he
ader is a
li
st of gen
eral p
a
cket h
eade
r informatio
n
you
want to mo
nitor for
po
ssibl
e malici
o
u
s
b
ehaviors. Th
e
r
e a
r
e u
s
ually
five general intrusi
on h
ead
er
element
s:
-
Protocol: The protocol of the packet that
will be monitored, such as
TCP, UDP or ICMP.
-
Source IP ad
dre
ss/
CIDR b
l
ock: Source
IP addre
s
s/CI
DR
blo
ck spe
c
ifies wh
ere
t
he
po
ssible
intrusi
on from
.
-
De
stination
I
P
address/CI
DR
block: T
he de
stinatio
n IP
addre
ss/CIDR blo
ck spe
c
ifie
s
the
possibl
e local
targets of net
work intrus
i
o
ns from the e
x
ternal or inte
rnal.
-
Source p
o
rt range: T
he
so
urce po
rt ran
ge sp
e
c
ifies
whi
c
h p
o
rt
will be the p
o
ssi
b
le intru
s
io
n
s
from.
-
De
stination
p
o
rt
ra
nge:
De
st
ination
port
rang
e
spe
c
ifies the
po
ssi
b
l
e local target
port o
r
p
o
rt
rang
e the intruder
will attack agai
nst.
Each intrusio
n heade
r ha
ndle
s
a linke
d list of
intrusion optio
n. Intrusi
on opti
on is the
more
detaile
d de
scriptio
n
and i
n
form
ation of n
e
tw
o
r
k intrusi
on te
chni
que
s. It contain
s
detail
ed
informatio
n o
f
some
spe
c
ific
cha
r
a
c
teri
stics
of mali
ci
ous be
haviors. Intru
s
ion
o
p
tion i
s
the
last
step to formal
ize an intrusi
on tech
niqu
e.
The gene
ral i
n
trusi
on optio
n element
s are:
-
Name and Descriptio
ns of
Intrusio
n:
Thi
s
is the
name
and de
scripti
ons
of possib
l
e malici
o
u
s
behavio
rs after
spe
c
ifying
the intru
s
io
n
type and
goi
ng d
o
wn the
two-di
men
s
io
n lin
ked
list
s
from a sp
ecifi
c
intru
s
ion h
e
ader to a
spe
c
ific intru
s
io
n option.
-
IP header
op
tions: Some
of the IP header o
p
tion
s related to net
work
se
curity
for example
s
are IP_TTL,
FSAG_ID, IP_OPT.
-
ICMP hea
de
r option
s
: So
me of the I
C
MP head
er
o
p
tions
relat
e
d to net
work se
cu
rity fo
r
examples
are ICMP_TYPE,
ICMP_CODE, ICMP_SEQ.
-
TCP hea
der
option
s
: Some of the TCP head
er
optio
n
s
relate
d to n
e
twork
securi
ty are FLAG,
SEQ_NUMB
E
R, ACK_NUMBER.
-
Payload optio
ns: Th
e spe
c
i
f
ic data m
a
y be some AS
CII strin
g
s fo
r CGI atta
ck
o
r
some
bina
ry
data to overflow the lo
cal d
e
stinatio
n victims.
In the LIDM side, to do the pattern m
a
tchin
g
intru
s
ion d
e
tectio
n, the Packe
t
Parse
r
parsed th
e n
e
twork
packets, and
se
n
d
to the
Pri
m
ary Inferen
c
e En
gine.
The p
a
cket
s are
recursively p
a
ssed to
LIDM from the i
n
trusio
n type,
i
n
trusi
on h
ead
er to the i
n
tru
s
ion
option
st
ep
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NIKA
Vol. 11, No
. 10, Octobe
r 2013 : 625
8 –
6266
6263
by step. If s
o
mewhe
r
e in
the packets match all
information ind
i
cated in a specifi
c
intru
s
i
o
n
sign
ature,
th
e
pa
ckets wi
ll
be con
s
id
e
r
ed as
t
he suspi
c
io
us or malicio
us, an
d
tran
sfe
r
th
e
packet
s
to GIDC for fu
rthe
r analyzin
g or
alert gen
erating.
3.2. GIDC Pa
tter
n
Matchi
ng Mecha
n
is
ms
The GI
DC ISD al
so
conta
i
ns th
ree
co
mpone
nts: th
e conventio
n
a
l intru
s
io
n t
y
pe, the
head
er/optio
n
inform
ation,
and
the
he
ader/o
pti
on t
h
re
shol
ds.
{
C
onve
n
tional
intru
s
ion
type,
Hea
der/O
ptio
n inform
ation
,
Head
er/O
ption thresh
old}
forms t
he GI
DC i
n
tru
s
ion
sign
ature. T
h
e
conve
n
tional
intrusi
on type
s indi
cate
d some intr
usi
o
n
types (i
n LIDM intru
s
ion
si
gnature),
whi
c
h
can b
e
exten
ded to the di
stribute
d
intru
s
ion te
chni
qu
es. Each con
v
entional intrusio
n type ha
s a
two-di
men
s
io
nal lin
ked
list
.
One di
men
s
ion is the
he
ader/o
ption i
n
formatio
n a
nd e
a
ch
of th
ese
handl
es the o
t
her linked list
,
the header/
option thre
sh
old.
Each
co
nvent
ional int
r
u
s
io
n type ha
ndle
s
a
not
he
r lin
ked list, h
ead
e
r
/option i
n
formation.
The h
ead
er i
n
formatio
n is
simila
r to the
intrus
i
on
hea
der
sp
ecifie
d
in the LI
DM I
S
D. The
opti
o
n
informatio
n is similar to the intrusi
on o
p
tion sp
e
c
ifie
d in the LIDM ISD. The
main differen
c
e
betwe
en th
e
LIDM
ISD’
s intru
s
io
n h
eade
r/inform
ation a
nd th
e GIDC ISD’s h
ead
er/op
t
ion
informatio
n i
s
that the
he
a
der/optio
n inf
o
rmatio
n
in
GIDC ISD i
s
almost
de
sig
ned fo
r th
e e
n
tire
netwo
rk. Th
e detailed i
n
formatio
n a
bout hea
der
/
option information ca
n be found in
the
se
ction 3.
Each h
ead
er/
option info
rm
ation han
dle
s
the other lin
ked li
st, hea
der/optio
n thresh
old.
The h
ead
er/o
ption threshol
d spe
c
ifies
some
statisti
cal characte
ristic ab
out a
sp
ecific dist
ribut
ed
netwo
rk int
r
u
s
ion. The
s
e
chara
c
te
risti
c
s are re
pr
e
s
e
n
t
ed in some
kind of the thresh
old value
of
spe
c
ific net
work pa
cket
(h
eade
r o
r
opti
on) i
n
form
at
ion.
If
the coll
ection
s or set
s
of pa
ckets have
some
network packet informati
on that
reach the threshold value,
the Inference Engine
will
rega
rd the
m
as the mali
ciou
s pa
cket
s. Some net
work p
a
cket
informatio
n a
bout dist
ribut
ed
netwo
rk attacks
and
its thresh
old a
r
e
u
s
ed i
n
the
S
A
-NIDS, they
are
Di
stributi
on of
sou
r
ce
IP
addresse
s, Distri
bution
of
desti
n
a
tio
n
IP add
re
sse
s
, Source
port
ran
g
e
s
, Destin
ation
port
rang
es, Time
statistics, and
Other stati
s
tics.
In the GIDC
side, to do th
e pattern m
a
tchin
g
intru
s
io
n detectio
n
, the pa
ckets receive
d
from the Information Re
cei
v
er are p
a
ssed to t
he GIDC intru
s
ion
si
gnature. If somewh
ere in the
informatio
n matche
s the la
st two sets of
intr
usio
n sig
nature (t
he h
eade
r/option i
n
formatio
n and
the heade
r/o
p
tion statisti
cs), the Infere
nce Engi
ne
will reg
a
rd th
e packet as
a malicio
us p
a
cket
and view the
su
spi
c
iou
s
a
c
tivity as the malicio
us
b
e
havior. The
n
the packet is
sent to the Alert
Manag
er to d
o
some
re
spo
n
sive a
c
tivity.
3.3. Sur
v
eilla
nce Techniques
To achieve the Surveilla
n
c
e techniq
u
e
s
, the
NMAP
prog
ram [11
]
is employed
into the
Surveillan
c
e
Agent of the
SA-NIDS a
s
optional
fun
c
t
i
ons. Th
e Surveillance tech
nique
s curren
tly
have two
sets of fun
c
tion
s, the Surveill
ance lau
n
chi
ng fun
c
tion
s
and the
Surv
eillan
c
e fun
c
ti
ons.
The Surveill
a
n
ce l
aun
chin
g functio
n
s
will take
mali
ciou
s pa
cket
s’ source IP/
C
IDR blo
c
k and
sou
r
ce po
rt range
s a
s
the
input and specifie
s t
he
Surveillan
c
e
type that wishes to sca
n
the
sou
r
ce ho
st or net
work. After spe
c
ifying the
type, the Surveilla
nce L
aun
chi
n
g Agent ch
o
o
se
s
corre
s
p
ondin
g
Surveillan
c
e functio
n
s to
do the a
c
tua
l
information
gatheri
ng. Th
e more detail
e
d
informatio
n a
bout the Surv
eillan
c
e tech
nique
s c
an b
e
found in m
o
st TCP/IP Network textbo
oks
[12].
4. Results a
nd Analy
s
is
In this section, we will apply the SA-NIDS to
our
campus
network to simul
a
te the real
attack
scen
arios a
nd intrusion dete
c
tion
pro
c
e
s
ses.
F
o
r t
he
se
cu
rit
y
con
s
ide
r
at
i
ons,
we r
e
st
ri
ct
the whol
e ex
perim
ent net
work
stru
cture to the ca
m
pus
netwo
rk i
n
Naval En
gineeri
ng
Univ
ersity
(NE
U
). The o
ffensive/defe
n
sive expe
ri
m
ent netwo
rk can be
see
n
in Figure 3.
In the defe
n
si
ve side,
we
construct th
e
d
e
fensive network
in
cl
ude
s one
GI
DC, GIDC-EE
in NEU E.E. netwo
rk a
nd three LI
DM
s, LIDM-
EE, LIDM-DO
R
, an
d LIDM-CC d
i
stribute
d
in NEU
E.E. Network, NEU d
o
rmit
ory net
work,
and
NEU
Co
mputer
Ce
nter n
e
two
r
k. I
n
the othe
r
si
de,
we
con
s
truct
the offen
s
ive network in
NEU
and
on
e attacke
r
ho
st in Tia
n
Ji
n
School
(NET
S).
Attacke
r-1 is in the
NEU dormito
ry n
e
twork, A
ttacker-2 and
Attacker-3 are
i
n
the NEU E.E.
network, and Attacker-4 i
s
in the
NET
S
netwo
rk. T
he sim
u
lated attack utiliti
e
s we used
are
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Distrib
u
ted
Network Intru
s
ion
Dete
ctio
n System
with Active Su
rveillan
c
e Agen
t (Bin Zeng)
6264
Nessus vulnerability assessment
tool [13], SATAN vulnerability as
sessment tool
[14], Nmap port
scann
er [1
1], and SIP DDoS tools [1
5]. All of t
heir
operating
system is th
e UNIX clo
ne. T
h
e
experim
ent n
e
twork is
sho
w
n in Figu
re
3.
Figure 3. Experime
n
t offensive/defen
siv
e
netwo
rk to t
e
st the propo
sed SA-NIDS
We
have
cat
egori
z
e
d
the
netwo
rk intru
s
ion
s
in
to
six
types that
are the trivial
a
ttempts,
buffer ove
r
flo
w
atta
ck, i
n
fo
rmation
gath
e
ring,
ba
ck
do
or d
r
iving,
we
b probin
g
a
n
d
the
DoS
attack
[16]. To be suitable for
ou
r SA-NI
DS di
stribute
d
in
tru
s
ion
dete
c
tio
n
archite
c
ture
, we can furt
her
define
som
e
su
bsets i
n
t
hese
six categori
e
s.
We
define th
e tri
v
ial attempt, buffer ove
r
flo
w
,
backd
oor
driv
ing and th
e web p
r
o
b
ing
attacks a
s
th
e determi
nisti
c
network intrusio
ns a
nd th
en
define the inf
o
rmatio
n gat
herin
g and th
e DoS attacks as the a
m
bi
guou
s net
work intru
s
ion
s
.
The
determi
nisti
c
network intrusio
ns can
be detect
e
d
simply via
the prima
r
y pattern mat
c
hing
mech
ani
sm
s in the LIDM side. For the d
e
termini
s
tic n
e
twork intrusi
ons, the GIDC only nee
d to
receive the i
n
trusi
on
dete
c
tion
re
sults
from the
LIDMs a
nd th
en
gene
rate
s t
he ale
r
t. Fo
r the
ambigu
ou
s at
tacks, it is not
enou
gh to
d
o
the p
r
ima
r
y
pattern
matching int
r
u
s
ion
dete
c
tion in
the
LIDM
side.
The LI
DMs
have to furth
e
r p
a
ss the
su
spi
c
iou
s
p
a
ckets t
o
th
e GIDC
side
for
advan
ced p
a
ttern mat
c
h
i
ng dete
c
tion
or stat
i
s
tical techni
que
s appli
ed. T
hen the GI
DC
gene
rate
s a
n
d
ma
nage
s the al
ert
after the
advan
ced int
r
u
s
ion
detectio
n
fo
r the
ambig
u
ous
netwo
rk int
r
u
s
ion d
e
tectio
n done.
4.1. Examples of the
De
te
rministic Intr
usions
To laun
ch th
e determi
nisti
c
attacks in the o
ffensive
side, the Attacker-1 i
s
ch
ose
n
to
laun
ch the
de
termini
s
tic att
a
cks to
on
e o
f
the ho
sts in
the defen
sive
netwo
rk an
d
install a
set of
widely
spread vulnerabilit
y tools, e.g.,
Ness
us and SATAN. T
o
detec
t these
determini
stic
attac
k
s
,
we firs
t c
o
ns
t
r
uc
t the LIDM intrus
ion
detecti
on sign
ature in the ISD. All the packets
received by the LIDM
will be recursiv
e parsed to
the signatures to do the
primary pattern
matchin
g
intrusio
n dete
c
ti
on. Thu
s
, ba
sed on th
e
a
s
sumption of all
the malici
o
u
s
packet
s
can
be
captu
r
ed
by the LIDM
s’
Packet
Cat
c
her, if the d
e
termini
s
tic n
e
twork int
r
usi
ons la
un
che
d
by
Ne
ssus an
d
SATAN can
be fo
rmulate
d
into th
e
sig
nature
s
,
we
can d
e
tect t
h
e
s
e i
n
tru
s
ion
s
and
obtain
the
IP
add
re
ss of attacker. We
furthe
r
optio
nally sp
ecify
the Surveill
ance optio
ns to
determi
ne th
e p
r
ope
rtie
s
of Attacker-1.
The
TC
P/
UDP port
s
o
pen
ed by
him
are all
be
dete
c
ted
and we ca
n correctly gue
ss its ope
ratin
g
system typ
e
.
4.2. Examples of the
Amb
i
guous Intru
s
ions
We take the
informatio
n g
a
therin
g attack a
s
the ex
ample. In this se
ction, we
do the
ambigu
ou
s n
e
twork int
r
u
s
i
ons
dete
c
tio
n
in the
sam
e
archite
c
ture sh
own in
Figure 3. In
the
of
f
ensiv
e si
d
e
,
we ch
oo
se
A
t
t
a
cker
-
2,
A
t
t
a
cke
r-
3 and
Attacker-4 to
do the port scan
ning a
gai
nst
NE
U
E
E
1
9
2
.
168
.
163
.
X
NE
U
C
C
19
2.
1
6
8.
x.
x
NE
U
D
o
r
m
192
.
1
68.
1
34.
X
NE
U
E
E
1
9
2.
16
8
.
16
3
.
X
LI
D
M
-
E
E
Sol
a
ri
s
-
2.
6
1
92.
168
.
1
63
.20
wi
t
h
LI
D
M
-
DOR
F
r
eeBS
D
-
3
.4
1
9
2
.
168
.
134
.
5
7
GI
D
C
-
E
E
w
ith
C
I
D
M
-
E
E
Fr
eeBS
D
-3.4
192
.
1
68.
163
.
2
3
2
LID
M
-C
C
S
unO
S
-
5
.
6
1
9
2.168
.
5
.
1
A
ttacke
r
-1
N
e
ssus¡
BS
A
T
A
N
DD
o
S
C
l
i
e
nt
,
M
a
s
t
e
r
,
Da
e
m
o
n
Linux R
e
d
h
at-6.
0
192
.
168
.
163.233
A
tta
ck
e
r
-
4
N
m
a
p
Sc
a
n
ne
r
Fr
e
e
B
S
D
1
92.
168
.
39.195
A
ttacker-2
DD
o
S
Da
e
m
o
n
N
m
a
p
P
o
rt
Scanner
L
i
n
u
x Redh
at 6.
0
1
9
2.168
.
163
.
2
4
A
ttacker-
3
DDo
S Da
e
m
o
n
N
m
a
p
P
o
rt
Scanner
Fr
eeBS
D
-3.4
192
.
1
68.16
3
.
232
De
f
e
n
s
i
v
e
Ne
t
w
o
r
k
to t
e
st
th
e pro
p
o
s
ed
SA
-
N
ID
S
Of
f
e
ns
i
v
e
S
i
d
e
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NIKA
Vol. 11, No
. 10, Octobe
r 2013 : 625
8 –
6266
6265
a ho
st, a gro
up of ho
sts,
or an
entire
sub
net of
the
defen
sive n
e
twork. We u
s
e the ex
cell
ent
publi
c
-d
omai
n informatio
n gatheri
ng tool
s NMAP to d
o
the real atta
ck.
Acco
rdi
ng to
the vari
ou
s
kind
s
of sca
n
te
chniqu
es,
we con
s
tru
c
t
the LIDM intrusi
o
n
sign
ature
s
wi
th the same
step as we did
in the
detecti
on example o
f
the determi
nistic int
r
usi
o
ns
for loggin
g
large su
spi
c
io
us packets in th
e LIDM end.
In the GIDC side, we
re
ce
ive all the suspi
c
io
u
s
pa
ckets ca
pture
d
by LIDMs. Th
e most
importa
nt GI
DC intru
s
io
n
sign
ature
s
ab
out the i
n
formation g
a
the
r
ing atta
cks
are the th
re
shol
d of
the numbe
r of the intended co
nne
ctio
n to the sa
m
e
destin
a
tion,
thresh
old of
the number of
packet to
the
same
de
stina
t
ion, thre
shol
d of time
interval and
the th
reshold
of the
time d
u
ratio
n
.
To detect the
various po
rt scanni
ng techniqu
es,
we
simply define
the GIDC intrusi
on si
gnat
ure
as a rule. Thi
s
rul
e
sp
ecifi
e
s the
statisti
cal th
reshold
s
to infer wh
ether the
su
spicio
us p
a
ckets
are mali
cio
u
s. When attackers la
un
ch th
e NMAP pro
c
ess, they will be dete
c
ted.
4.3. Detection Rate of SA-NIDS
A basic
way
to evaluate the perform
ance of
IDS is
the detection rate. To tes
t
the
detectio
n
rate of the SA-NIDS, the
Nessu
s
softw
a
r
e i
s
em
ploy
ed a
s
a
n
att
a
cker to p
e
rf
orm
attack a
c
tivities. A
c
cordi
n
g
to the
fun
c
tions in
th
e
Ne
ssus,
we
divi
ded
attack types that al
re
ady
inclu
ded
in t
he SA-NIDS
into ei
ght
categori
e
s an
d colle
cted t
he d
e
tectio
n
rate
from
the
offensive/def
ensive exp
e
ri
ment
netwo
rk. The detectio
n
rate is
sho
w
n in Tabl
e 1
.
Table 1. The
Dete
ction Rate of SA-NIDS
Categories
No. of Attack
No. of Detection
Detection Rate
Backdoors 26
16
61.54%
CGI ab
uses
128
75
58.59%
Fire
w
a
lls 8
5
62.50%
FTP
25
19
76.00%
Gene
ral 23
13
56.52%
Misc.
17
9
52.94%
NIS 2
1
50.00%
Remote file access
23
8
34.78%
Overall
252
146
57.94%
We
ca
n
see f
r
om th
e Ta
bl
e 1, the to
p
detectio
n
rate (7
6%) i
s
o
n
FTP atta
cks a
nd the
overall
dete
c
tion rate i
s
57.
94%. The
det
ection
rate
is
depe
ndent
on
the intrusi
on
pattern
s in
th
e
ISD. To improve the perfo
rman
ce of th
e SA-NIDS
,
we may ad
d
more int
r
u
s
io
n pattern
s int
o
the
ISD to incre
a
s
e the dete
c
ti
on rate.
5. Conclusio
n
In this pap
e
r
, we integ
r
ate the rule
-
based dete
c
t
i
on algo
rithm
and the st
atistical
anomaly d
e
tection
app
ro
ach i
n
to the
prop
osed SA
-NIDS th
at is based o
n
th
e network-ba
s
ed
intrusi
on det
ection a
r
chite
c
ture. It inclu
des thr
ee ba
sic comp
one
nts, Local Int
r
usi
on Detect
ion
Monitor (LIDM), Global I
n
trusi
on Detection
C
ontroller (GIDC),
and Surveill
ance Agent (SA).
These thre
e comp
one
nts
coo
perat
e wit
h
each other to achieve i
n
trusi
on dete
c
tion, intru
s
io
n
inferri
ng an
d attacki
ng Surveillance.
For effectiven
ess, more pre
c
ise intru
s
ion
detectio
n
me
cha
n
ism
s
sho
u
ld be develo
ped to
redu
ce the
system false a
l
arm. For effi
cien
cy, t
he IDSs
shoul
d
work in
ways that do not affect
the computer system perf
orma
nce too
much.
The proposed SA-NI
DS
still has m
any features
that can be i
m
prove
d
su
ch as ap
plying
more
p
r
eci
s
e intrusi
on d
e
tection me
chani
sm to re
duce
the false al
arm. Ma
ny
impleme
n
tation d
e
tails
still neede
d t
o
be
compl
e
ted, such
as
cryptog
r
a
phy feature
s
. More use
r
frien
d
l
y
conf
igu
r
atio
n of the intru
s
ion
sign
ature databa
se a
nd
the network f
a
ct data
b
a
s
e
is ne
ede
d. The u
s
e
r
inte
rface
should
be imp
r
oved
so that the
SA-
NIDS is practically applie
d in curre
n
t network a
r
chitectures by the
NSO.
A succe
ssful
intrusio
n de
tection sy
ste
m
depen
ds
on seve
ral p
a
ram
e
ters, such a
s
efficiency, effectiveness, flexibilit
y, security, transparency and so
on. The future works include
improvin
g the
perfo
rma
n
ce
of RD-NIIDS
,
devel
opin
g
anomaly
dete
c
tion m
odel
s,
intru
s
ion
types
colle
ction, an
d hetero
gen
e
ous IDS integ
r
ation.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Distrib
u
ted
Network Intru
s
ion
Dete
ctio
n System
with Active Su
rveillan
c
e Agen
t (Bin Zeng)
6266
Referen
ces
[1]
Meera G, Sriv
atsa SK. Detecti
ng and
prev
enting attacks
using net
w
ork
intrusion detec
t
ion s
y
stems
.
Internatio
na
l Journ
a
l of Co
mputer Scie
nce
and Sec
u
rity
. 2
011; 2(1): 4
9
-6
0.
[2]
T
a
rtakovsky
A
G, Polunchenk
o AS, Sokolov
G. Ef
ficient Computer Net
w
ork Anomaly
Detection by
Cha
nge
po
int D
e
tection M
e
tho
d
s.
IEEE Journal of Selected
Topics in S
i
gnal Process
i
ng
. 201
3; 7(1): 4-
11.
[3]
Horasani Zadeh HK, Idris NB.
D
i
s
tri
b
u
t
e
d
In
tru
s
i
o
n
D
e
te
ction
tru
s
t ma
n
a
g
e
m
e
n
t
th
ro
ug
h
in
te
g
r
i
t
y and
expertis
e
ev
al
uatio
n
. Proce
e
d
in
g(s) of 2
0
1
2
Intern
ation
a
l
Confer
enc
e
on C
y
b
e
r S
e
c
u
rit
y
,
C
y
ber
W
a
rfare and D
i
g
ital F
o
re
nsic (
C
yberS
e
c). Kuala L
u
mpur. 2
0
12; 1: 133-
138.
[4]
Saei
d AT
, Behzad
Z
D
, Ah
mad H, B
ehz
ad B. S
y
nt
heti
c
F
eature
T
r
ansformatio
n
w
i
th RBF
n
eura
l
net
w
o
rk to im
prove the Intr
usio
n Detectio
n S
y
st
em Acc
u
rac
y
an
d De
crease Com
p
u
t
ationa
l Costs.
Internatio
na
l Journ
a
l of Infor
m
ati
on a
nd N
e
tw
ork Security
. 201
2; 1(1): 28-
36.
[5]
T
huzar. F
eature Selecti
on an
d F
u
zz
y
Dec
i
s
i
on T
r
ee for Net
w
o
r
k Intrusio
n Detectio
n.
International
Journ
a
l of Infor
m
atics a
nd C
o
mmu
n
icati
on T
e
chn
o
lo
gy
. 201
2; 1(2): 109-1
1
8
.
[6]
Lia
ng Z
,
Xiao-
Hui
Z
.
Rese
arc
h
o
n
R
e
co
nfig
urab
le Intr
usio
n D
e
tectio
n Sy
stem
. Pr
ocee
di
ng(s)
of 2
0
1
2
F
ourth Interna
t
iona
l Co
nfere
n
ce o
n
Multi
m
edi
a Informa
tion N
e
t
w
orki
n
g
an
d Sec
u
rity (MINES)
.
Nanj
in
g. 201
2; 1: 913-9
17.
[7]
F
r
ancois J, Aib
I, Boutaba R.
F
i
reCol: A C
o
ll
abor
at
ive Prote
c
tion Net
w
o
r
k for the Detecti
o
n of F
l
ood
in
g
DDoS Attacks.
IEEE/ACM Tra
n
sactions on Networking
. 20
1
2
; 20(6): 18
28-
184
1.
[8]
Haque MJ, Magld KW, Hunde
w
a
le
N.
An in
tellig
ent ap
pro
a
ch
for
Intrusi
on Detectio
n b
a
sed
on
d
a
ta
mi
nin
g
tech
niq
ues
. Proce
edi
ng(s) of 2
012
Internatio
na
l C
onfere
n
ce on Multimed
ia
C
o
mputin
g
an
d
S
y
stems (ICM
CS). Morocco. 201
2; 1: 12-16.
[9]
Kunl
un G, Jian
ming L, Ji
an G, Rui A.
Study o
n
data ac
qu
isiti
on sol
u
tio
n
of netw
o
rk securit
y
mo
nitori
n
g
system
. Proc
e
edi
ng(s)
of 20
1
0
IEEE Intern
a
t
iona
l C
onfere
n
ce
on Inform
a
t
ion T
heor
y
an
d Informati
on
Securit
y
(ICIT
I
S). Beijin
g. 201
0; 1: 674-6
77.
[10]
Z
a
man S, K
a
rra
y F
T
.
Collaborativ
e
arc
h
itecture for
di
stributed
int
r
usion detection system
.
Procee
din
g
(s)
of IEEE Sy
mposi
u
m on
Comp
utat
ion
a
l
Intellig
enc
e for Securit
y
and D
e
fens
e
Applications. Ottaw
a
. 2009; 1: 1-6.
[11]
Kocher JE, Gilliam DP.
Se
lf port scann
ing
tool: provi
d
in
g a
more sec
u
re com
p
uting environm
ent
throug
h the us
e of proactive
port scann
ing
.
Proceeding(s) of 14th IEEE
International Workshops on
Enab
lin
g T
e
chnol
ogi
es: Infrastructure for Col
l
ab
or
ative E
n
te
rprise. Li
nkop
in
g. 2005; 1: 13
9
-
143.
[12]
Barr
y
BIA, Chan HA.
A Cros
s-protoco
l
ap
pr
oach to
detect
TCP Hijack
in
g attacks
. Pro
c
eed
ing(s)
of
IEEE International Confer
ence on Signal Proc
essing and Comm
unications.
Dubai. 2007; 1: 57-60.
[13] Cha
o
D,
Danf
eng
Y, Yu
n
Y, F
angch
u
n
Y.
A do
main-
o
rie
n
ted
distri
buted
vul
ner
a
b
ility sc
an
nin
g
mec
h
a
n
is
m
. Procee
din
g
(s)
of 2nd IEE
E
Internatio
na
l Confer
enc
e
on Broa
db
a
nd Net
w
o
r
k
&
Multimed
ia T
e
chno
log
y
(IC-B
N
MT '
09). Beijin
g. 2009; 1: 83
1-83
6.
[14]
IváN Arce. Vul
nera
b
il
ities: Vu
l
ner
abi
lit
y
m
a
n
agem
ent at the crossroa
ds.
Journ
a
l of Net
w
ork Security
.
200
8; 20(5): 11
-13.
[15]
Stanek J, Ke
n
c
l L.
SIPp-DD
:
SIP DDoS
F
l
ood-Attack
Simulati
on T
o
ol
. Proce
edi
ng
s of the 2
0
t
h
Internatio
na
l C
onfere
n
ce o
n
Comp
uter Com
m
unic
a
ti
ons a
n
d
Net
w
orks (IC
CCN), Ha
w
a
ii.
201
1; 1: 1-7.
[16]
Mei
x
in
g L, Sta
v
rou A, Kan
g
BB, Doub
leGu
ard: Detecti
n
g
Intrusi
ons in Multitier
W
eb Appl
icatio
ns
.
IEEE Transactions on Dependabl
e and Secur
e
Com
p
uting
. 2
012; 9(4): 5
12-
525.
Evaluation Warning : The document was created with Spire.PDF for Python.