Detail publikace

Exploitation of NetEm Utility for Non-payload-based Obfuscation Techniques Improving Network Anomaly Detection

Originální název

Exploitation of NetEm Utility for Non-payload-based Obfuscation Techniques Improving Network Anomaly Detection

Anglický název

Exploitation of NetEm Utility for Non-payload-based Obfuscation Techniques Improving Network Anomaly Detection

Jazyk

en

Originální abstrakt

The main objective of our work is to aid in the improvement of attack detection capabilities of machine learning based network anomaly detection. The paper leverages several techniques aimed at obfuscation of remote attacks which are based on the modification of various properties of network flows. We present a tool, based on NetEm utility and Metasploit framework, which serves for automatic exploitation of network vulnerabilities enabling utilization of obfuscation techniques. The tool is applied to the chosen set of network attacks and later we use captured data for data mining experiments employing anomaly detection features called Advanced Security Network Metrics which were designed in our previous work. Experiments confirm the assumption of achieving a better classification recall and precision only in the case of obfuscated attacks are included into a training process of the Naive Bayes classifier compared to training without prior knowledge about them. We perform accuracy evaluation of all suggested obfuscations, whereby the most successful ones are based on combinations of several techniques and damaging of packets. Experimentally, our approach does not consider a normalizer of network traffic, as there were described performance and platform dependence issues with normalizers as well as differences and problems with various implementations.

Anglický abstrakt

The main objective of our work is to aid in the improvement of attack detection capabilities of machine learning based network anomaly detection. The paper leverages several techniques aimed at obfuscation of remote attacks which are based on the modification of various properties of network flows. We present a tool, based on NetEm utility and Metasploit framework, which serves for automatic exploitation of network vulnerabilities enabling utilization of obfuscation techniques. The tool is applied to the chosen set of network attacks and later we use captured data for data mining experiments employing anomaly detection features called Advanced Security Network Metrics which were designed in our previous work. Experiments confirm the assumption of achieving a better classification recall and precision only in the case of obfuscated attacks are included into a training process of the Naive Bayes classifier compared to training without prior knowledge about them. We perform accuracy evaluation of all suggested obfuscations, whereby the most successful ones are based on combinations of several techniques and damaging of packets. Experimentally, our approach does not consider a normalizer of network traffic, as there were described performance and platform dependence issues with normalizers as well as differences and problems with various implementations.

BibTex


@inproceedings{BUT144383,
  author="Ivan {Homoliak} and Martin {Teknős} and Maroš {Barabas} and Petr {Hanáček}",
  title="Exploitation of NetEm Utility for Non-payload-based Obfuscation Techniques Improving Network Anomaly Detection",
  annote="The main objective of our work is to aid in the improvement of attack detection
capabilities of machine learning based network anomaly detection. The paper
leverages several techniques aimed at obfuscation of remote attacks which are
based on the modification of various properties of network flows. We present
a tool, based on NetEm utility and Metasploit framework, which serves for
automatic exploitation of network vulnerabilities enabling utilization of
obfuscation techniques. The tool is applied to the chosen set of network attacks
and later we use captured data for data mining experiments employing anomaly
detection features called Advanced Security Network Metrics which were designed
in our previous work. Experiments confirm the assumption of achieving a better
classification recall and precision only in the case of obfuscated attacks are
included into a training process of the Naive Bayes classifier compared to
training without prior knowledge about them. We perform accuracy evaluation of
all suggested obfuscations, whereby the most successful ones are based on
combinations of several techniques and damaging of packets. Experimentally, our
approach does not consider a normalizer of network traffic, as there were
described performance and platform dependence issues with normalizers as well as
differences and problems with various implementations.",
  address="Springer International Publishing",
  booktitle="Proceedings of 12th International Conference on Security and Privacy in Communication Networks",
  chapter="144383",
  doi="10.1007/978-3-319-59608-2",
  edition="Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering",
  howpublished="online",
  institution="Springer International Publishing",
  year="2017",
  month="june",
  pages="770--773",
  publisher="Springer International Publishing",
  type="conference paper"
}