Detail publikace

Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Originální název

Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Anglický název

Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Jazyk

en

Originální abstrakt

Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network trac for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform evaluation on five classifiers: Gaussian Nave Bayes, Gaussian Nave Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% - 73.3%, while the FPR is deteriorated only slightly (0.1% - 1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations.

Anglický abstrakt

Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network trac for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform evaluation on five classifiers: Gaussian Nave Bayes, Gaussian Nave Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% - 73.3%, while the FPR is deteriorated only slightly (0.1% - 1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations.

BibTex


@article{BUT155121,
  author="Ivan {Homoliak} and Martin {Teknős} and Dominik {Breitenbacher} and Petr {Hanáček}",
  title="Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach",
  annote="Machine-learning based intrusion detection classifiers are able to detect unknown
attacks, but at the same time they may be susceptible to evasion by obfuscation
techniques. An adversary intruder which possesses a crucial knowledge about
a protection system can easily bypass the detection module. The main objective of
our work is to improve the performance capabilities of intrusion detection
classifiers against such adversaries. To this end, we firstly propose several
obfuscation techniques of remote attacks that are based on the modification of
various properties of network connections; then we conduct a set of comprehensive
experiments to evaluate the effectiveness of intrusion detection classifiers
against obfuscated attacks. We instantiate our approach by means of a tool, based
on NetEm and Metasploit, which implements our obfuscation operators on any TCP
communication. This allows us to generate modified network trac for machine
learning experiments employing features for assessing network statistics and
behavior of TCP connections. We perform evaluation on five classifiers: Gaussian
Nave Bayes, Gaussian Nave Bayes with kernel density estimation, Logistic
Regression, Decision Tree, and Support Vector Machines. Our experiments confirm
the assumption that it is possible to evade the intrusion detection capability of
all classifiers trained without prior knowledge about obfuscated attacks, causing
an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the
training knowledge of the classifiers by a subset of obfuscated attacks, we
achieve a significant improvement of the TPR by 4.21% - 73.3%, while the FPR is
deteriorated only slightly (0.1% - 1.48%). Finally, we test the capability of an
obfuscations-aware classifier to detect unknown obfuscated attacks, where we
achieve over 90% detection rate on average for most of the obfuscations.",
  address="NEUVEDEN",
  chapter="155121",
  doi="10.4108/eai.10-1-2019.156245",
  edition="NEUVEDEN",
  howpublished="online",
  institution="NEUVEDEN",
  number="17",
  volume="5",
  year="2018",
  month="december",
  pages="1--15",
  publisher="NEUVEDEN",
  type="journal article - other"
}