Detail publikace

ASNM Datasets: A Collection of Network Traffic Features for Testing of Adversarial Classifiers and Network Intrusion Detectors

Originální název

ASNM Datasets: A Collection of Network Traffic Features for Testing of Adversarial Classifiers and Network Intrusion Detectors

Anglický název

ASNM Datasets: A Collection of Network Traffic Features for Testing of Adversarial Classifiers and Network Intrusion Detectors

Jazyk

en

Originální abstrakt

In this paper, we present three datasets that have been built from network traffic traces using ASNM features, designed in our previous work. The first dataset was built using a state-of-the-art dataset called CDX 2009, while the remaining two datasets were collected by us in 2015 and 2018, respectively. These two datasets contain several adversarial obfuscation techniques that were applied onto malicious as well as legitimate traffic samples during the execution of particular TCP network connections. Adversarial obfuscation techniques were used for evading machine learning-based network intrusion detection classifiers. Further, we showed that the performance of such classifiers can be improved when partially augmenting their training data by samples obtained from obfuscation techniques. In detail, we utilized tunneling obfuscation in HTTP(S) protocol and non-payload-based obfuscations modifying various properties of network traffic by, e.g., TCP segmentation, re-transmissions, corrupting and reordering of packets, etc. To the best of our knowledge, this is the first collection of network traffic metadata that contains adversarial techniques and is intended for non-payload-based network intrusion detection and adversarial classification. Provided datasets enable testing of the evasion resistance of arbitrary classifier that is using ASNM features.

Anglický abstrakt

In this paper, we present three datasets that have been built from network traffic traces using ASNM features, designed in our previous work. The first dataset was built using a state-of-the-art dataset called CDX 2009, while the remaining two datasets were collected by us in 2015 and 2018, respectively. These two datasets contain several adversarial obfuscation techniques that were applied onto malicious as well as legitimate traffic samples during the execution of particular TCP network connections. Adversarial obfuscation techniques were used for evading machine learning-based network intrusion detection classifiers. Further, we showed that the performance of such classifiers can be improved when partially augmenting their training data by samples obtained from obfuscation techniques. In detail, we utilized tunneling obfuscation in HTTP(S) protocol and non-payload-based obfuscations modifying various properties of network traffic by, e.g., TCP segmentation, re-transmissions, corrupting and reordering of packets, etc. To the best of our knowledge, this is the first collection of network traffic metadata that contains adversarial techniques and is intended for non-payload-based network intrusion detection and adversarial classification. Provided datasets enable testing of the evasion resistance of arbitrary classifier that is using ASNM features.

BibTex


@article{BUT162288,
  author="Ivan {Homoliak} and Petr {Hanáček}",
  title="ASNM Datasets: A Collection of Network Traffic Features for Testing of Adversarial Classifiers and Network Intrusion Detectors",
  annote="In this paper, we present three datasets that have been built from network
traffic traces using ASNM features, designed in our previous work. The first
dataset was built using a state-of-the-art dataset called CDX 2009, while the
remaining two datasets were collected by us in 2015 and 2018, respectively. These
two datasets contain several adversarial obfuscation techniques that were applied
onto malicious as well as legitimate traffic samples during the execution of
particular TCP network connections. Adversarial obfuscation techniques were used
for evading machine learning-based network intrusion detection classifiers.
Further, we showed that the performance of such classifiers can be improved when
partially augmenting their training data by samples obtained from obfuscation
techniques. In detail, we utilized tunneling obfuscation in HTTP(S) protocol and
non-payload-based obfuscations modifying various properties of network traffic
by, e.g., TCP segmentation, re-transmissions, corrupting and reordering of
packets, etc. To the best of our knowledge, this is the first collection of
network traffic metadata that contains adversarial techniques and is intended for
non-payload-based network intrusion detection and adversarial classification.
Provided datasets enable testing of the evasion resistance of arbitrary
classifier that is using ASNM features.",
  address="NEUVEDEN",
  chapter="162288",
  edition="NEUVEDEN",
  howpublished="print",
  institution="NEUVEDEN",
  volume="NEUVEDEN",
  year="2019",
  month="december",
  pages="0--0",
  publisher="NEUVEDEN",
  type="journal article - other"
}