Every
computer on the Internet nowadays is a potential target for attack at any
moment. Such attacks may result in services being disabled or system crashes
resulting in losses of critical information. We consider the problem of
detecting these “zero-day” intrusions quickly and accurately upon their very
first appearance.
PAYL
is a payload-based anomaly detector for intrusion detection. Most
current Network Intrusion Detection Systems (NIDS) use packet headers and
derived statistics describing connections and sessions (packet rates, bytes transferred,
etc.) to detect unusual events that are likely attacks, but these approaches are
blind to content of the packet
stream. PAYL is designed to detect attacks that are otherwise normal
connections except that the packets carry bad (anomalous) content indicative of
a new exploits. PAYL augments other sensors and enriches the view of network
traffic to detect malicious events.
PAYL
models the normal application payload of network traffic in a fully automatic,
unsupervised and very efficient fashion. We first compute, during a training
phase, a profile byte frequency distribution and their standard deviation of
the application payload flowing to a single host and port. We then use
Mahalanobis distance during the detection phase to calculate the similarity of
new data against the pre-computed profile. The detector compares this measure
against a threshold and generates an alert when the distance of the new input
exceeds this threshold. We experimentally demonstrate that the site-specific models trained and used for testing by PAYL are capable of
detecting new intrusions with high accuracy.
We
also developed a new approach that correlates ingress/egress PAYL alerts to identify
the worm’s initial propagation. Since our approach only uses packet payloads, unlike other systems, PAYL is not
dependent upon detection of probing or scanning behavior or the prevalence of
common probe payloads, and is especially good for the detection of slow and
stealthy worms. This method also enables
automatic signature generation very early in the worm’s propagation stage.
These signatures can be deployed immediately to network firewalls and content
filters to proactively protect other hosts.
Papers
- Ke Wang, Salvatore J. Stolfo. "Anomalous Payload-based Network Intrusion Detection". RAID, Sept., 2004. [PDF]
- Ke Wang, Gabriela Cretu, Salvatore J. Stolfo "Anomalous Payload-based Worm Detection and Signature Generation" Proceedings of the Eighth International Symposium on Recent Advances in Intrusion Detection(RAID 2005) [PDF]
Sponsor:
