Detecting Application-Layer Attacks Based on Hidden Semi-Markov Models

Abstract:

This paper presents an application-layer attack detection method based on hidden semi-markov models. In this method, the keywords of an application-layer protocol and their inter-arrival times are used as the observations, a hidden semi-markov model is used to describe the application-layer behaviors of a normal user who is using some application-layer protocol. This method is also based anomaly detection. In theory, application-layer anomaly detection can identify the known, unknown and novel attacks happened on application-layer. The experimental results show that this method can identify several application-layer attacks, and has high detection accuracy and low false positive ratio.

• Periodical: Applied Mechanics and Materials (Volumes 631-632)
• Pages: 923-927
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.631-632.923
• Online since: September 2014
• Authors: Bai Lin Xie*, Qian Sheng Zhang
• Keywords: Anomaly Detection, Application-Layer, Hidden Semi-Markov Model, Protocols’ Keywords

References

[1] Leyla B, Tudor D, Before we knew it: an empirical study of zero-day attacks in the real world, Proceedings of the 2012 ACM conference on Computer and communications security, 2012, pp.833-844.

DOI: 10.1145/2382196.2382284

[2] Shun-Zheng Yu, Hidden Semi-Markov Models, Artificial Intelligence, 2010, Vol. 174, No. 2, pp.215-243.

DOI: 10.1016/j.artint.2009.11.011

[3] Rabiner L R. A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition, Proceedings of the IEEE, 1989, Vol. 77, No. 2, pp.257-286.

DOI: 10.1109/5.18626

[4] Kruegel C, Vigna G, Robertson W. A Multi-model Approach to the Detection of Web-based Attacks, Computer Networks, 2005, Vol. 48, No. 5, pp.717-738.

DOI: 10.1016/j.comnet.2005.01.009

[5] Kruegel C, Vigna G. Anomaly Detection of Web-based Attacks, Proceedings of the 10th ACM Conference on Computer and Communication Security, 2003, pp.251-261.

DOI: 10.1145/948109.948144

[6] Wang K, Stolfo S J. Anomalous Payload-Based Network Intrusion Detection, Proceedings of the Seventh International Symposium on Recent Advances in Intrusion Detection, 2004, pp.203-222.

DOI: 10.1007/978-3-540-30143-1_11

[7] Perdisci R, Ariu D. McPAD: A Multiple Classifier System for Accurate Payload-based Anomaly Detection, Computer Networks, 2009, Vol. 53, No. 6, pp.864-881.

DOI: 10.1016/j.comnet.2008.11.011

[8] Mahoney M V, Chan P K. Learning Nonstationary Models of Normal Network Traffic for Detecting Novel Attacks, Proceedings of the Eighth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2002, pp.376-385.

DOI: 10.1145/775047.775102

[9] Hakem B, Geert Deconinck, Trackling Application-layer DDoS Attacks, Procedia Computer Science, 2012, Vol. 10, pp.432-441.

DOI: 10.1016/j.procs.2012.06.056

[10] Yu, S.Z. H. Kobayashi, An Efficient Forward-backward Algorithm for an Explicit-duration Hidden Markov Model, IEEE Signal Processing Letters, 2003, Vol. 10, No. 1, pp.11-14.

DOI: 10.1109/lsp.2002.806705

[11] Mahoney M V, Chan P K. An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection, Lecture Notes in Computer Science, 2003, pp.220-237.

DOI: 10.1007/978-3-540-45248-5_13

[12] Thakare MSP, Chandurkar MP, Computer Attacks and Intrusion Detection System: A Need Review, International Journal of Computer Science and Applications, 2013, Vol. 6, No. 2, pp.425-436.