NATE: Network Analysis of Anomalous Traffic Events, a low-cost approach

ABSTRACT

A new approach to network intrusion detection is needed to solve the monitoring problems of high volume network data and the time constraints for Intrusion Detection System (IDS) management. Most current network IDS's have not been specifically designed for high speed traffic or low maintenance. We propose a solution to these problems which we call NATE, Network Analysis of Anomalous Traffic Events. Our approach features minimal network traffic measurement, an anomaly-based detection method, and a limited attack scope. NATE is similar to other lightweight approaches in its simplified design, but our approach, being anomaly based, should be more efficient in both operation and maintenance than other lightweight approaches. We present the method and perform an empirical test using MIT Lincoln Lab's data.

REFERENCES

• 1: J. Allen et al. State of the practice intrusion detection technologies. Carnegie Mellon, SEI, Tech Report, CMU/SEI-99-TR-028, ESC-99-028, January 2000.
• 2: Stephanie Forrest , Steven A. Hofmeyr , Anil Somayaji, Computer immunology, Communications of the ACM, v.40 n.10, p.88-96, Oct. 1997 [doi>10.1145/262793.262811]
• 3: L. T. Heberlein, G. V. Dias, K. N. Levitt, B. Mukherjee, J. Wood, and D. Wolber.A network security monitor. In Proceedings of the IEEE Symposium on Research in Security and Privacy, Oakland, CA, April 1990.
• 4: Steven A. Hofmeyr , Stephanie A. Forrest, Architecture for an Artificial Immune System, Evolutionary Computation, v.8 n.4, p.443-473, December 2000 [doi>10.1162/106365600568257]
• 5: V. Jacobson, C. Leres, and S. McCanne. tcpdump. LBNL, University of California, June 1997, ftp://ftp.ee.lbl.gov/tcpdump.tar.Z.
• 6: H. S. Javitz, and A. Valdes. The NIDES statistical component: description and justification. Tech. Report, Computer Science Lab., SRI-Int., Menlo Park, CA, March 1994.
• 7: D. E. Johnson. Applied Multivariate Methods for Data Analysis. Brooks/Cole Publishing Co., 1998.
• 8: L. Kaufman and P. J. Rousseeuw. Finding Groups in Data: An Introduction to Cluster Analysis. Wiley Series in Probability and Mathematical Statistics, John Wiley and Sons, Inc., 1990.
• 9: K. Kendell. A database of computer attacks for the evaluation of intrusion detection systems. Masters Thesis, MIT, June 1999
• 10: R. Lippmann and M. Zissman. Intrusion detection technical evaluation --- 1998 project summary. www.darpa.mit/ito.
• 11: Peter G. Neumann , Phillip A. Porras, Experience with EMERALD to Date, Proceedings of the Workshop on Intrusion Detection and Network Monitoring, p.73-80, April 09-12, 1999
• 12: S. Northcutt, V. Irwin, B. Ralph. Shadow. Naval Surface Warfare Center Dahlgren Lab., 1998.
• 13: V. Paxson. Experiences learned from Bro. login; The Usenix Assoc. Magazine, Sept. 1999, 21-22.
• 14: Marcus J. Ranum , Kent Landfield , Michael T. Stolarchuk , Mark Sienkiewicz , Andrew Lambeth , Eric Wall, Implementing a Generalized Tool for Network Monitoring, Proceedings of the 11th Conference on Systems Administration, p.1-8, October 26-31, 1997
• 15: M. Roesch. Snort --- lightweight intrusions detection for networks. www.clark.net/~roesch/security.html.
• 16: D. Ruiu. Cautionary tales: stealth coordinated attack howto.www.nswc.navy.mil/ISSEC/CID/Stealth_Coordinated_Attack.html. 1999.
• 17: SAS Institute. SAS/STAT Users' Guide, Version 6, Fourth Edition, Vol. 1, SAS Institute, 1990.
• 18: R. L. Scheaffer, W. Mendenhall III and R. L. Ott. Elementary Survey Sampling. Wadsworth Publ. Co., 1996.
• 19: S. E. Smaha. Haystack: an intrusion detection system. Proceedings IEEE Fourth Aerospace Computer Science Applications Conference, Orlando, FL, Dec. 1988.
• 20: S. E. Smaha, T. Grance, D. M. Teal and D. Mensur. Dids --- motivation, architecture, and an early prtotype. Proceedings of 14th National Computer Security Conference, Washington, DC, Oct. 1991.
• 21: Anil Somayaji , Steven Hofmeyr , Stephanie Forrest, Principles of a computer immune system, Proceedings of the 1997 workshop on New security paradigms, p.75-82, September 23-26, 1997, Langdale, Cumbria, United Kingdom [doi>10.1145/283699.283742]
• 22: S. Staniford-Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, D. Zerkle. GrIDS --- a graph-based intrusion detection system for large networks. The 19th National Information Systems Security Conference, Oct. 1998.
• 23: G. Vigna , R. A. Kemmerer, NetSTAT: A Network-Based Intrusion Detection Approach, Proceedings of the 14th Annual Computer Security Applications Conference, p.25, December 07-11, 1998

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network monitoring

Additional Classification:
  B. Hardware
  B.2 ARITHMETIC AND LOGIC STRUCTURES
      B.2.4 High-speed Arithmetic
          Subjects: Cost/performance

  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network management

General Terms:
Management, Security