Title:  McPAD: A multiple classifier system for accurate payload-based anomaly detection
Issue Date:  2009
Internal authors: 
Authors:  Perdisci, R; Ariu, Davide; Fogla, P; Giacinto, Giorgio; Lee, W.
Number of authors:  5
Language:  Inglese
Journal:  COMPUTER NETWORKS
Volume:  53
Issue:  6
First page:  864
Last page:  881
Number of pages:  18
Digital Object Identifier (DOI):  http://dx.doi.org/10.1016/j.comnet.2008.11.011
Scopus identifier:  2-s2.0-61749083929
ISI identifier:  WOS:000265197900009
Abstract:  Anomaly-based network intrusion detection systems (IDS) are valuable tools for the defense-in-depth of computer networks. Unsupervised or unlabeled learning approaches for network anomaly detection have been recently proposed. Such anomaly-based network IDS are able to detect (unknown) zero-day attacks, although much care has to be dedicated to controlling the amount of false positives generated by the detection system. As a matter of fact, it is has been shown that the false positive rate is the true limiting factor for the performance of IDS, and that in order to substantially increase the Bayesian detection rate, P(Intrusion/Alarm), the IDS must have a very low false positive rate (e.g., as low as 10(-5) or even lower). In this paper we present McPAD (multiple classifier payload-based anomaly detector), a new accurate payload-based anomaly detection system that consists of an ensemble of one-class classifiers. We show that our anomaly detector is very accurate in detecting network attacks that bear some form of sheH-code in the malicious payload. This holds true even in the case of polymorphic attacks and for very low false positive rates. Furthermore, we experiment with advanced polymorphic blending attacks and we show that in some cases even in the presence of such sophisticated attacks and for a low false positive rate our IDS still has a relatively high detection rate. (
Type: 1.1 Articolo in rivista

Files in This Item:
There are no files associated with this item.

Questionnaire and social

Share on: