Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems
Network evasions can bypass network intrusion detection/prevention systems to deliver exploits, attacks, or malware to victims without being detected. This paper presents a novel method for the detection and recognition of atomic network evasions by the classification of a transmission control proto...
| Principais autores: | , , , , |
|---|---|
| Formato: | Artigo |
| Idioma: | English |
| Publicado em: |
IEEE
2019-01-01
|
| coleção: | IEEE Access |
| Assuntos: | |
| Acesso em linha: | https://ieeexplore.ieee.org/document/8750789/ |
| _version_ | 1831589281286586368 |
|---|---|
| author | Jia Jingping Chen Kehua Chen Jia Zhou Dengwen Ma Wei |
| author_facet | Jia Jingping Chen Kehua Chen Jia Zhou Dengwen Ma Wei |
| author_sort | Jia Jingping |
| collection | DOAJ |
| description | Network evasions can bypass network intrusion detection/prevention systems to deliver exploits, attacks, or malware to victims without being detected. This paper presents a novel method for the detection and recognition of atomic network evasions by the classification of a transmission control protocol (TCP) stream's packet behavior. The syntax for the conversion of TCP streams to codeword streams is proposed to facilitate the extraction of statistical features while preserving the evasion behavior attributes of original network flows. We developed a feature extraction method of employing the normalized term frequencies of codewords to characterize intra and inter packet attribute patterns hidden in actual TCP streams. A TCP stream is then transformed to a fixed length numeric feature vector. Supervised multi-class classifiers are built on the extracted feature vectors to differentiate different types of evasions from normal streams. The quantitative evaluations on an evasion dataset consisting of normal network flows and eight types of atomic evasion flows demonstrated that the proposed approach achieved an encouraging performance with an accuracy of 98.95%. |
| first_indexed | 2024-12-18T00:41:29Z |
| format | Article |
| id | doaj.art-d34c999617d947e7980d3a7dd46b3a39 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-18T00:41:29Z |
| publishDate | 2019-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-d34c999617d947e7980d3a7dd46b3a392022-12-21T21:26:53ZengIEEEIEEE Access2169-35362019-01-017878168782610.1109/ACCESS.2019.29256398750789Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention SystemsJia Jingping0https://orcid.org/0000-0001-8450-3753Chen Kehua1Chen Jia2Zhou Dengwen3Ma Wei4School of Control and Computer Engineering, North China Electric Power University, Beijing, ChinaSchool of Control and Computer Engineering, North China Electric Power University, Beijing, ChinaChina Communications Asset Management Company Ltd., Beijing, ChinaSchool of Control and Computer Engineering, North China Electric Power University, Beijing, ChinaSchool of Control and Computer Engineering, North China Electric Power University, Beijing, ChinaNetwork evasions can bypass network intrusion detection/prevention systems to deliver exploits, attacks, or malware to victims without being detected. This paper presents a novel method for the detection and recognition of atomic network evasions by the classification of a transmission control protocol (TCP) stream's packet behavior. The syntax for the conversion of TCP streams to codeword streams is proposed to facilitate the extraction of statistical features while preserving the evasion behavior attributes of original network flows. We developed a feature extraction method of employing the normalized term frequencies of codewords to characterize intra and inter packet attribute patterns hidden in actual TCP streams. A TCP stream is then transformed to a fixed length numeric feature vector. Supervised multi-class classifiers are built on the extracted feature vectors to differentiate different types of evasions from normal streams. The quantitative evaluations on an evasion dataset consisting of normal network flows and eight types of atomic evasion flows demonstrated that the proposed approach achieved an encouraging performance with an accuracy of 98.95%.https://ieeexplore.ieee.org/document/8750789/Network intrusion detection/preventionnetwork evasionterm frequency and inverse document frequency |
| spellingShingle | Jia Jingping Chen Kehua Chen Jia Zhou Dengwen Ma Wei Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems IEEE Access Network intrusion detection/prevention network evasion term frequency and inverse document frequency |
| title | Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems |
| title_full | Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems |
| title_fullStr | Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems |
| title_full_unstemmed | Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems |
| title_short | Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems |
| title_sort | detection and recognition of atomic evasions against network intrusion detection prevention systems |
| topic | Network intrusion detection/prevention network evasion term frequency and inverse document frequency |
| url | https://ieeexplore.ieee.org/document/8750789/ |
| work_keys_str_mv | AT jiajingping detectionandrecognitionofatomicevasionsagainstnetworkintrusiondetectionpreventionsystems AT chenkehua detectionandrecognitionofatomicevasionsagainstnetworkintrusiondetectionpreventionsystems AT chenjia detectionandrecognitionofatomicevasionsagainstnetworkintrusiondetectionpreventionsystems AT zhoudengwen detectionandrecognitionofatomicevasionsagainstnetworkintrusiondetectionpreventionsystems AT mawei detectionandrecognitionofatomicevasionsagainstnetworkintrusiondetectionpreventionsystems |