N-Gram against the Machine: On the Feasibility of the N-Gram Network Analysis for Binary Protocols

摘要: In recent years we have witnessed several complex and high-impact attacks specifically targeting "binary" protocols (RPC, Samba and, more recently, RDP). These could not be detected by current --- signature-based detection solutions, while at least in theory they state-of-the-art anomaly-based systems. This raises once again the still unanswered question of how effective systems are practice. To contribute to answering this question, paper investigate effectiveness a widely studied category network intrusion systems: algorithms using n-gram analysis for payload inspection. Specifically, present thorough evaluation variants on real-life environments. Our tests show that analyzed systems, presence data with high variability, cannot deliver low false positive rates same time.