Detecting exploit patterns from network packet streams

摘要: Network-based Intrusion Detection Systems (NIDS), e.g., Snort, Bro or NSM, try to detect malicious network activity such as Denial of Service (DoS) attacks and port scans by monitoring traffic. Research from traffic measurement has identified various patterns that exploits on today's Internet typically exhibit. However, there not been any significant attempt, so far, design algorithms with provable guarantees for detecting exploit packets. In this work, we develop apply data streaming packet streams. In intrusion detection, it is necessary analyze large volumes in an online fashion. Our work addresses scalable analysis under the following situations. (1) Attack can be stealthy nature, which means a few covert attackers might call checking logs days even months, (2) Traffic multidimensional correlations between multiple dimensions maybe important, (3) Sometimes sources may need analyzed combined manner. offer bounds resource consumption approximation error. theoretical results are supported experiments over real traces synthetic datasets.