Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Characterizing the Modification Space of Signature IDS Rules

Ryan Guide, Eric Pauley, Yohan Beugin, Ryan Sheatsley, Patrick McDaniel

TL;DR

This paper demonstrates that applying modifications to real-world SIDS rules allow for relaxing some constraints and characterizing the performance space of modified rules, and develops an iterative approach for exploring the space of modifications to SIDS rules.

Abstract

Signature-based Intrusion Detection Systems (SIDSs) are traditionally used to detect malicious activity in networks. A notable example of such a system is Snort, which compares network traffic against a series of rules that match known exploits. Current SIDS rules are designed to minimize the amount of legitimate traffic flagged incorrectly, reducing the burden on network administrators. However, different use cases than the traditional one--such as researchers studying trends or analyzing modified versions of known exploits--may require SIDSs to be less constrained in their operation. In this paper, we demonstrate that applying modifications to real-world SIDS rules allow for relaxing some constraints and characterizing the performance space of modified rules. We develop an iterative approach for exploring the space of modifications to SIDS rules. By taking the modifications that expand the ROC curve of performance and altering them further, we show how to modify rules in a directed manner. Using traffic collected and identified as benign or malicious from a cloud telescope, we find that the removal of a single component from SIDS rules has the largest impact on the performance space. Effectively modifying SIDS rules to reduce constraints can enable a broader range of detection for various objectives, from increased security to research purposes.

Characterizing the Modification Space of Signature IDS Rules

TL;DR

This paper demonstrates that applying modifications to real-world SIDS rules allow for relaxing some constraints and characterizing the performance space of modified rules, and develops an iterative approach for exploring the space of modifications to SIDS rules.

Abstract

Signature-based Intrusion Detection Systems (SIDSs) are traditionally used to detect malicious activity in networks. A notable example of such a system is Snort, which compares network traffic against a series of rules that match known exploits. Current SIDS rules are designed to minimize the amount of legitimate traffic flagged incorrectly, reducing the burden on network administrators. However, different use cases than the traditional one--such as researchers studying trends or analyzing modified versions of known exploits--may require SIDSs to be less constrained in their operation. In this paper, we demonstrate that applying modifications to real-world SIDS rules allow for relaxing some constraints and characterizing the performance space of modified rules. We develop an iterative approach for exploring the space of modifications to SIDS rules. By taking the modifications that expand the ROC curve of performance and altering them further, we show how to modify rules in a directed manner. Using traffic collected and identified as benign or malicious from a cloud telescope, we find that the removal of a single component from SIDS rules has the largest impact on the performance space. Effectively modifying SIDS rules to reduce constraints can enable a broader range of detection for various objectives, from increased security to research purposes.
Paper Structure (18 sections, 1 equation, 2 figures, 4 tables)

This paper contains 18 sections, 1 equation, 2 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Snort
  4. Snort Rules
  5. Methodology
  6. The Removal Function
  7. Calculating the Space of Modifications
  8. Iterative Exploration
  9. Evaluation
  10. The Rule Set
  11. Defining a Ground Truth
  12. Creating a Pipeline
  13. The Original Rules
  14. The Pareto Frontier
  15. The Options that Caused Movement
  16. ...and 3 more sections

Figures (2)

  • Figure 1: ROC curves for the original rules, single removals, and the union of all Pareto frontiers.
  • Figure 2: Minimum cost to achieve ideal detection for various costs on false positives and false negatives for the original rules and single removals. The shaded area represents the area reduced by the modifications.