Over-Threshold Multiparty Private Set Intersection for Collaborative Network Intrusion Detection

TL;DR

The paper tackles privacy challenges in collaborative network intrusion detection by proposing OT-MP-PSI to identify IPs appearing in at least $t$ of $N$ institutions without exposing non-threshold data. It introduces a novel hashing scheme that reduces the aggregation complexity from $O(M(N \log M / t)^{2t})$ to $O(t^2 M \binom{N}{t})$, enabling practical use on real logs. The approach supports two deployment modes: a collusion-safe, interactive option and a non-interactive option with a non-colluding aggregator, with thorough security and performance analyses. Evaluation on CANARIE IDS data demonstrates reconstruction times around a few hundred seconds for hundreds of institutions, illustrating real-world viability for privacy-preserving multi-institution threat detection.

Abstract

An important function of collaborative network intrusion detection is to analyze the network logs of the collaborators for joint IP addresses. However, sharing IP addresses in plain is sensitive and may be even subject to privacy legislation as it is personally identifiable information. In this paper, we present the privacy-preserving collection of IP addresses. We propose a single collector, over-threshold private set intersection protocol. In this protocol $N$ participants identify the IP addresses that appear in at least $t$ participant's sets without revealing any information about other IP addresses. Using a novel hashing scheme, we reduce the computational complexity of the previous state-of-the-art solution from $O(M(N \log{M}/t)^{2t})$ to $O(t^2M\binom{N}{t})$, where $M$ denotes the dataset size. This reduction makes it practically feasible to apply our protocol to real network logs. We test our protocol using joint networks logs of multiple institutions. Additionally, we present two deployment options: a collusion-safe deployment, which provides stronger security guarantees at the cost of increased communication overhead, and a non-interactive deployment, which assumes a non-colluding collector but offers significantly lower communication costs and applicable to many use cases of collaborative network intrusion detection similar to ours.

Figures (11)

• Figure 1: The OT-MP-PSI protocol visualization for parameters ${N=6}, {M=5}, {t=3}$
• Figure 2: Oblivious Pseudo-Randon Secret Sharing (OPR-SS) Functionality $\mathcal{F}_{OPR\!-\!SS}$
• Figure 3: OT-MP-PSI Functionality $\mathcal{F}_{OT\!-\!MP\!-\!PSI}$
• Figure 4: The new hashing scheme. Every participant creates multiple tables, $\mathbb{P}$ is the polynomial function, $h_K$ is the keyed hash function used for mapping, and $H_K$ is the keyed hash function used for pseudo-random ordering. The tuples in boxes represent the points on the polynomial, i.e. secret shares, and light gray numbers represent the dummy shares.
• Figure 5: Number of missed Intersection Elements in $10^7$ trials ($M=200, t=4$)

Theorems & Definitions (12)

• Theorem 1
• proof
• Theorem 2
• proof
• Theorem 3
• proof
• Theorem 4
• proof
• Theorem 5
• proof