An Architecture for Generating Semantics-Aware Signatures
نویسندگان
چکیده
Identifying new intrusions and developing effective signatures that detect them is essential for protecting computer networks. We present Nemean, a system for automatic generation of intrusion signatures from honeynet packet traces. Our architecture is distinguished by its emphasis on a modular design framework that encourages independent development and modification of system components and protocol semantics awareness which allows for construction of signatures that greatly reduce false alarms. The building blocks of our architecture include transport and service normalization, intrusion profile clustering and automata learning that generates connection and session aware signatures. We demonstrate the potential of Nemean’s semantics-aware, resilient signatures through a prototype implementation. We use two datasets to evaluate the system: (i) a production dataset for false-alarm evaluation and (ii) a honeynet dataset for measuring detection rates. Signatures generated by Nemean for NetBIOS exploits had a 0% false-positive rate and a 0.04% false-negative rate.
منابع مشابه
A Context-aware Architecture for Mental Model Sharing through Semantic Movement in Intelligent Agents
Recent studies in multi-agent systems are paying increasingly more attention to the paradigm of designing intelligent agents with human inspired concepts. One of the main cognitive concepts driving the core of many recent approaches in multi agent systems is shared mental models. In this paper, we propose an architecture for sharing mental models based on a new concept called semantic movement....
متن کاملAn Architecture for Generating Semantic Aware Signatures
Identifying new intrusion exploits and developing effective detection signatures for them is essential for protecting computer networks. We present Nemean, a system for automatic generation of intrusion signatures from honeynet packet traces. Our architecture is distinguished by its emphasis on a modular design framework that encourages independent development and modification of system compone...
متن کاملContextual Semantic Search Navigation
Search has for a long time been an important tool for users seeking information. Manypopular search systems have been based on keyword search. However, such systems arenot that well adapted to explore the search space. Effective exploration requires systemswhich can guide the user in his quest. The main focus of this thesis is to generate a framework for semantic navigational search...
متن کاملAdaptive Semantics-Aware Malware Classification
Automatic malware classification is an essential improvement over the widely-deployed detection procedures using manual signatures or heuristics. Although there exists an abundance of methods for collecting static and behavioral malware data, there is a lack of adequate tools for analysis based on these collected features. Machine learning is a statistical solution to the automatic classificati...
متن کاملDesign of a novel congestion-aware communication mechanism for wireless NoC architecture in multicore systems
Hybrid Wireless Network-on-Chip (WNoC) architecture is emerged as a scalable communication structure to mitigate the deficits of traditional NOC architecture for the future Multi-core systems. The hybrid WNoC architecture provides energy efficient, high data rate and flexible communications for NoC architectures. In these architectures, each wireless router is shared by a set of processing core...
متن کامل