Towards Run-Time Protocol Anomaly Detection and Verification
نویسندگان
چکیده
‘How to verify incoming packets whether they follow standards or not?’ and ‘How to detect protocol anomalies in real-time?’, we seek to answer these questions. In order to solve these questions, we have designed a packet verifier with packet inspection and sanity check. In this work, we specify TCP transaction behaviours declaratively in a high-level language called Specification and Description Language (SDL). This specification will be then compiled into an inspection engine program for oberving packets. In addition, the SanityChecker covers protocol header anomalies.
منابع مشابه
Runtime Detection of Zero-Day Vulnerability Exploits in Contemporary Software Systems
It is argued that runtime verification techniques can be used to identify unknown application security vulnerabilities that are a consequence of unexpected execution paths in software. A methodology is proposed that can be used to build a model of expected application execution paths during the software development cycle. This model is used at runtime to detect exploitation of unknown security ...
متن کاملOn the automatic verification of interaction protocols using g−SCIFF
Interaction protocol verification has been in recent years intensively investigated within and outside multi-agent research. Many techniques and models have been proposed based on a number of assumptions and choices, among which are the kind of knowledge available and the kind of properties that are subject of verification. We focus on interaction protocol verification in open multi-agent syste...
متن کاملAn Adaptive Anomaly Threshold in Artificial Dendrite Cell Algorithm
The dendrite cell algorithm (DCA) relies on the multi-context antigen value (MCAV) to determine the abnormality of a record by comparing it with anomaly threshold. In practice, the threshold is pre-determined before mining based on previous information and the existing MCAV is inefficient when expose to extreme values. This causes the DCA fails to detect unlabeled data if the new pattern distin...
متن کاملAn Adaptive Observation Window for Verifying Configuration Changes in Self-Organizing Networks
The automatic verification of Configuration Management (CM) changes is an important step towards a highlyoptimized Self-Organizing Network (SON). A verification mechanism operates in three steps: based on the CM changes it divides the network into verification areas, assesses those by using an anomaly detection algorithm, and generates CM undo requests for the abnormally performing ones. To suc...
متن کاملDynamic anomaly detection by using incremental approximate PCA in AODV-based MANETs
Mobile Ad-hoc Networks (MANETs) by contrast of other networks have more vulnerability because of having nature properties such as dynamic topology and no infrastructure. Therefore, a considerable challenge for these networks, is a method expansion that to be able to specify anomalies with high accuracy at network dynamic topology alternation. In this paper, two methods proposed for dynamic anom...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2004