Automated Intrusion Detection and Prevention System over SPIT (AIDPoS)

Chapter 5 - Intrusion Prevention and Detection Systems

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

Recently, plenty of voice quality measuring devices of VoIP(Voice over Internet Protocol) service is developed to support high quality VoIP service for communication. However, the existing voice quality measuring devices select the unique measurement method, which uses PESQ(Perceptual Evaluation of Speech Quality) or R-factor only. However, the each voice quality measurement method differs from its usage and assumed range, which leads to the slightly different results at the same testing area for voice services. At the actual VoIP service business and related regulatory organizations, they request to use the above two types of algorithm at the same time for measuring voice quality. However, the development expenses are very high to use the above two types of algorithm at the same time for measuring voice quality due to additional resources and subsidiary devices. VoIP business and regulatory agencies also request the hardware specification of the voice quality measurement device is similar to that of VoIP service user terminal, considering VoIP service supply at the wireless mobile internet such as WiBro(Wireless Broadband). In this paper, we present the voice quality measurement method by using of the above two algorithms at the one physical measurement device at the same time for more accurate and reliable VoIP voice quality measurement. In addition, we introduce the development method of the voice quality measurement device with relatively low cost.

The philosophy of the IoT world is becoming important for a projected, always-connected world. The 5G networks will significantly improve the value of 4G networks in the day-to-day world, making them fundamental to the next-generation IoT device networks. This article presents the current advances in the improvement of the standards, which simulate 5G networks. This article evaluates the experience that the authors gained when implementing Vodafone Romania 5G network services, illustrates the experience gained in context by analyzing relevant peer-to-peer work and used technologies, and outlines the relevant research areas and challenges that are likely to affect the design and implementation of large 5G data networks. This paper presents a machine learning-based real-time intrusion detection system with the corresponding intrusion prevention system. The convolutional neural network (CNN) is used to train the model. The system was evaluated in the context of the 5G data network. The smart intrusion detection system (IDS) takes the creation of software-defined networks into account. It uses models based on artificial intelligence. The system is capable to reveal not previously detected intrusions using software components based on machine learning, using the convolutional neural network. The intrusion prevention system (IPS) blocks the malicious traffic. This system was evaluated, and the results confirmed that it provides higher efficiencies compared to less overhead-like approaches, allowing for real-time deployment in 5G networks. The offered system can be used for symmetric and asymmetric communication scenarios.

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

Attack-aware Security Function Management

This paper presents Intrusion Detection Systems (IDS), Intrusion Detection and Prevention Systems (IDPS) and their classification emphasizing on the use of neural networks in IDS. Contemporary IDS usually include both signature verification and anomaly detection approaches realized by rule-based expert system and statistical module correspondingly. Neural networks may be used mainly as additional module to the statistical module to better recognize the user behavior. User behavior may be represented as frequency pattern of users command history. The paper presents an example of user profile vector for Unix-based platforms.

The Internet is the darling of the information age. Its rapid development has brought a lot of wealth to the society, but it has also brought about increasingly serious security problems. In particular, the widespread application of e-commerce has made network security the most important part of the development of network technology. Network security technology is increasingly valued by computer researchers. Most of the existing security products are passive. The firewall can only be statically disabled. Although the Intrusion Detection System can dynamically detect the intrusion behavior, it cannot block the detected attack behavior. However, the impact of the intrusion prevention system on network performance and the high intrusion detection false alarm rate restrict the development and application of the IPS system. Especially on gigabit high-speed networks, performance has become the primary bottleneck of IPS systems. In view of the above problems, this paper proposes a distributed intrusion detection and blocking system that can run efficiently on high-speed networks. Such systems are also known as intrusion prevention systems IPS. Explain the structure of distributed high-speed network intrusion prevention system, and also introduce the related implementation technology and the realization of each part of distributed intrusion prevention system.

Unsolicited bulk email or spam is a menace to the usability of Internet email. The possibility of cheap Voice over IP (VoIP) services have introduced the threat of Spam over Internet Telephony (SPIT). A previously unexperimented solution for tackling the spam machinery is to increase its cost via Human Interactive Proofs (HIP). These proofs are basically applicable to all kind of spam, including email, but we concentrate on the Session Initiation Protocol (SIP) in this paper. Our approach allows the use of varying kinds of HIPs to prevent automated call connection attempts. The HIPs are used as an enrollment feature for configuring the call-recipient's call pass or block lists. By giving a proof of humanity, the caller is automatically put e.g. to the call-recipient's graylist for further processing by the user. The approach can be also used to mitigate unsolicited call connection attempts made by humans. We also present our SIP signaling based solution to address the SPIT threat.

In order to provide the same or better service quality in the Internet than traditional circuit-switched telephone network, a number of issues have to be solved which have hampered it in the Internet. Therefore, in this paper the VoIP (Voice over Internet Protocol) network design problems are modeled as nonlinear non convex combinatorial integer mathematical programming problems. The optimization problems have great practice value for the network service providers. This problem is a constrained multicast QoS routing and is proved to be a NP complete problem. The total link capacity augmented cost should be minimized when we design a new VoIP network or when the original network could not serve all of the traffic demands. It is also known as a complicated problem. Introduction Originally, the Internet was designed to provide best-effort services for the data generated by computers. The timeliness of data communication is generally delay tolerant. Quality-of-Service (QoS) constraints are not as important as routing flexibility and connectivity. Hence, using IP to transport voice data is contradictory to the basic requirement of the voice service: a timely delivery of voice samples. Although IP was not initially designed to provide services for real-time traffic, recent technical progress has made IP have the capabilities to provide real-time services in near future. In order to provide the same or better service quality in the Internet than traditional circuit-switched telephone network, we must deal with a number of issues that have hampered it in the Internet. Voice service requirements could be discussed from two perspectives: (1) application requirements such as end-to-end delay, jitter, packet loss and overdue probability; (2) user’s perspective such as reliability, availability, and supplementary services [1][2]. Telephony service providers must guarantee the quality of service they provide e.g. maximum one way delay does not exceed 150ms. Internet telephony requires a range of protocols, ranging from those needed for transporting real-time data across to the network e.g. Real-time Transport protocol (RTP) [3], to Quality-of-Service aware routing (QoS routing), signaling protocol, resource reservation, internetworking between IP networks and PSTN, QoS-aware network management and billing protocols. ITU-T defined H.323 to provide multimedia communication in packet networks. From the perspective of network service providers, they want to optimize the network performance such as minimizing the total bandwidth consumption, maximizing throughput or total revenue [4][5] subject to user and application constraints. In this paper, we want to develop the mathematical model for VoIP network. We minimize the total bandwidth consumption under users’ QoS requirements, the network topology and the network capacity. Performance Optimization Model It is generally accepted that Internet telephony and traditional circuit-switched telephony will coexist for quite some time. The VoIP architecture must deal with interworking between IP networks and PSTN, so we need gateways between the two worlds. There are four possible models of VoIP [6]. They are PC-to-PC, Gateway-to-Gateway, PC-to-Gateway, and Gateway-to-PC models. The architecture of VoIP is shown in Fig.1. The first model of VoIP is PC-to-PC architecture, which based 2nd International Conference on Electrical, Computer Engineering and Electronics (ICECEE 2015) © 2015. The authors Published by Atlantis Press 1144 on the assumption that two or more users have access to multimedia computers that are connected to the Internet. Fig.1 VoIP Architecture The VoIP system is modeled as a graph, where the hosts, VoIP gateways, and switches are represented by nodes and communication link sets are represented by links. Let N = {1, 2,..., n} be the set of nodes and L be the set of links in the graph (network). Let G be the set of all user groups. An user group g is a voice communication session requesting for transmission in the network. An user group g may be an unicast from the source to a destination or a multicast from the source to multiple destinations. For each user group g, the traffic is transmitted exactly over one tree. Dg represents the set of destinations of user group g. g λ is the required bandwidth of the voice transmission for each user group g. Below is a verbal description of the VoIP system design problem we considered. Given : Network topology Capacities of network links Equivalent bandwidth of each multicast/unicast group Time threshold and tolerable overdue probability for each multicast/unicast group To determine : The minimum overall bandwidth consumption Routing tree for each multicast/unicast group Overdue probability of each multicast/unicast group Objective : To minimize the total bandwidth consumption Subject to : End-to-end QoS (overdue probability) constraint Tree constraint Multi-commodity flow constraint Capacity constraint Integrality constraint Hop constraint Table 1 and 2 are the notations we use in this paper . Internet VoIP Gateway VoIPGatewa Central office switch or local hub Central office switch or local hub Multimedia PC IP Router Multimedia PC IP Router Gatekeepe r

Network-based intrusion detection and prevention systems -NIDS /NIPS- have been widely implemented in order to build layered information security infrastructures. Many intrusion detection and prevention algorithms have been developed and its operation modes imply benefits and drawbacks that are not taken into account when choosing a network IDS/IPS. This paper assesses the network security provided by five NIDS/NIPS software solutions, by analyzing the protection against malicious traffic. Security platforms against network intrusion such as Snort Inline, Stonegate IPS, Strataguard, Intrupro and Packetalarm are tested and analyzed.

Voice over Internet Protocol (VoIP) is one of the most popular technologies nowadays that facilitate the user by providing different features as instant messages, phone calls, video calls, and voicemails. Basic VoIP protocols were designed to be efficient instead of secure. After numerous attacks on these protocols several solutions were proposed to prevent against these threats. In this paper, we focus on the security of Session Initiation Protocol (SIP) that is used to initiate, modify, and terminate the VoIP sessions. The paper presents the design and implementation of secure layered architecture for SIP, which adds a new layer to the standard SIP layer model and entitled as Security layer. The Security layer provides authentication, authorization, adaptable feature, and secure key exchange, based on our newly designed protocol, named as Session Initiation Protocol using Single Sign-On (SIPSSO). In order to implement the secure layered architecture based on SIPSSO, we have developed an Android Secure Call application and extend the open source Asterisk accordingly. After the designing and implementation phases, we have verified the SIPSSO protocol formally by using an automated security verification tool, Scyther. Our analysis results reveal that by adding Security layer, we ensured protection against different SIP attacks such as Eavesdropping, Man In The Middle (MITM) attack, Message Tampering, Replay attack, Session Teardown, and Spam over Internet Telephony (SPIT).

An intrusion prevention system (IPS) acts as a new type of information security technology, the configuration and management of which are currently urgent problems; in particular, debate exists regarding the value of these systems. In this paper, we analyse whether a firm realizes a positive or negative value from using an IPS instead of an intrusion detection system (IDS) in a default configuration and an optimal configuration, respectively. Our results suggest: (a) an IPS could hurt the firm when not configured optimally; (b) the optimal configuration of the IPS depends not only on the cost parameters but also on the external environment (quality of the IDS) in which the firm is operating; (c) whether the IDS is optimally configured or not, the firm will make the same decisions between using the IPS instead of the IDS and continuing to use the IDS; and (d) except for the true positive rate of IDS being in a certain region and the blocking cost being sufficiently high, the firm realizes a strictly nonnegative value if the firm configures the IPS optimally.

The paper presents an analytical model to study the performance and availability of queueing systems with finite queue and two service phases. The first phase has the exponential distribution of service time, while the second one has the hyperexponential distribution. The analytical results obtained are verified using discrete-event simulation. A few numerical examples for varying the service rates and arrival rates are given. The results presented in the paper can be used for analysis of the intrusion detection and prevention systems (IDPS).

The growing complexity of cyber threats necessitates creative solutions beyond conventional rule-based security systems. This study presents a new method for the incorporation of artificial intelligence (AI) into intrusion detection and prevention systems (IDPS) that facilitates real-time threat mitigation, adaptive learning, and autonomous response. Through the use of machine learning (ML), behavioural analytics, and generative AI, this solution overcomes the weaknesses of legacy systems while maximizing accuracy, scalability, and operational efficiency in cybersecurity. Key Words: Artificial Intelligence (AI); Cybersecurity; Intrusion Detection System (IDS); Intrusion Prevention System (IPS); Real-Time Threat Detection; Machine Learning (ML); Anomaly Detection; Behavioural Analytics; User and Entity Behaviour Analytics (UEBA); Automated Incident Response; Adaptive Learning; Generative Adversarial Networks (GANs); Adversarial AI; Zero-Day Attack Detection; Security Orchestration, Automation, and Response (SOAR); Autonomous Cybersecurity; Cyber Threat Mitigation; Network Security; Deep Learning; Explainable AI (XAI); Federated Learning; Threat Intelligence; Real-Time Analytics; Predictive Cybersecurity; AI-Driven Defence Systems; Proactive Defence Mechanisms; Self-Improving Systems; Quantum-Resistant AI; Zero Trust Architecture; Cyber-Physical Systems Security