Research of Snort Rule Extension and APT Detection Based on APT Network Behavior Analysis

Nowadays, cyber-attacks are beginning to be smart and hard to be detected, these attacks can be classified as Advance Persistence Threat(APT), which are hard to be detected and need sophisticated mechanisms of cybersecurity detection systems to be implemented to detect these types of attacks. Snort is an Intrusion Detection System (IDS) open source application that gained a high level of trust from hundreds of companies by using it as an IDS sensor whether Host-based Intrusion Detection System (HIDS) or Network Intrusion Detection System (NIDS) mode. Snort is depending on rules that are predefined to detect known attacks where if there is a new attack released and have not been registered to CheckPoint as an attack, then Snort will not detect it as an attack and the attack will bypass. The main problem that stands with traditional IDS (Snort) is the rate of false positive alerts. A new technique has been revealed by understanding the behavior of the traffic flow and deciding if the traffic flow matches the attributes that have abnormal activities that the traditional misuse IDS cannot detect. The new technique is a machine learning process that depending on training and testing the data of the traffic after converting the PCAP file to CSV file through an application that calls CICFlowMeter. it is an open source machine learning application that used as GUI mode calls Weka. After the PCAP file converted through CICFlowMeter, a dataset end with CSV extension will be generated with 80 plus attributes that Weka will learn as the training phase after that the testing phase will determine the matched traffic if they are normal or abnormal.

The newest technology, the Internet of Things, uses IoT devices to transmit data through networks. The biggest challenge with IoT is ensuring data transfer security. An intrusion detection system (IDS) is suggested as a solution to this problem. An essential network security tool for protecting computers and network systems is the IDS. It is capable of detecting and watching network activity. To find the unusual activity, we used the Snort IDS programme. An open source network security tool is Snort IDS. Both recognized and unidentified hazards might be found. To find attacks and produce alerts, it may search and compare the rules with network traffic data. This article examines protocol risks, attacks, and security problems related to network security. It also includes a plan to mitigate these risks. The MIT-DARPA 1999 data collection was used to produce the experiment's findings. The Snort IDS is used to identify anomalous behavior data since behaviour pattern datasets can be both normal and aberrant. The effectiveness of Snort's rule was assessed and put to the test in this article.

We are living in a connected world which encompasses various types of devices and networks. The most widely used network in modern age is Internet of Things (IoT). It is a type of network where IOT devices can communicate with each other without human intervention. The life of people is transformed with the evolution of smart city, smart home concepts. The areas are not limited. It ranges from healthcare, medical, transportation to banking, smart grid, agriculture. It has transformed the lives of people by providing ease and comfort of completing the tasks in less time with less overhead. However, there is a negative side of IoT and that is it lacks the implementation of sound and effective security measures. There are various risks associated with use of IoT. Some of them are risk of unauthorized access of data, node spoofing and different cyber-attacks like denial of service (DoS), Botnet, Ransom ware, eavesdropping, zero day attack. So, the main concern addressed here is how to detect intrusions into the network using Machine Learning. Machine Learning (ML) plays an important role in designing of intrusion detection systems to detect the anomalies in the network. The ML techniques are very efficient in detection of different types of cyber-attacks. This paper presents the review of different ML techniques in detection of intrusions into IoT networks. Different ML techniques like Random Forest, Neural Network, support vector machine etc. are useful in detection of anomalies in the network. Different datasets like UNSW-NB 15, CICIDS-2017, KDD-99, NSL-KDD, TON_IoT and ECU-IOHT are available which consists of data related to different types of cyber-attacks and are used to form intrusion detection systems. This paper presents the application of different ML algorithms in detection of abnormalities in the network, comparative analysis of different feature selection and machine learning techniques along with challenges and issues present in traditional intrusion detection systems(IDS) in IOT networks.

With the popularization and development of network knowledge, network intruders are increasing, and the attack mode has been updated. Intrusion detection technology is a kind of active defense technology, which can extract the key information from the network system, and quickly judge and protect the internal or external network intrusion. Intrusion detection is a kind of active security technology, which provides real-time protection for internal attacks, external attacks and misuse, and it plays an important role in ensuring network security. However, with the diversification of intrusion technology, the traditional intrusion detection system cannot meet the requirements of the current network security. Therefore, the implementation of intrusion detection needs diversifying. In this context, we apply neural network technology to the network intrusion detection system to solve the problem. In this paper, on the basis of intrusion detection method, we analyze the development history and the present situation of intrusion detection technology, and summarize the intrusion detection system overview and architecture. The neural network intrusion detection is divided into data acquisition, data analysis, pretreatment, intrusion behavior detection and testing.

The Internet Engineering Task Force (IETF) has defined routing protocols for low power and lossy networks (RPL) for constrained devices. RPL constructs DODAGs (destination oriented directed acyclic graphs), to optimize routing. RPL ensures acyclic topology with the DODAG version number. However, the control message’s DODAG version number is not authenticated. So, RPL is vulnerable to network resource attack known as DODAG Version Number (DVN) attack. DVN attack creates a packet delay, packet loss, cyclic topology, etc., in the network. This paper proposes a method for detecting DODAG version number attacks. Several existing schemes to defend against the DVN, such as cryptographic techniques, trust-based, threshold-based and mitigation are computationally intensive or require protocol modification. DVN does not change the packet format or sequence of packets, but can still perform attacks and hence fall under the category of stealthy attacks, which are difficult to detect using traditional intrusion detection system’s (IDS). Discrete-event system (DES) based IDS have been applied in the literature for stealthy attacks that achieve low overhead, low false alarm rate, etc. However, the construction of DES-based IDS for network protocol may lead to errors, as modelling is manual. The resulting IDS, therefore, is unable to guarantee its correctness. This paper proposes linear temporal logic (LTL) based DES paradigm to detect DVN. LTL-based paradigm facilitates formal verification of the DES-based IDS, and hence the correctness of the scheme is ascertained. The proposed technique is simulated using the Contiki cooja simulator. When the percentage of spiteful nodes in the network increases, the true positive rate, and packet delivery rate drops, while the false positive rate and control message overhead increase. The memory requirement for sending the packets and verifying the nodes is minimal. The LTL-based IDS has been formally verified using NuSMV to ensure the correctness of the framework.

Critical infrastructure protection and national security are enhanced by the security and reliability of networks. Various types of information circulate on these networks, ranging in classification from open to closed. The consequences of cyberattacks on these networks can be severe, including reputational damage, financial loss, operational disruption and data leakage. Traditional security methods, such as firewalls and anti-virus software, are becoming less effective against modern and ever-changing cyber threats. As a result, powerful network intrusion detection systems (IDS) have become indispensable for proactive detection and mitigation of cyber attacks. Machine learning has become a viable method for creating adaptive intrusion detection tools that can detect new and complex attack patterns. By learning from huge labelled network traffic datasets, ML models can understand the subtle patterns and differentiating features of normal and abnormal or malicious traffic flows. This allows them to detect possible cyber threats and intrusions that traditional signature-based IDSs cannot detect. Extracting discriminative features and training appropriate classification models from such data is a challenging task. In the presented study, we analyse the effectiveness of ML algorithms for detecting cyberattacks, in particular distributed denial of service (DDoS) attacks, in network traffic data. In the presented study, a network attack detection system is developed using ML and deep learning (DL) models and experimented on the CICIDS2017 dataset. The main objectives of the study are to develop a strategy for extracting valuable information from raw network streams; to study the impact of data preparation on the false positive rate; and to conduct a comparative analysis of ML models for cyberattack detection. The main goal of the study is to provide an understanding of the development of a reliable adaptive network intrusion detection system using ML approaches that increase cybersecurity capabilities and protect against future cyberattacks.

Wireless Sensor Networks (WSNs) have modernized healthcare, providing vital sign collection and real-time patient monitoring. Healthcare WSNs are vulnerable to cyberattacks, such as false data injection, sensor manipulation, and data eavesdropping, which can disrupt monitoring and endanger patient lives. Traditional Intrusion Detection Systems (IDSs) based on static signatures struggle with evolving threats. Deep Learning (DL)-based IDSs, combined with Feature Selection (FS), offer a more adaptive and effective solution, improving attack detection and protecting patient data. This work presents an innovative Pigeon-Inspired Optimizer-based Feature Selection with Deep Learning-based Attack Detection and Classification (PIOFS-DLADC) method, which focuses on creating an optimal DL framework for attack detection and classification in healthcare WSNs. Initially, patient health data (actual input data) undergo preprocessing using the one-hot encoding system. Then, the PIOFS method selects key features from sensor data streams, reducing dimensionality and improving model efficiency. Furthermore, an attention-based Bidirectional Gated Recurrent Unit (BiGRU) method captures long-term dependencies and prioritizes features for accurate attack classification. The Coati Optimization Algorithm (COA) is employed to tune the hyperparameters of the DL models. The model efficiently explores the hyperparameter space, optimizing the performance for attack detection and classification. Validated on a healthcare WSN dataset, the PIOFS-DLADC model demonstrated an accuracy of 96.78%, which is superior to existing approaches.

As a promising technique for the design of 5G wireless networks, software-defined networks (SDNs) have been proposed. However, SDNs are vulnerable to most of the attacks that traditional networks are vulnerable to. Various techniques have been developed and designed to help in the detection as well as the prevention of various attacks. An intrusion detection system (IDS) is one of the common techniques used to detect malicious activity in a network. Intrusion detection systems have strengths and weaknesses when it comes to detecting intrusions. It becomes a challenging task for IDS to process any mixture of traffic that results in packet drop and delay. In this study, we scrutinized two open-source IDS, including Snort IDS and Zeek IDS, to assess the IDS performance in terms of various parameters such as detection rate, dropping rate, and latency. The method of detection was one of the main differences between Snort and Zeek. Zeek IDS uses an anomaly-based detection method as opposed to Snort IDS, which uses a signature-based detection method. Differences between them had an impact on the way network traffic was handled. Such a thought analysis is expected to be of great value in selection and further enhancement of IDS in SDN.

The Internet of Things (IoT) has been rapidly evolving towards making a greater impact on everyday life to large industrial systems. Unfortunately, this has attracted the attention of cybercriminals who made IoT a target of malicious activities, opening the door to a possible attack to the end nodes. Due to the large number and diverse types of IoT devices, it is a challenging task to protect the IoT infrastructure using a traditional intrusion detection system. To protect IoT devices, a novel ensemble Hybrid Intrusion Detection System (HIDS) is proposed by combining a C5 classifier and One Class Support Vector Machine classifier. HIDS combines the advantages of Signature Intrusion Detection System (SIDS) and Anomaly-based Intrusion Detection System (AIDS). The aim of this framework is to detect both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the Bot-IoT dataset, which includes legitimate IoT network traffic and several types of attacks. Experiments show that the proposed hybrid IDS provide higher detection rate and lower false positive rate compared to the SIDS and AIDS techniques.

With the expansion of the campus scope and the application function of campus network, the network flow is also increase, which requires the intrusion detection system can be rapid in the high-speed network, and reduce the misinformation and missed samples of intrusion detection. Therefore, this project aims to security issues of campus. Firstly, the application on the role of the campus network is analyzed, focusing on the system architecture of Snort intrusion detection system, the testing procedures and testing rules etc. The distributed intrusion detection system is combined; the distributed Snort intrusion detection system model is designed through the protocol analysis and pattern matching detection methods to improve the speed and accuracy of the intrusion detection system. Finally, the security of campus network is effectively improved on the application.

As 5G and beyond networks grow in heterogeneity, complexity, and scale, traditional Intrusion Detection Systems (IDS) struggle to maintain accurate and precise detection mechanisms. A promising alternative approach to this problem has involved the use of Deep Learning (DL) techniques; however, DL-based IDS suffer from issues relating to interpretation, performance variability, and high computational overheads. These issues limit their practical deployment in real-world applications. In this study, CiNeT is introduced as a novel DL-based IDS employing Convolutional Neural Networks (CNN) within a bijective encoding–decoding framework between network traffic features (such as IPv6, IPv4, Timestamp, MAC addresses, and network data) and their RGB representations. This transformation facilitates our DL IDS in detecting spatial patterns without sacrificing fidelity. The bijective pipeline enables complete traceability from detection decisions to their corresponding network traffic features, enabling a significant initiative towards solving the ‘black-box’ problem inherent in Deep Learning models, thus facilitating digital forensics. Finally, the DL IDS has been evaluated on three datasets, UNSW NB-15, InSDN, and ToN_IoT, with analysis conducted on accuracy, GPU usage, memory utilisation, training, testing, and validation time. To summarise, this study presents a new CNN-based IDS with an end-to-end pipeline between network traffic data and their RGB representation, which offers high performance and enhanced interpretability through revisable transformation.

In today's digital landscape, the rapid expansion of computer networks and the increasing reliance on information technology have made network security a paramount concern. With the growing sophistication of cyber threats, traditional intrusion detection systems (IDS) face significant challenges in effectively identifying and mitigating security breaches. To address these evolving threats, novel approaches that combine cutting-edge technologies are required. This paper explores the fusion of autoencoder based classifier to training and classifying the attacks of IDS. This approach is applied on the most meaningful feature that selected based on the pearson correlation (for continues vales) and chi-square test (for binary values). The benchmark NSL-KDD database is utilized to assess the validity of the suggested IDS. The experimental outcomes demonstrate that the designed Intrusion Detection System (IDS) attains superior classification accuracy at 92.27%, outperforming both prior research efforts and alternative classifier methods.

With the rapid development of information technology, network security issues have become increasingly prominent. In particular, data security intrusions pose serious threats to the data privacy and system security of enterprises and individuals. Traditional intrusion detection systems often exhibit low detection accuracy and high false alarm rates when faced with complex and dynamic network environments and diverse attack methods. Therefore, this paper proposes a data security intrusion detection system based on deep learning, which integrates the Mamba model and ECANet model and employs an end-to-end learning approach for training and optimization. First, the Mamba model is introduced for preliminary data feature extraction, whose efficient feature representation capabilities provide a solid foundation for the subsequent detection process. Then, by integrating the ECANet model, feature selection is further optimized through the attention mechanism, enhancing the model’s focus on important features. Finally, an end-to-end learning approach is adopted to train and optimize the entire system, ensuring excellent performance and robustness in practical applications. Experimental results show that the proposed intrusion detection system demonstrates higher detection accuracy on multiple test datasets, improving by approximately 5% compared to traditional methods, providing a new and effective solution for data security.

The APT attack on the Internet is becoming more serious, and most of intrusion detection systems can only generate alarms to some steps of APT attack and cannot identify the pattern of the APT attack. To detect APT attack, many researchers established attack models and then correlated IDS logs with the attack models. However, the accuracy of detection deeply relied on the integrity of models. In this paper, we propose a new method to construct APT attack scenarios by mining IDS security logs. These APT attack scenarios can be further used for the APT detection. First, we classify all the attack events by purpose of phase of the intrusion kill chain. Then we add the attack event dimension to fuzzy clustering, correlate IDS alarm logs with fuzzy clustering, and generate the attack sequence set. Next, we delete the bug attack sequences to clean the set. Finally, we use the nonaftereffect property of probability transfer matrix to construct attack scenarios by mining the attack sequence set. Experiments show that the proposed method can construct the APT attack scenarios by mining IDS alarm logs, and the constructed scenarios match the actual situation so that they can be used for APT attack detection.

In the cybersecurity attack and defense space, the “attacker” and the “defender” form a dynamic and symmetrical adversarial pair. Their strategy iterations and capability evolutions have long been in a symmetrical game of mutual restraint. We will introduce modern Intrusion Detection Systems (IDSs) from the defender’s side to counter the techniques designed by the attacker (APT attack). One major challenge faced by IDS is to identify complex attack paths from a vast provenance graph. By constructing an attack behavior tracking graph, the interactions between system entities can be recorded, but the malicious activities of attackers are often hidden among a large number of normal system operations. Although traditional methods can identify attack behaviors, they only focus on the surface association relationships between entities and ignore the deep causal relationships, which limits the accuracy and interpretability of detection. Existing graph anomaly detection methods usually assign the same weight to all interactions, while we propose a Causal Autoencoder for Graph Explanation (CAGE) based on reinforcement learning. This method extracts feature representations from the traceability graph through a graph attention network(GAT), uses Q-learning to dynamically evaluate the causal importance of edges, and highlights key causal paths through a weight layering strategy. In the DARPA TC project, the experimental results conducted on the selected three datasets indicate that the precision of this method in the anomaly detection task remains above 97% on average, demonstrating excellent accuracy. Moreover, the recall values all exceed 99.5%, which fully proves its extremely low rate of missed detections.