CRBP-OpType: A Constrained Approximate Search Algorithm for Detecting Similar Attack Patterns Ambika Shrestha Chitrakar Prof. Slobodan Petrovic CyberICPS, Oslo, 2017

Outline Introduction Background CRBP-OpType Experimental Work Misuse-based IDS Problem and Motivation Contribution Background Approximate Search Approximate Search and Bit-Parallelism Row-based Bit-Parallelism (RBP) CRBP-OpType Experimental Work Conclusion

Introduction

Misuse-based IDS Misuse-based IDS detect attacks based on the previously known attack signatures Example: Snort Snort is one of the widely used open-source misuse-based IDS It stores known attack signatures in its misuse database as rules Applies Aho-Corasick (an exact search) to find them in the network traffic Generates alert when it can find one of them

Problem and Motivation The problem is, Snort like misuse-based IDS fail to detect new attacks even when they are similar to the known ones It is even enough to modify a single bit in the known attack signatures to evade such IDS Proposed Solution Apply approximate search instead of an exact search However, they generate lot of false positives

Contribution CRBP-OpType: a constrained approximate search algorithm The number of false positives can be reduced At the same time, it can also help in detecting new attacks that are similar to the known ones

Background

Approximate Search Allows errors to find the occurrences of the search pattern in the given search string Lavenshtein distance has been used extensively in approximate search Given string T=abbaccacbbadrbbb, and pettern P = bbba, find all the occurrences of P in T with errors k=1, using edit distance abbaccacbbadrbbb - occurrences at position 4, 11, and 16

Constrained Approximate Search Allows one to define constraints on the edit operations Example: Constraints on the number of indels (Sankoff-Indels and CRBP-Indels) considers insertions and deletions together 2 indels = 2 insertions/deletions or 1 insertion and 1 deletion Constraints on the allowed number of each edit operations (CRBP-OpCount) E.g.: allowing 1 insertion and 2 substitutions

Approximate Search and Bit-Parallelism Σ 00 k 01 i 02 l 03 l 04 ԑ ԑ ԑ ԑ Σ Σ Σ Σ 10 k 11 i 12 l 13 l 14 An NFA for the search pattern «kill», permitting up to 1 error A character match Insertion Substitution Deletion

Row-based Bit-Parallelism (RBP) Search pattrn (P) = kill, search string (T) = kil, error (k) = 1 00 k 01 i 02 l 03 l 04 i k l ԑ ԑ ԑ ԑ Σ Σ Σ Σ 10 k 11 i 12 l 13 l 14 An NFA for the search pattern «kill», permitting up to 1 error A character match Insertion Substitution Deletion

CRBP-OpType

Possible edit operations N = 3, k = 2 N = 1, k = 2

RBP and CRBP-OpType Bit-mask: same as in RBP Initialization of NFA: The position j in the search pattern is set to active if the character at that position is equal to the character for which bit-mask is being performed Other positions of the search pattern is set to inactive We start bit-mask from right to left Initialization of NFA: In RBP, consecutive bits equal to the number of rows (starting from 0) is set active In CRBP-OpType, it is valid if deletion is allowed. Otherwise, all the bits in all the rows are kept inactive Applying the Search: Update formula for the rows greater than 0 is broken down and the formula related to the allowed edit operations is only included in the computation

CRBP-OpType Search pattrn (P) = kill, search string (T) = kil, error (k) = 1 deletion 00 k 01 i 02 l 03 l 04 l k i ԑ ԑ ԑ ԑ 10 k 11 i 12 l 13 l 14 An NFA for the search pattern «kill», permitting up to 1 deletion A character match Insertion Substitution Deletion

Experimental Work

System specification: Quad-core 2.7 GHz processor 8 GB RAM Programming: C#

Experiment

Results

Results

Conclusion

Conclusion Detect new attacks that are similar to the known ones Can be achieved by using approximate search algorithms like RBP and CRBP-OpType with a certain level of tolerance Reduce the number of false positives/alarms Constrained approximate search (CRBP-OpType) is capable of reducing the number of false positives than the unconstrained approximate search (RBP) Increase the efficiency of the search algorithm Better efficiency can be achieved by limiting the use of edit operations

Thank you! Questions?