Evaluating a Real-time Anomaly-based IDS A.B. Ruighaver P.G. Thorne K. Tan Computer Forensic and System Security Group University of Melbourne, Australia

Anomaly-based Intrusion Detection To detect the unauthorized use, misuse or abuse of a computer system. Not attack based (use a misuse IDS) Can detect masqueraders Finger prints user behavior Other intrusions ? Subjective (what is an intrusion ?) Anomaly only indicates possible intrusion

A Real-time Anomaly-based IDS Neural network based Uses simple feed forward networks Does not predict next action in sequence, but whether current action is “normal behavior” Needs to be able to forget old behavior Uses standard system logs No need to permanently run auditing software Consumes minimal system resources Portability

Behavioral profiles Separate networks for each behavioral characteristic Commands Activity Time CPU usage Login Host Correlation network to build user profile

Evaluation Finger Print uniqueness Intrusive behavior only briefly tested, seems to work well not sure whether we can identify an attacker Intrusive behavior external attacks (easy) insider threat (more difficult) Initial test data Student machine for one semester Host identification not reliable and removed

Preliminary Evaluation results Some clear intrusions Some clear non-intrusions Most anomalies can not be classified A few accounts generate most anomalies Known incidents have been detected Command-time anomalies prevalent Many repeated anomalies Command is not a good indicator

Lessons Need good data set Need more behavior No artificial data set, need varied behavior Need audit data to explain behavior May need to filter out repeated intrusions Need more behavior Tailor system to generate complex behavior Prevent detection of non-intrusive anomalies Need to have better response capabilities

Conclusions Finger print based on individual behavior Indicates any change in individual behavior To identify intrusions need group behavior Need to create more behavior in system Anomaly-based IDS is not only a tool for detection but also a tool for prevention -> use it as a behavioral monitor