1. Using Mobility Profiles for Anomaly-based Intrusion Detection in Mobile Networks
Jeyanthi Hall
Ph.D. Candidate - Carleton University
Supervisors: Michel Barbeau and Evangelos Kranakis
Network and Distributed System Security Workshop
Supported by: MITACS, ALCATEL and NSERC)
Copyright 2005 Jeyanthi Hall

2. Presentation Outline
Use of profiles in anomaly-based intrusion detection (ABID)
ABID using mobility profiles
Create user mobility profiles
Design a classification system
Analysis of two key system parameters (sequence length and cluster size)
Simulation Results
Conclusions
Future Research Initiatives

3. Use of profiles in ABID Previous research: Focus of our research:
Node/device profiles [Hall 05]
Operating System profiles [Taleck 03]
User-behavior profiles based on calling patterns [Boukerche et al. 02] and service usage [HP/Compaq 03]
Focus of our research:
Explore the feasibility of using mobility profiles of users (APRS and IBL) for enhancing anomaly-based intrusion detection (ABID) in mobile networks
Analyze the impact of mobility characterization and cluster size on the false alarm and detection rates

4. Anomaly-based Intrusion Detection Using Mobility Profiles

5. ABID using mobility profiles
Objective 1: Create a mobility profile for each user
Phase 1 Data Collection
Phase 2 High Level Mapping
Phase 3 Feature Extraction
Phase 4 Definition of a user mobility profile (UMP)

6. Data
High Level
Feature
Definition
of UMP
Collection
Mapping
Extraction
Objective:
Capture location broadcasts (latitude, longitude) using the Automatic Position Reporting System (APRS)

7. High Level
Mapping
Data
Feature
Definition
of UMP
Collection
Extraction
Objective:
Reduce intra-user variability between sequences of location broadcasts
latitude
Sequence on day 1
Sequence on day 2
longitude

8. QUESTION 1: What cluster size is appropriate?
High Level
Mapping
Data
Feature
Definition
of UMP
Collection
Extraction
Approach:
Transform location coordinates (LCs) in each broadcast into a cluster of given size (reduce the precision)
QUESTION 1: What cluster size is appropriate?

9. QUESTION 2: What sequence length is appropriate?
Data
High Level
Feature
Definition
of UMP
Collection
Mapping
Extraction
Objective:
Extract the LCs (feature) from each location broadcast
Create a set of mobility sequences (specified by sequence length)
QUESTION 2: What sequence length is appropriate?

10. Objective: Define a mobility profile for each user Data High Level
Feature
Definition
of UMP
Collection
Mapping
Extraction
Objective:
Define a mobility profile for each user

11. 1 Second subset of the mobility sequences
Data
High Level
Feature
Definition
of UMP
Collection
Mapping
Extraction
Profile: User 19
Minimum/Maximum thresholds calculated using mobility sequences in training and parameter1 sets
Parameters:
sequence length = 10
cluster size = 3
1 Second subset of the mobility sequences

12. ABID using mobility profiles
Data
High Level
Feature
Definition
of UMP
Classification
Collection
Mapping
Extraction
ABID using mobility profiles
Objective 1: Create a mobility profile for each user
Phase 1 Data Collection
Phase 2 High Level Mapping
Phase 3 Feature Extraction
Phase 4 Definition of a user mobility profile (UMP)
Objective 2: Design a classification system
Compares an observed mobility sequence of user A to each of the mobility sequences stored in his/her profile → similarity measure (SM)
Determines the type of behavior
normal – SM value is within pre-established thresholds
anomalous – user A or intruder?

13. ABID using mobility profiles
Data
High Level
Feature
Definition
of UMP
Classification
Collection
Mapping
Extraction
ABID using mobility profiles
Approach
Implement the Instance-Based Learning (IBL) classification framework [Lane 1999]
Provides a mechanism for reducing noise (minor deviations from a given path due to external/internal factors)

14. Analysis of system parameters: Sequence length and Cluster size
Primary Goal: Detect intrusions

15. Analysis of system parameters (sequence length)
As SL is increased
Acceptance region expands towards left/right
Distribution of intrusions shifts to the right - towards the acceptance region
Acceptance
Region

16. Analysis of system parameters (cluster size)
As CS is decreased (SL=5)
Acceptance region shifts towards left
Distribution of intrusions shifts to the left – away from the acceptance region
Acceptance
Region

17. Simulation Exercise

18. Simulation Exercise Objective: Definition: Methodology:
Determine impact of characterization and cluster size on false alarm and detection rates
Definition:
False positives/alarm and detection (NSMP values – outside the thresholds)
Methodology:
False alarm (NSMP values using test/training data – user 19)
Detection (training data of user 19 and test data of the remaining 19 users)

19. Quality of Characterization
How well do the mobility sequences (training data) reflect the on-going mobility behavior?
1 key indicator: Acceptance Region
Determined by comparing sequences (parameter data) with those (training data)
High level of similarity – mobility behavior is consistent with regards to time
Increase the level of similarity
Using larger cluster sizes?
How will this affect the false alarm and detection rates?

20. Simulation Results False alarms
At CS=3 (biggest cluster or lowest precision)
Acceptance region – localized at the higher end of similarity spectrum
Acceptance
Region

21. Simulation Results False alarms
At CS=2 (second biggest cluster or lower precision)
Acceptance region – left margin shifts towards the left
Acceptance
Region

22. Question: Can we choose any one of the sizes?
Simulation Results
False alarms
At CS=1 (smallest cluster or highest precision)
Acceptance region – shifts towards the left
Acceptance
Region
Question: Can we choose any one of the sizes?

23. Simulation Results Detection Rate
At CS=1 (smallest cluster or highest precision)
Large number of intrusions within the acceptance region – lowest detection rate
Acceptance
Region
Detection
Intrusions

24. Simulation Results Detection Rate
At CS=2 (second biggest cluster or lower precision)
Less intrusions within the acceptance region – higher detection rate
Acceptance
Region

25. Question: Is CS of 3 the best choice?
Simulation Results
Detection Rate
At CS=3 (biggest cluster or lowest precision)
Least number of intrusions within the acceptance region – highest detection rate
Acceptance
Region
Question: Is CS of 3 the best choice?

26. Conclusion
Yes, it is feasible to use mobility profiles for ABID as long as
User Mobility Profiling
Accurately characterize the mobility behavior of users
Select values for sequence length and cluster size - based on user’s/group mobility behavior (consistent or chaotic)
Classification scheme
Design a classification system that provides sufficient functionality

27. Future Research Initiatives
Enhance the characterization of mobility behavior of users
Proposed alternate mechanism (Hall 05)
Extend the feature set to include timeframe, average speed, etc.
Prove useful in detecting potential intruders
Explore the use of different values for system parameters – based on users’ mobility behavior
Reduce the complexity of the classification system (space and time)
Current level of performance is less efficient than statistical classification systems
Address the issue of user privacy
Possible techniques include the use of hash codes, statistical trees and other representations of LCs

28. References Use of profiles for ABID IBL
A. Boukerche, Security and fraud detection in mobile and wireless networks. John Wiley and Sons, Inc., 2002, ch.27.
J. Hall, M. Barbeau, and E. Kranakis, “Enhancing intrusion detection in wireless networks using radio frequency fingerprinting”, in Proceedings of the 3rd IASTED International Conference on Communications, Internet and Information Technology, St. Thomas, U.S. Virgin Islands, Nov. 2004, pp
J.Hall, M. Barbeau, and E. Kranakis, “Anomaly-based intrusion detection using mobility profiles of public transportation users”, Carleton University, Tech. Rep. TR-05-01, Jan. 10, 2005
(2003) Hp – fraud management system. Hewlett Packard [online] Available:
G. Taleck, “Ambiguity resolution via passive os fingerprinting”, in Proceedings of the International Conference on Recent Advances in Intrusion Detection, Berlin Heidelberg, 2003, pp
IBL
T.Lane and C.Brodlay, “Temporal sequence learning and data reduction for anomaly detection” ACM Transactions on Information and System Security, vol. 2, pp , Aug

29. Network and Distributed System Security Workshop
Thank You
Jeyanthi Hall
Questions ?
Network and Distributed System Security Workshop