1. Loss-Sensitive Decision Rules for Intrusion Detection and Response Linda Zhao Statistics Department University of Pennsylvania Joint work with I. Lee, L. Unger, J. Wang and X. Lei

2. Topics 1.Intrusion detection 2.Attack taxonomy and loss evaluation 3.Decision rules 4.Data collection and data anlaysis 5.Challenges

3. Current ID Systems IDS is the mechanism of detecting inappropriate, incorrect, or anomalous activity. –Host-based IDS and network-based IDS –Misuse IDS and Anomaly IDS Figure 1. Typical Disparate Alert Analysis Module Deployment Internet Network Misuse ID Network Anomaly ID Firewall Host Misuse ID Host Anomaly ID Protected Intranet Alert Analysis Module Protected Host

4. Misuse ID Systems (SNORT) Advantages: –The potential for relatively low false alarm rates in comparison with anomaly alerts –Detailed contextual information makes preventive actions easier Disadvantages: –Misuse ID systems dont work for unknown attacks, its detection rate depends on the signature base –Not effective to resource abuse activities –The difficulty of keeping signature databases up to date –Environment dependent –False alarm rates remain high

5. Anomaly ID Systems (LERAD) Anomaly: by observing a deviation from normal behavior. Learning: The process to derive the behavior profiles or models to describe normality Advantages: –Can be effective for novel and unknown attacks Disadvantages: –High false positive –Currently must have clean data for training –Currently alert without any contextual information

6. Issues Unacceptably high false alarm and false negative alert rate –As an example (SNORT) False alarm rate (current protocol): 1-304/7988=96% Detection rate: 304/962=32% Lack of loss evaluation and sensible decision rules

7. Current Research Classify attacks and propose loss evaluation Modify MIT 1999 network design: –Insert more attacks (new types and increased frequency) –Simultaneously deploy 5 ID systems Generate new data Combine the information given from SNORT and LERAD, use Bayesian decision rule with classification tools (also use other IDS data) Use original TCP/IP packet data to find new detection rules

8. Current Research Because of large volume of traffic, ID system can not keep up with all the packets and currently ignores many. A multiple quieing system according to priority is needed. Decision rules which are not too sensitive to the loss are needed.

9. Further Challenges Identify hacking activities in a real network Small probability events causes unstable statistical procedures Online efficient detection