1. Intrusion Detection System B95901153 薛仲翔 B96901038 郭建言

2. Outline The Development of IDS The Architecher and Strategies of IDS IDSwith GA The Implementation of IDS with Some Other Popular Methods

3. Outline The Development of IDS The Architecher and Strategies of IDS IDSwith GA The Implementation of IDS with Some Other Popular Methods

4. Security Audit Generate, record, review, and then sort the system events for some security purposes. System monitoring Avoid misusing Event reconstructing Accountability Damage assessing and recovering

5. The Development of IDS In 1950s, a document of requirements of Electronic Data Processing (EDP) audit was defined. In 1970s, audit processing was subsumed into "Trusted Computer System Evaluation Criteria“.

6. The Development of IDS (cont.) Audit reduction Distinguish risks and threats. Statistic analysis Masquerade attack Intrusion detection systems after 1980s Discovery, Haystack, MIDAS, NADIR, NSM, etc. Commercial product

7. Outline The Development of IDS The Architecher and Strategies of IDS IDSwith GA The Implementation of IDS with Some Other Popular Methods

8. Architecture Functional device information source analysis engine response component Separated audit and audited system Intruder may shut down the IDS. Audit records may be altered or deleted. Reduce the loading of IDS

9. Strategies Information source, or event generator Host-based Network-based Application-based Target-based

10. Strategies (cont.) Analysis Misuse Anomaly Response Accountability Log Alarm the administrator Adjust IDS or the intruded system Notify routers and/or firewalls

11. Outline The Development of IDS The Architecher and Strategies of IDS IDSwith GA The Implementation of IDS with Some Other Popular Methods

12. Genetic Algorithm(GA) 0 1 1 0 1 0 0 1 1 0 1 0 0 1 1 0 0 0 1 0 0 1 0 1 0 1 1 0 1 0 1 1 0 1 0 1 1 1 0 1 0 1 1 1 0 1 0 1 0 1 1 0 1 0 1 1 0 1 0 1 0 1 1 0 1 0 1 1 0 1 0 1 1 0 0 0 1 1 0 1 1 1 0 1 0 1 1 0 0 1 1 1 0 0 1 1 1 1 0 1 0 1 1 1 1 0 1 1 0 0 1 0 1 0 1 0 1 0 1 0 Selection Evaluation Selection Initialization Crossover Mutation 0 1 1 1 0 1 Until termination Replacement Crossover Higher fitness 1 1 0 0 1 0 Simple GA flow Prof. TianLi Yu 1 1 1 0 1 0 Mutation Lower fitness 0 0 1 0 1 1 GA is a kind of global mountain climbing algorithm

13. Why Genetic Algorithm(GA)? Misused detection is not treated well.(Because it needs continous updating) System based on GA can be easily re-trained. The space of potential solution is truely huge. Due to the parallelism that allows them to implicitly evaluate many schemas at once.

14. System Implementation(Developed by Bancovic et al.) Rule-Based IDS: If-then rules are trained to recognize normal connections. ‧MultiExpressionProgramming(MEP)isappliedtoconstructtherules. ‧Very low false-positive rate Linear classifier: Classifies connections into normal ones and potential attacks. ‧Low false-negative rate ‧high false-positive rate ->its decision has to be re-checked.

15. System Implementation Linear classifier: Population = 1000 ;Generation = 300 The features used to Describe the Attack: gene[1]*duration + gene[2]*src_bytes + gene[3]*dst_host_srv_serr_rate < gene[4] FitnessFunction: # squared percentage achieves better performance

16. System Implementation Rule-Based IDS: FitnessFunction :F-Measure If-then rules are trained to recognize normal connections. ‧MultiExpressionProgramming(MEP)isappliedtoconstructtherules. ‧Very low false-positive rate Service Hot Logged Threshold SampleRule used to identifyNormal Connections: ----------------------------------------------------------------- If(service==“http”andhot==“0”andlogged_in==“0”) Thennormal A rule

17. Results The experimental results of whole system Trained by 250000 of 491021 data from “KDD_10_percent” Retrained by the remaining data from KDD_10_percent

18. Discussion ‧Advantage: Perform the training process and the process of detecting intrusions faster while maintaining high detection rate. #Because only six feature are defined to train. ‧Drawback： The distribution of the attacks and normal connection in the datasets is not very realistic [7], i.e. only 20% of the training data set makes normal connections while in real world the situation is quite opposite, as the percentage of normal packets highly exceeds the percentage of intrusive ones.

19. Outline The Development of IDS The Architecher and Strategies of IDS IDSwith GA The Implementation of IDS with Some Other Popular Methods

20. The Implementation of IDS with Some Popular Methods

21. Reference GASSATA, A Genetic Algorithm as an Alternative Tool for Security Audit Trails Analysis, Ludovic Me,2000 A Genetic Algorithm-based Solution for Intrusion Detection , ZoranaBanković et al,2009 駭客入侵偵測專業手冊,旗標出版社,Rebecca Gurley Bace著,賴冠州編譯,2001