Multiple Simultaneous Threat Detection in UNIX Environment

Transcription

1 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February Multiple Simultaeous Threat Detectio i UNIX Eviromet Zafar Sulta School of Sciece ad Techology, Uiversity of New Eglad, Armidale, NS, Australia Summary Although UNIX is cosidered a very stable ad secure platform, the developmet of Itrusio Detectio Systems (IDS) is essetial as curret ad future geeratios of hackers are cotiuously attemptig to udermie its itegrity. The empirical experimet of multiple simultaeous threat detectio system proved that use of hybrid data fusio model of Bayesia, Dempster Shafer ad exteded Dempster Shafer icreased a average 0% threat detectio rate. The false positive rate also wet dow by 5%. The use of Exteded Dempster Shafer to combie probability mass of 4 itrusio detectio (Multisesor) systems icreased precisio of threat detectio by 6% whilst the iitial probability mass of the Dempster Shafer of Multisesor was oly 0.0. Set Cover as a middle tier data fusio tool produced icredible results, particularly i data groupig by reducig the populatio size from 7 to 49 that amazigly miimise the computatioal processig cpu ad memory overhead cost ad time. I order to improve the results of the precisio of the multiple simultaeous threat detectio system, as a ext step of my research is that is a extesio to the Bayesia ad Dempster Shafer theory. GEP presets a better evidetial combiatio ad separate propositios ad the decisios. Key words: Multiple Simultaeous Threat Detectio; Itrusio Detectio Systems; Bayesia Theory; Dempster Shafer, Multisesor Data Fusio; Exteded Dempster Shafer, Set Cover; Set Packig; GEP; UNIX.. Itroductio A large umber of Itrusio Detectio Systems have bee developed for computer security but more developmet is required as attackers are very shrewd these days ad have developed differet approaches ad programmes to peetrate ito computer systems ad have succeeded may times i breakig all security walls. Thus hackers, i fact, ot oly have stole valued ad critical busiess data but also forced computer idustry ad busiesses to develop advace software to moitor ad block their attacks. As a result the compaies have to sped billio dollars to develop prevetive codes for this purpose [4]. For example Microsoft spet $. billio to stop Sapphire/Slammer worm i 00 [7] []. Itegratio of UNIX with Firewall protectio ad CISCO techology were cosidered very secure systems but hackers have also broke such security measures. The way the security field is progressig, it looks like this is a cotiuous battle betwee security professioals ad hackers. Hackers are i reality people familiar with all types of computer systems like cyberspace, etworks, operatig systems ad their thousads of applicatios. Hackers kow the loopholes of iformatio techology systems, they exploit system weakesses ad misuse their expertise to perform illegal fuctios o busiess critical systems such as stealig importat iformatio, busiess secrets, damagig data or systems etc. etc. The hardest problem i trackig these types of attack, their origi ad quatity of damage depeds upo attacker s software ad techiques. Hackers may attack from multiple sites ad hide their idetity by cotiuously chagig their IP addresses. Sometimes they do physical damage to the systems or their applicatios, but if they just steal importat iformatio, the security experts may be uaware of it for may moths util they apply a ew security update or hackers does ay physical damage to ay process or data of that particular busiess [5] []. False positives ad false egatives are additioal issues i computer security ad also i UNIX systems. False alarm results because alarms are set at low levels of security. The preset moitorig ad IDS aalyse data take from system processes, memory, CPU, disk utilizatio ad log messages ad track or batch or log files. Attacks are checked based o patter matchig with existig situatios of the processes ad systems attributes [] [7]. The aim of this paper is the prelimiary experimetal evaluatio of the multiple threat detectio system usig Multisesor data fusio, its various approaches ad techiques. However, the mai emphasis of my research is to detect multiple simultaeous attacks i UNIX eviromets. My research will help i buildig multiple simultaeous threat detectio system for computer security i geeral ad for UNIX eviromets i particular.. Existig Threat Detectio Approaches. Data Fusio Approaches i UNIX Bayesia, Dempster Shafer, fuzzy rules, parametric / o parametric ad Kalma Filter are widely used data fusio techiques [5] [4] []. Chapma-Kalmogorov predictio model has also bee used as a itegral model with Mauscript received February 5, 009 Mauscript revised February 0, 009

2 66 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February 009 Bayesia ad Dempster Shafer [9] [4]. Ifereces regardig threats, locatio ad other attributes are made from these models. These models fuse data from the Multisesor systems o the same or differet etworks. Fusio model behave exactly the same way like huma brai process data ad take actios or decisios. UNIX system s IDS get their data from differet sesor created by systems commads ad etworks packets. Data may be siffer packets; sys log files, SNMP traces, system messages ad other similar activities of the etwork [6]. Data fusio model after processig this iformatio sed its outputs i form of alarms to security people ad system egieers ad war of ay expected threat o a particular subet. Though data fusio models work like cogitive approach but i fact they are ot really itelliget eough to cope with differet type of chages or attacks if their iformatio does ot already exist i the IDS database. The Lagley attack lost millio dollars ad they could ot fid bombs util their busiess server crashed. The curret Multiple Itrusio Detectio Models are uable to auto track, idetify, ad block all suspected threats. Advace IDS are required to deliver ehaced reliability ad precisio i threat detectio []. Thus additioal developmet is required i the field of multiple sesor data fusio models of IDS i UNIX [6] [9].. Other Data Fusio Approaches A large amout of research work ad literature is available o Multisesor data fusio of IDS i defese ad other related fields. However, there is a little work i the field of UNIX, oly few scietists worked o multiple simultaeous threat detectio i UNIX. It is, therefore, a relatively ew area to work o. Though a few yeas back UNIX was oe of the secure eviromets from outside hackers but itruders ow have broke may busiess applicatios ad databases i UNIX etwork whilst all critical busiess like credit cards, cliet profiles ad fiacial trasactios are olie ad eed more security ever tha before. Majority of the workers used Bayesia, Dempster Shafer, parametric / o parametric ad few others iferece egies for Multisesor data aalysis i their IDS. Dog ad Deborah [0] worked o DARPA IDS evaluatio data set show i their experimets that improved threat detectio rates from 75 to 94 % with their hybrid models. I aother study, Dog ad Deborah emphasized that hybrid model of Bayesia is the best techique to improve the itrusio detectio precisio for IDS. Christos ad Basil [] worked o multiple data fusio model ad cocluded that the use of Multisesor data aalysis icreases threat detectio accuracy. They used a Bayesia ad Dempster Shafer detectio egie. Huadog u, Mel Siegel ad Raier [] idetified relatioship betwee Bayesia ad Dempster Shafer theory ad compared with the probability method ad cocluded that combied mathematical iferece models will be a promisig area for Multisesor data aalysis i IDS. A. Habib, M Hefeeda [] ad Christos [] worked o DoS i a IDS ad foud a icrease i precisio by usig classical Bayesia methods for data aalysis. Diego Zamoi [8] used a patter matchig detectio model to detect ew attacks, however, he did ot metio ay particular fusio model i his experimet. V. Chatzigiaakis, A. Leis, C. Siaterlis, M. ad Grammatikou D [4] foud that their fusio model is more effective tha sigle metric aalysis. They used Pricipal Compoet Aalysis for Multisesor data fusio for itrusio detectio. Vladimir G, Oleg K, ad Vladimir S [5] suggested that combiig a decisio model is better i thereat detectio precisio tha a Meta model i IDS. Kapil K S [5] worked o IDS architecture ad foud that rule set kowledge, expert systems state models ad strig match are useful parameters i the developmet of a advace threat detectio model. Hugh Durrat-hyte ad Mike Steves [] described mathematical model for their fusio model. They aalysed data usig Kalma Filter ad theoretical methods derived from Bayesia theorem. S Terry Brugger, [0] worked o offlie data fusio model, used data miig approach i her IDS. However, she did ot produce ay particular model durig her experimet. I the view of all above literature reviews, it is obvious that there is eough material o Multisesor data fusio models of IDS. However, very little was reported i the UNIX. Ad almost egligible work was foud if we search material or study o multiple simultaeous threat detectio i the field of UNIX.. Research Directios I this research, I ll idetify a multiple simultaeous threat detectio model. This model will be a hybrid of Bayesia ad Dempster Shafer theory of ifereces with Set Cover theory. The ew model will icrease the precisio i threat detectio ad reduce the volume of false alarms i UNIX eviromet. The use of the model will assist i decreasig the data security expeses, particularly web based busiesses. Researchers will get also beefit for future IDS developmets i UNIX.

3 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February The ew multiple simultaeous threat detectio model will be able to detect more tha oe threat simultaeously. Aother advatage is that the results of this research ca be applied i high speed etworks like cyberspace. There are also some additioal situatioal parameters that will be geerated as a result of this work such as high level architecture of multiple threat detectio model, idetificatio of proper Multisesor eviromet based o hybrid model, ad idetificatio of middle tiers of the research. Origial Cotributios I order to detect multiple threat detectio, researchers are makig efforts i order to develop suitable data fusio model based o advaced mathematical ad statistical techiques. However, most of the models detect sigle threats, few models are advaced but the work i multiple threat detectio is rare i UNIX eviromet [].. Novelties of multiple simultaeous threat detectio This research, i fact, is a step forward that addresses the additioal precisio i multiple threat detectio process as compared to the existig threat detectio approaches i UNIX ad it is differet i may ways from other s work i Multisesor data fusio i IDS developmet. ) I used hybrid model of Multisesor data fusio comprised of basic Bayesia, Dempster Shafer, ad Exteded Dempster Shafer theory of iferece i multiple simultaeous threat detectio of UNIX eviromet. ) Set Cover as a middle tier data fusio tool i hybrid Bayesia ad Dempster model is a ovel approach as o oe has used it before. ) Geeralized Evidetial processig (GEP) presets a better evidetial combiatio ad separate propositios ad the decisios. GEP will be implemeted very first time i a distributed Multisesor etwork of a UNIX eviromet.. Set Cover Set Cover is a brach of mathematics ad i this research I deal with sets, subsets ad their iteractio sets. Set Cover is the basic system of mathematics. Simple facts of set uio ad its subsets are used i cover sets of multiple simultaeous threat detectio system that is a basic brach of mathematics []. I multiple simultaeous threat detectio system the total umbers of elemets were 74 deoted by:- ui = U () ui here U is the uiversal set ad i = elemets i the uiversal set is sum of all the I the experimet, the types of threats represeted by subsets S, S, S,..., S U Ad the cost of each set is C, C, C,..., C. I our case threat(s) are preset i differet data substrigs from ay of the 4 differet itrusio detectio systems of a distributed Uix Network. The target is to fid the sets P = {,,, } that must cotai miimum umber of strigs havig threats so that each set have all the relevat strigs of data ad summatio of sets will have all the strigs of the iputs. Cover set usig greedy algorithm also provides miimum cost represeted by Q. Q = i = Ci Ci here is the sum of the costs i selectig a ew i = ode of the experimet The cost effectiveess to select computer ode is deoted by β C( Q) β = () Q P here CQ ( ) is the iitial cost for selectig the odes for each itrusio detectio system ad P is the set with miimum elemets ad Q is the miimum cost i selectig the ew ode. 4 Approaches ad Methodology I a large umber of Multisesor data fusio model, Bayesia ad Dempster Shafer have bee used for data aalysis. Most of the existig work was i sigle threat detectio []. Oly couple of researchers tried to focus o multiple threat detectio without usig Set Cover theory. Set Cover has bee idetified as a ew area which ca be used to prioritize ad schedule rule set o certai criteria i the fusio process. O this topic there are oly a few papers available i the UNIX eviromet, therefore, it is difficult to compare literature o Multisesor threat detectio i UNIX [5] [8]. Statistical /mathematical models such as Parametric / No Parametric, Bayesia, Dempster are the most commoly used theory of estimatio i data fusio i UNIX eviromet. These experimetal models were used i detectio of DoS, bombs ad buffer overflow attacks with may limitatios. This research is about idetificatio of multiple simultaeous threat detectio models. Data fusio will be doe usig hybrid model of Bayesia ad Dempster. Set Cover will be used to idetify data groups ad schedulig []. The hybrid model will provide a icrease i precisio of threats detected ad additioal theoretical ad techical ()

4 68 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February 009 kowledge about multiple threat detectio for computer security, especially for UNIX [9]. As the multiple simultaeous threat detectio system is a future prospect for IDS developmet i the UNIX eviromet. I order to make it a useful work, I ll idetify the followig parameters i my research;-.idetify ad implemet multiple simultaeous threat detectio model targetig future Itrusio Detectio systems.idetify high-level model/architecture that ca address Multiple Simultaeous attacks i UNIX.Idetify proper Multisesor data eviromet to use i the fusio model.idetify ad Implemet ad ru testig eviromet for the data fusio algorithms i multiple simultaeous threat detectio systems.idetify if my ew research o multiple simultaeous threat detectio model works well or ot? Ad provide all possible reasos i ay case.i ll provide a excellet compariso of models based o differet mathematical ifereces 4..Multiple simultaeous threat detectio system The mai target of this research is to idetify the exact threat(s) with a high degree of precisio by usig hybrid data fusio model comprised of Set cover, Bayesia theory of estimatio, Dempster ad Exteded Dempster Shafer theory. The origi ad directios of the threats are exclusive of this research as that icludes complicated, extesive ad separate research. I this distributed test eviromet which is coceptually the same as server cliet eviromet, a multiple simultaeous threat detectio system has bee set up o differet odes across the distributed subets. Computer odes are comprised of multiple operatig systems ad located at differet etworks, predomiatly UNIX though iclude itel machies as well. Each computer ode has differet itrusio detectio system that filters all the etwork data ad collects threat related iformatio ad trasfers them to the computer ode hostig multiple simultaeous threat detectio system for further accuracy ad precisio of the threat detectio results. The computer odes across differet subets receive differet threats. As this is a cotrolled experimet, 4 types of threats maily deial of service, ma-i-the-middle, buffer overflow ad Troja will be iitiated from oe of the experimetal computer ode. 4. Architecture of Multiple simultaeous threat detectio system Fig showig the architecture of the multiple simultaeous threat detectio system I this experimetal test eviromet, 4 idepedet itrusio detectio systems work as a separate Multisesor observers o differet subets. I order to moitor all data packets i the test eviromet, I used a switch o test etwork ad cofigured a moitorig port to replicate all packets of the data traffic passig through the switch. Network data of layer ad was also gathered. Data collectig software the decodes ad aalyse the data. I used followig software for data collectio:- MARS, Siffers, Soop ad ireshark. Four types of threats:- DoS, Deial of Service, Mom- ma-i-the-middle attack or bucket-brigade attack or Jaus attack, Buffer overflow or buffer overru ad Troja Horses Each itrusio detectio system collects etwork data ad filters it usig Cover set theory. Data may cotai a sigle, two, three, four or ay combiatios of the above 4 x threats or false alarms ad the move the data to ext level of the data fusio withi the multiple simultaeous threat detectio system. The Multiple simultaeous threat detectio system processes the data through differet statistical ad mathematical techiques ad makes decisio about the threats. The multiple simultaeous threat detectio system s cliet odes that exist o each computer uses the Set Cover Model as a middle tier data fusio tool which refies the data ito small group of sets ad schedules these groups of data for oward statistical ad

5 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February mathematical data fusio. Aother beefit of the Set cover model is to choose computer odes that cover all the aticipated threats at a miimum cost. 5. Results of the Test Experimet Set Cover Fusio Model The iitial cost for selectig the odes for each itrusio detectio system is:- C ( A) = 8 = cost of the st Node C ( B) = 5 = cost of the d Node C ( C) = = cost of the rd Node C ( D) = 8 = cost of the 4 th Node The sets with miimum umber of elemets deoted by P ad set with miimum cost Q for each ode were determied durig the experimet. The total umber of sets whose cost was lowest ad set with miimum umber of elemets covered by ode A, B, C ad D of the experimet are give as:- P ( A) = 0, P ( B) =, P ( C) =, P ( D) =4 Q ( A) =8, Q ( B) =4, Q ( C) =7, Q ( D) =8 Here I like to make it clear that the above values are the umber of the sets ot the elemets of the sets, therefore, it should ot cause ay problem or mix up whilst readig Table. The cost effectiveess to select computer ode A, B, C ad D are calculated usig equatio () C( A) 8 Selectig A: β A = = = (4) QA ( ) PA ( ) 8-0 Selectig B: β B = Selectig C: β C = Selectig D: β D = CB ( ) QB ( ) PB ( ) CC ( ) QC ( ) PC ( ) CD ( ) QD ( ) PD ( ) = = = = 5 (5) = (6) = (7) As per above equatios, the cost effectiveess of the ode are A, D, C ad B respectively. Iitial total cost of selectig these odes was = that is ot optimal. The optimal cost as per cost effectiveess of the odes would be A+D+C=8+8+=8. 5. Set Cover s set geeratio I order to collect 4 types of threats, 4 itrusio detectio systems collected 74 malicious substrigs of 5 ad above bytes from the experimetal etwork. Set coverig is a complex problem i iformatio techology because of the complexity of NP-complete problems. However, it was ot very hard i my research as I already had used well kow itrusio detectio systems to collect threat data ad each of them gathered data cotaiig all of the threats. The threat data was a mixture of all 4 types of geerated threats. The secod issue was cost effectiveess i choosig the computer ode. Here are the big beefits that I achieved were miimizig the size of the sets ad cost effectiveess by usig Set Packig ad Greedy algorithm respectively. Set Packig provided me the ability to select the K = 4 umber of subsets out of the uio set N of 74 such that each subset is a pair wise disjoit to other subsets. Thus each subset ow has similar strigs of the threat data whose uio is N. I order to fid out pair wise disjoit subsets, I aalysed N=74 threat data usig a small pearl script. The script separated pair wise disjoit strigs of the threat data ito 4 subsets of total 49 substrigs. The umber of elemets or substrig i each subset is give as:- Table showig the set cover subsets reduced the sizes of the sets The cliet ode seds all the above filtered data to ext level of the data fusio system of the multiple simultaeous threat detectio system. The multiple simultaeous threat detectio system combies all the multisesor threat data that has already bee filtered ito differet sets of miimum size usig Set Cover model. I order to detect the real threats, improve the accuracy ad precisio i threat detectio; the multiple simultaeous threat detectio system fuses the multisesor data with Bayesia theory of estimatio, Dempster ad Exteded Dempster Shafer theory. 5. Dempster Shafer Theory to fuse Data I this experimet, frame of discermet θ will be a set of elemetal propositios or combiatios of the hypothesis statemets. Threats deoted by T may be overlappig or differet to each other. I the set of mutually exclusive ad exhaustive set of hypotheses about threat(s) T..T. Θ = {T, T T } (8) If θ have set of hypotheses, Boolea combiatio of the set will be θ hypotheses. Dempster Shafer theory does ot calculate the probability of a hypothesis but helps i fidig out the probability of the evidetial support for a hypothesis.

6 70 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February 009 Ulike Bayesia ad classical theory of iferece, Dempster Shafer theory of iferece helps i developig probability mass m (θ) by assigig evidece to each propositios or geeral propositios. Each itrusio detectio system ca assig evidece via probability mass to each of the 4 threats, e.g. M (T), M (T), M (T) ad M4 (T4). The total probability masses of all the propositios icludig geeral propositios will be equal to. The probability mass is represeted as:- m (θ) (9) m (θ) = (0) m (θ) is the probability mass of ay possible hypotheses. I this experimet that may be a sigle threat or combiatios of the 4 threats. 5. Propositios / Hypothesis A hypothesis may be a propositio whilst a propositio ca be a hypothesis or combiatios of hypotheses. I this experimet, I ve 4 sesors (itrusio detectio systems) ad 4 differet types of threats. Sesors ca receive a sigle threat or ay possible combiatios of the 4 geerated threats. The total possible base propositios usig mathematical theory of combiatorics with ad without repetitios are 40 ad 5 respectively. As repeated threats are of o sigificace durig hypothesis testig ad will also uecessary icrease processig cost ad time. Therefore, I ll oly cocetrate o the propositios without repetitios. Oly 645 (5 x 49) o repetitive propositios will be processed ad tested by MTDS egie as compared to 7760 (40 x 74) with repetitive propositios. The geeral Combiatios ad Permutatios formula is:! P(,r) = () r! ( r)! here is the umber of sesors (Itrusio Detectio System), r is the umber of threats to be selected (0 r ), where =4 i this experimet, if r =, P(, r) =! Case : whe sigle threat detected by each sesor, total # of hypothesis / propositios with ad without repetitios would be 4 ad 4 Case : whe two threats detected by each sesor, total # of hypothesis / propositios with ad without repetitios would be 6 ad 6 Case : whe three threats detected by each sesor, total # of hypothesis / propositios with ad without repetitios would be 4 ad 64 Case 4: whe four threats detected by each sesor, total # of hypothesis / propositios with ad without repetitios would be ad 56 Limitatio Due to high complexity of the probability mass ad weights calculatios, it is ot possible for me to cover all the 5 o repetitive hypotheses durig my research. Therefore, I ll test oly four elemetary hypotheses as metioed i sectio Fusio without usig the eights of the itrusio detectio systems This experimet has 4 types of itrusio detectio systems ad each has its ow way of threat detectio. This meas each itrusio detectio system has differet perceptio ad reliability that it provides to multiple simultaeous threat detectio system. The Dempster Shafer model to combie the probability masses of the threats from more tha two idepedet itrusio detectio systems:- p({ Ti}) Mi( Ti) = () p({ Ti}) + p({ Ti}) 0 0 here Mi( Ti ) is probability mass fuctio, T is the threat(s) ad i }) is the probability of a ith threat of the jth Itrusio Detectio System for a particular type of the threat? The calculatio of the combied probability mass fuctios will be followed as:- }) = = = 0.05 () 0 }) is the probability assiged to the st threat by st Itrusio detectio system. 0 }) = = = (4) 4 }) is the probability assiged to the d threat by d Itrusio detectio system. 9 }) = = = (5) 95 }) is the probability assiged to the rd threat by rd Itrusio detectio system. 7 4}) = = = (6) 0

7 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February }) is the probability assiged to the 4th threat by 4th Itrusio detectio system. Puttig the above values i the combied probability mass formulas! }) M, ( T, ) = }) + P({ T }) P({ T }) (7) M ( T ) is the combied probability mass of the,, itrusio detectio system ad assiged to threat ad. M ( T ) = (8),, }) M,, ( T,, ) = }) + P({ T }) P({ T }) P({ T }) (9) M ( T ) is the combied probability mass of the,,,, itrusio detectio system, ad assiged to threat, ad. M,, ( T,, ) = (0) Similarly the probability mass of the 4 itrusio detectio system would be:- M,,,4 (T,,,4 )= P({T })P({T })P({T })P({T }) 4 () P({T })P({T })P({T })P({T })+P({ 촖 })P({ 촖 })P({ 촖 })P({ 촖 }) 4 4 M (T ) is the combied probability mass of the,,,4,,,4 itrusio detectio system,, ad 4 assiged to threat,, ad 4. M,,,4 ( T,,,4 ) = () I this experimet oly 4 x threats ad 4 x itrusio detectio systems are participatig i data gatherig, therefore this combied probability mass formula for two, three ad four threats will be calculated. 5.5 Data Fusio usig eights of the itrusio detectio systems Bayesia decisio theory caot differetiate betwee ucertaity ad igorace, plus it eeds to assig evidece to a hypothesis. The Dempster Shafer theory of iferece that is a extesio of the Bayesia decisio theory overcomes this issue ad presets mathematical approach that ca assig evidece to a sigle or group of propositios i a experimet ad ca combie probability masses of the propositios emergig from more tha two sources but its self-evidet defiitio of evidece (probability mass) is ot very accurate. The Dempster Shafer theory of iferece also has some issues i reormalizatio of the probability mass durig probability masses combiatios. Thus it has become oe of the most challegig tasks to fid out the ways to perfect the evidetial or probability mass combiatio techiques to icrease the accuracy of the statistical decisios. I my research, I used two differet ways to improve decisio makig.. eights of the observatios. Geeralized Evidece Processig (ot doe yet) These methods miimised the effect of probability assigmets to the propositios ad reormalizatio of the rule of combiatios of the probability masses of the prepositio(s). The assumptio I made, i the above data fusio model is that all Itrusio Detectio Systems have same weights or degree of accuracy i detectig a type of threat. This is ot valid i this particular case because those 4 itrusio detectio systems are differet products ad obviously have differet level of accuracy i threat detectios. Thus each of these Itrusio Detectio Systems i detectig the same type of a threat may provide differet level of precisio. If a Itrusio Detectio System is better tha others i determiig a particular type of threat(s) so it will be ufair to give the same weights to all the Itrusio Detectio Systems i this particular case. Therefore, I eed to measure the weight of each Itrusio Detectio Systems that determies its level of precisio ad reliability for particular threat detectio. There are may methods to fid out the weights. I used Maximum Etropy method to calculate the weight of the Itrusio Detectio Systems i threat detectio. (Graham allies derivatio) eights of the four Itrusio Detectio Systems are calculated by usig Max Etropy (MaxEt) As each computer ode has differet itrusio detectio system, it is quite obvious that the reliability of each itrusio detectio system is differet. The Dempster- Shafer theory is cosidered to be a excellet mathematical model to measure ucertaity i threat detectio. Dempster-Shafer theory ad Exteded Dempster-Shafer models provide umerical methods for multiple threat aalyses of the data collected from differet itrusio detectio systems whilst each itrusio detectio system have differet reliability. The Probability formula for calculatig the probability mass ad weights of a Itrusio Detectio System for a particular threat is:-

8 [ 7 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February 009 Mi( Ti) i = 0 0 i}) i i}) i + P({ Ti}) i () here T is the threat ad is the weight of the itrusio detectio system ad P is the probability of the ith threat of jth Itrusio Detectio System. Ad i}) i = P ({ Ti}) i (4) i}) i is the probability assiged to the threat by Itrusio detectio system with weight. The Probability formula for calculatig the weights of a Itrusio Detectio System for a particular threat:- = P log P (5) i i here is the weight of the Itrusio Detectio Systems (sesors) ad P is the probability of a ith threat of jth Itrusio Detectio Systems. Calculatios of the Exteded Dempster Shafer will be as followed:- 9 }) = = = (6) }) is the weighted probability assiged to the st threat by st Itrusio detectio system. 8 }) = = = (7) 46 }) is the weighted probability assiged to the d threat by d Itrusio detectio system. 6 }) = = = (8) 98 }) is the weighted probability assiged to the rd threat by rd Itrusio detectio system }) = = = (9) }) is the weighted probability assiged to the 4th threat by 4th Itrusio detectio system. The weights of the itrusio detectio systems:- = Plog P = (0) is the weight of the st itrusio detectio system = Plog P = () is the weight of the d itrusio detectio system = Plog P = () i = is the weight of the rd itrusio detectio system 4 = P4 log P4 = () 4 is the weight of the 4th itrusio detectio system }) }) M ( T ) i = (4),, }) }) + P({ T}) P({ T }) M ( T ) i is the weighted combied probability mass,, of the probability assiged to st ad d threat by st ad d itrusio detectio system. = (5) Similarly the other weighted combied probability masses of the other itrusio detectio systems would be:- M ( T ) i = (6),,,, M ( T ) i = (7),,, 4,,, Threat Results based o Dempster Shafer Theory of Iferece After Set Cover data fusio we had a total of 49 threats (Table). This threat data is ow further processed by the ext part of the multiple simultaeous threat detectio system that is Dempster Shafer as show i Fig. I order to icrease the precisio of each threat was passed through multiple hypotheses testig as proposed i sec 5.. The itrusio detectio system classified the Dempster Shafer ifereces ito 4 types. Observed threats,, ad Real Alerts that helped i determiig

9 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February the real threat detectio ad false positive rates. The fial results of this part of the fusio have bee give i Table. False Positive rates are determied usig the formula:- Real Alerts False Positive Rates = *00 (8) Observerd Alerts Ad Threat Detectio rate is calculated usig the equatio:- Threat Detectio Rate = *00 Observerd Threats (9) Threat observatios by the multiple simultaeous threat detectio system usig Dempster Shafer IDS OT OA DA RA ireshark 0 Siffers Soop MARS Total where OT stads for Observed threats, OA for, DA for Detected Attacks ad RA for Real Alerts Table Threat Results based o Dempster Shafer Theory of Iferece 5.7 Threat Results based o Exteded Dempster Shafer Theory of Iferece Just like the Dempster Shafer iferece, 49 threats data aalysed by the Exteded Dempster Shafer iferece ad Itrusio Detectio System the grouped as give i Table. It is obvious that real alerts have goe up from 4 to that is a sigificat idicatio that False Positive Rates have reduced as compared to Dempster Shafer. Likewise there is a obvious improvemet i threat detectio rate as well. Threat observatios by the multiple simultaeous threat detectio system usig Exteded Dempster Shafer IDS OT OA DA RA ireshark 9 Siffers 46 8 Soop 98 6 MARS Total where OT stads for Observed threats,oa for DA for Detected Attacks ad RA for Real Alerts 5.8 Performace of the multiple simultaeous threat detectio system The multiple simultaeous threat detectio system is a multisesor data fusio system. Its major compoets statistical ad mathematical set covers, Dempster Shafer ad extesio Dempster Shafer are the mai data processig cores ad heart of the data processig uit for the system. The larger the umber of sesors the greater should be the accuracy ad precisio i the results. Although Bayesia ad Dempster Shafer provide best processig model i multisesor data fusio but ivolve too much complex iteratio of the data fusio process i terms of its probability mass ad weight calculatios. Therefore, i real life, it would be a very hard task to use Bayesia ad DS model for combiig probability masses of a experimet havig a more tha four sesors, particularly i case of overlappig ad coflictig propositios. The greater the umber of sesors, larger would be precisio i threat detectio, that s why I m lookig ito possibility of usig more tha 4 sesors i my ext step ad will use Geeralized Evidece Processig (GEP) theory. I my experimet, I performed experimet i three steps usig evideces of d, rd ad the 4th sesors (itrusio detectio systems) to the 4 type of threats. The sesors were 4 itrusio detectio systems. I compared their results ad have proved the obvious fact that the combied results of the 4 sesors have improved threat detectio sigificatly. Bayesia ad Dempster Shafer theory of ifereces provided me tools to combie evideces of these sesors ad measure the ucertaity of a hypothesis or to gai better cofidece i the combied probability measuremets to the evideces or propositios. The followig are the graphs draw i Microsoft Excel to display the results of multiple simultaeous threat detectio system. Comparig efficiecy of the Demspter Shafer ad Exteded Demspter Shafer data fusio techiques, figure ad are showig a sigificat icrease i the combied probability masses i case of Exteded Demspter Shafer Theory. That is a good idicatio of ehaced precisio, accuracy ad better performace of Exteded Demspter Shafer data fusio i threat detectio over the Dempster Shafer Data fusio techiques. Table Threat Results based o Exteded Dempster Shafer Theory of Iferece

10 74 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February 009 Combied probability Mass Performace of Multiple Simultaeous Threat Detectio system DS Prob mass Expo Prob mass Liear (DS Prob Sesors Set-Itrusio Detectio System Fig Performace of the multiple simultaeous threat detectio system Effectiveess of Multiple Simultaeous Threat detectio System Improvemet % Sesors Sets- Itrusio detectio System Fig Effectiveess of the multiple simultaeous threat detectio System 6. Coclusios The empirical experimet of multiple simultaeous threat detectio system proved that the hybrid model had sigificat icrease i precisio i threat detectio. Dempster Shafer iferece produced 9% detectio rate whilst exteded Dempster Shafer had 59% detectio rate. So o a average, four Itrusio Detectio Systems icreased 0% detectio rate. The false positive rate also wet dow from 6 % to %. (Detectio rate is calculated by dividig detected alerts by observed alerts ad false positive rate is derived by dividig real alerts by observed alerts.) Thus there was a et improvemet of 5 % i gettig rid of false positive alarms ad that is highly sigificat achievemet. Aother achievemet of the multiple simultaeous threat detectio system was its better performace to joi probability masses from 4 differet Itrusio Detectio. The combied probability mass of the Dempster Shafer was 0.06 whilst Exteded Dempster Shafer had combied probability mass 0.4, so there was 6 % icrease i determiig the combied probability masses. The Multiple simultaeous threat detectio system also proved that icrease i umber of sesors cotiuously improvig the threat detectio. However there are calculatio complexities ivolved i determiig joied probability masses usig Bayesia ad Dempster Shafer that made impossible to have more tha 4 sesors (itrusio Detectio systems). Set Cover as a middle tier data fusio tool produced icredible results, particularly i data groupig that amazigly miimise the computatioal processig cpu ad memory overhead cost ad time. Set Cover reduce data populatio (from 74 to 49) to the level that it became possible to detect more tha simultaeous threats with less computatioal efforts whist that was almost impossible with the existig threat detectio approaches ad others that used Bayesia ad Dempster Shafer. Set Cover also determied the cost effectiveess of choosig a computer ode for the multiple simultaeous threat detectio system. Thus the Set cover played a vital role to assist Multiple simultaeous threat detectio system to improve its ability to icrease precisio of threat detectio results. Lookig ito the results, it is obvious that results of experimet has prove that my proposed threat detectio system multiple simultaeous threat detectio system remaied successful to achieve my research goals. I order to improve precisio of threat detectio, as a ext step of my research, the mai task I m plaig is to implemet Geeralised Evidetial Processig (GEP). GEP is a extesio of the Bayesia ad Dempster Shafer theory that presets a better evidetial combiatio ad separate propositios ad the decisios. Therefore each propositio or set of propositios ca be tested ad aalysed separately at differet levels of the data. I additio to that I ll focus to improve the quality of the test experimet ad write the fial thesis. 8. Ackowledgmets I would like to thak Dr. Paul Kwa (my pricipal supervisor) for his suggestio o the iitial research directio ad his valuable commets o how to structure this paper. I also thak to Thomas Keri, IBM, Capacity Plaer, Melboure, Victoria, Australia for his suggestios. 9. Refereces [] A. Bedjebbour, Y. Deligo, et al., Multisesor Image Segmetatio Usig Dempster-Shafer Fusio i Markov Fields Cotext, IEEE Trasactio o GeoSciece ad Remote Sesig, Volume 9 Issue 8, August 00; pp. -0 [] A. Habib, M. Hefeeda, ad B. Bhargava. Detectig service violatios ad DoS attacks. I NDSS Coferece Proceedigs. Iteret Society, 00; pp

11 IJCSNS Iteratioal Joural of Computer Sciece ad Network Security, VOL.9 No., February [] Aickeli U (00): A Idirect Geetic Algorithm for Set Coverig Problems, Joural of the Operatioal Research Society, 5(0), pp [4] Be Grocholsky, Alexei Makareko, Hugh F. Durrat-hyte: Iformatio-theoretic coordiated cotrol of multiple sesor platforms. ICRA 00: pp [5] Brau, J. (000) Dempster-Shafer theory ad Bayesia reasoig i multisesor data fusio, Sesor Fusio: Architectures, Algorithms ad Applicatios IV; Proceedigs of SPIE 405, pp [6] COMPUTER SECURITY INSTITUTE. Cyber crime bleeds U.S. corporatios, survey shows, Apr. 00. accessed o.. Accessed 6 Jauary 00. [7] D. Hall. Mathematical Techiques i Multisesor Data Fusio. Artech House, Norwood, Massachusetts, 99;pp [8] Diego Zamboi. Doig itrusio detectio usig embedded sesors CERIAS Techical report 000-, CERIAS, Purdue Uiversity, est Lafayette, IN, Oct, 000;pp. -9 [9] Do Koks ad Subhash Challa, 005, A Itroductio to Bayesia ad Dempster-Shefer Data Fusio; pp. - 5 [0] Dog ad Deborah (ACM 005) Alert Cofidece Fusio i Itrusio Detectio Systems with Exteded Dempster-Shafer Theory; pp [] H. u, M. Siegel, R. Stiefelhage, ad J. Yag. Sesor fusio usig Dempster-Shafer theory. I Proceedigs of IEEE Istrumetatio ad Measuremet Techology Coferece, Achorage, AK, USA, 00;-6 [] Hugh F. Durrat-hyte: Data fusio i sesor etworks. IPSN 005, pp [] J. Burroughs, L. F. ilso ad George V. Aalysis of Distributed Itrusio Detectio Systems Usig Bayesia Methods, preseted at IPCCC 00, April 00; pp [4] J. R. Bosto, A Sigal Detectio System Based o Dempster-Shafer Theory ad Compariso to Fuzzy Detectio, IEEE Trasactios o Systems, Ma, ad Cyberetics, Part C: Applicatios ad Reviews, Volume 0, Issue, February 000;pp [5] Kapil Kumar S, 000 Itrusio Detectio ad Aalysis, Uiversity of British Columbia [6] Lawrece A. Klei, Sesor ad Data Fusio Cocepts ad Applicatios (secod editio), SPIE Optical Egieerig Press, 999, ISBN ; pp. -5 [7] Ma, Big 00 Parametric ad No Parametric Approaches for Multisesor Data Fusio PhD thesis, Uiversity Of Michiga;- [8] Nig P, Xu D, Healey C ad Amat R (004), Buildig Attack Scearios through Itegratio of Complemetary Alert Correlatio Methods, th Aual Network ad Distributed System Security Symposium, pp. 97- [9] Rehma R, (00) Itrusio Detectio System with SNORT, accessed o.. ; pp [0] S Terry Brugger, 004 Data Miig for Network Itrusio Detectio PP.8/55 accessed o.. df [] Siaterlis C ad Maglaris B (004), Towards Multisesor Data Fusio for DoS detectio, Proceedigs of the 004 ACM symposium o Applied Computig; pp.-8 [] SPAFFORD, E. H. The Iteret worm icidet. Tech. Rep. Purdue Techical Report CSD-TR-9, Departmet of Computer Sciece, Purdue Uiversity, est Lafayette, IN , 99. LEM OS, R. Coutig the cost of slammer, Ja. 00; pp. -9 [] Tim Bass ad Dave Gruber. a glimpse ito the future of id. Useix. 8 Aug 005. accessed o.. [4] V. Chatzigiaakis, A. Leis, C. Siaterlis, M. Grammatikou, D. Kalogeras, S. Papavassiliou & V. Maglaris 00, Distributed Network Moitorig ad aomaly Detectio as a Grid Applicatio ;pp. - [5] V.Gorodetski, O.Karsaev, I.Koteko, ad A.Khabalov. "Software Developmet Kit for Multi-aget Systems Desig ad Implemetatio". I B.Dui-Keplicz ad E.Nawareski (Eds.) "From Theory to Practice i Multi- aget Systems". Lecture Notes I Artificial Itelligece, vol. 96, -0, Spriger Verlag, 00;pp. -0