NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F14%3APU112017" target="_blank" >RIV/00216305:26230/14:PU112017 - isvavai.cz</a>

Výsledek na webu

<a href="http://www.fit.vutbr.cz/research/pubs/all.php?id=10658" target="_blank" >http://www.fit.vutbr.cz/research/pubs/all.php?id=10658</a>

DOI - Digital Object Identifier

—

Jazyk výsledku

angličtina

Název v původním jazyce

NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic

Popis výsledku v původním jazyce

This paper examines the detection properties of obfuscated network buffer overflow attacks by selected IDS and NBA. The obfuscation was performed by tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of simulating the usual legitimate characteristics of the HTTP traffic's flow. The buffer overflow vulnerabilities of four services were used: Samba, BadBlue, Apache, DCOM RPC. Exploitation was performed in a virtual network environment by using scenarios simulating real traffic's conditions as well as legitimate traffic simulations which were performed. Captured data were examined by SNORT and by ASNM network features of the AIPS representing statistically and behaviorally based NBA. The achieved results show an obfuscated attacks transparency for SNORT detection and low detection performance of the AIPS trained by direct attacks and legitimate traffic only in contrast with high classification accuracy of the AIPS trained with an inclusion of obfuscated attacks. Data mining analysis was performed by using both bi-nominal and poly-nominal classifications, resulting into better performance of poly-nominal classification. At the summary, we emphasize the necessity of training the statistically and behaviorally based NBAs with divergent obfuscation techniques to strengthen their detection capabilities.

Název v anglickém jazyce

NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic

Popis výsledku anglicky

This paper examines the detection properties of obfuscated network buffer overflow attacks by selected IDS and NBA. The obfuscation was performed by tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of simulating the usual legitimate characteristics of the HTTP traffic's flow. The buffer overflow vulnerabilities of four services were used: Samba, BadBlue, Apache, DCOM RPC. Exploitation was performed in a virtual network environment by using scenarios simulating real traffic's conditions as well as legitimate traffic simulations which were performed. Captured data were examined by SNORT and by ASNM network features of the AIPS representing statistically and behaviorally based NBA. The achieved results show an obfuscated attacks transparency for SNORT detection and low detection performance of the AIPS trained by direct attacks and legitimate traffic only in contrast with high classification accuracy of the AIPS trained with an inclusion of obfuscated attacks. Data mining analysis was performed by using both bi-nominal and poly-nominal classifications, resulting into better performance of poly-nominal classification. At the summary, we emphasize the necessity of training the statistically and behaviorally based NBAs with divergent obfuscation techniques to strengthen their detection capabilities.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/ED1.1.00%2F02.0070" target="_blank" >ED1.1.00/02.0070: Centrum excelence IT4Innovations</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Rok uplatnění

2014

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of International Conference for Internet Technology and Secured Transactions (ICITST-2014)

ISBN

978-1-908320-40-7

ISSN

—

e-ISSN

—

Počet stran výsledku

8

Strana od-do

311-318

Název nakladatele

IEEE Computer Society

Místo vydání

London

Místo konání akce

Londýn

Datum konání akce

8. 12. 2014

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—