Verify Results of Network Intrusion Alerts Using Lightweight Protocol Analysis

Citation

• J. Zhou, A. Carlson, and M. Bishop, “Verify Results of Network Intrusion Alerts Using Lightweight Protocol Analysis,” Proceedings of the 21st Annual Computer Security Applications Conference pp. 117–126 (Dec. 2005).

Paper

• PDF
• PS

Bibliographic Information

• DOI: 10.1109/CSAC.2005.62
• BibTeX
• EndNote

Abstract

We propose a method to verify the result of attacks detected by signature-based network intrusion detection systems using lightweight protocol analysis. The observation is that network protocols often have short meaningful status codes saved at the beginning of server responses upon client requests. A successful intrusion that alters the behavior of a network application server often results in an unexpected server response, which does not contain the valid protocol status code. This can be used to verify the result of the intrusion attempt. We then extend this method to verify the result of attacks that still generate valid protocol status code in the server responses. We evaluate this approach by augmenting Snort signatures and testing on real-world data. We show that some simple changes to Snort signatures can effectively verify the result of attacks against the application servers, thus significantly improve the quality of alerts.

Copyright Notice

©2005 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author’s copyright. In most cases, these works may not be reposted without the explicit permission of the copyright holder.
The definitive version was published in Proceedings of the 21st Annual Computer Security Applications Conference, Dec. 2005.