8,842 research outputs found
ProtoMon: Embedded Monitors for Cryptographic Protocol Intrusion Detection and Prevention
Intrusion Detection Systems (IDS) are responsible for monitoring and analyzing host or network activity to detect intrusions in order to protect information from unauthorized access or manipulation. There are two main approaches for intrusion detection: signature-based and anomaly-based. Signature-based detection employs pattern matching to match attack signatures with observed data making it ideal for detecting known attacks. However, it cannot detect unknown attacks for which there is no signature available. Anomaly-based detection uses machine-learning techniques to create a profile of normal system behavior and uses this profile to detect deviations from the normal behavior. Although this technique is effective in detecting unknown attacks, it has a drawback of a high false alarm rate. In this paper, we describe our anomaly-based IDS designed for detecting malicious use of cryptographic and application-level protocols. Our system has several unique characteristics and benefits, such as the ability to monitor cryptographic protocols and application-level protocols embedded in encrypted sessions, a very lightweight monitoring process, and the ability to react to protocol misuse by modifying protocol response directly
Sleep Deprivation Attack Detection in Wireless Sensor Network
Deployment of sensor network in hostile environment makes it mainly
vulnerable to battery drainage attacks because it is impossible to recharge or
replace the battery power of sensor nodes. Among different types of security
threats, low power sensor nodes are immensely affected by the attacks which
cause random drainage of the energy level of sensors, leading to death of the
nodes. The most dangerous type of attack in this category is sleep deprivation,
where target of the intruder is to maximize the power consumption of sensor
nodes, so that their lifetime is minimized. Most of the existing works on sleep
deprivation attack detection involve a lot of overhead, leading to poor
throughput. The need of the day is to design a model for detecting intrusions
accurately in an energy efficient manner. This paper proposes a hierarchical
framework based on distributed collaborative mechanism for detecting sleep
deprivation torture in wireless sensor network efficiently. Proposed model uses
anomaly detection technique in two steps to reduce the probability of false
intrusion.Comment: 7 pages,4 figures, IJCA Journal February 201
SecMon: End-to-End Quality and Security Monitoring System
The Voice over Internet Protocol (VoIP) is becoming a more available and
popular way of communicating for Internet users. This also applies to
Peer-to-Peer (P2P) systems and merging these two have already proven to be
successful (e.g. Skype). Even the existing standards of VoIP provide an
assurance of security and Quality of Service (QoS), however, these features are
usually optional and supported by limited number of implementations. As a
result, the lack of mandatory and widely applicable QoS and security guaranties
makes the contemporary VoIP systems vulnerable to attacks and network
disturbances. In this paper we are facing these issues and propose the SecMon
system, which simultaneously provides a lightweight security mechanism and
improves quality parameters of the call. SecMon is intended specially for VoIP
service over P2P networks and its main advantage is that it provides
authentication, data integrity services, adaptive QoS and (D)DoS attack
detection. Moreover, the SecMon approach represents a low-bandwidth consumption
solution that is transparent to the users and possesses a self-organizing
capability. The above-mentioned features are accomplished mainly by utilizing
two information hiding techniques: digital audio watermarking and network
steganography. These techniques are used to create covert channels that serve
as transport channels for lightweight QoS measurement's results. Furthermore,
these metrics are aggregated in a reputation system that enables best route
path selection in the P2P network. The reputation system helps also to mitigate
(D)DoS attacks, maximize performance and increase transmission efficiency in
the network.Comment: Paper was presented at 7th international conference IBIZA 2008: On
Computer Science - Research And Applications, Poland, Kazimierz Dolny
31.01-2.02 2008; 14 pages, 5 figure
- …