Detecting Compounded Anomalous SNMP Situations Using Cooperative Unsupervised Pattern Recognition

Transcription

1 Detectng Compounded Anomalous SNMP Stuatons Usng Cooperatve Unsupervsed Pattern Recognton Emlo Corchado, Álvaro Herrero, José Manuel Sáz Department of Cvl Engneerng, Unversty of Burgos, Span Abstract. Ths research employs unsupervsed pattern recognton to approach the thorny ssue of detectng anomalous network behavor. It apples a connectonst model to dentfy user behavor patterns and successfully demonstrates that such models respond well to the demands and dynamc features of the problem. It llustrates the effectveness of neural networks n the feld of Intruson Detecton (ID) by explotng ther strong ponts: recognton, classfcaton and generalzaton. Its man novelty les n ts connectonst archtecture, whch up untl the present has never been appled to Intruson Detecton Systems (IDS) and network securty. The IDS presented n ths research s used to analyse network traffc n order to detect anomalous SNMP (Smple Network Management Protocol) traffc patterns. The results also show that the system s capable of detectng ndependent and compounded anomalous SNMP stuatons. It s therefore of great assstance to network admnstrators n decdng whether such anomalous stuatons represent real ntrusons. 1 Introducton Intruson Detecton Systems (IDS) are tools desgned to montor the events occurrng n a computer system or network, analysng them to detect suspcous patterns that may be related to a network or system attack. They have become a necessary addtonal tool to the securty nfrastructure as the number of network attacks has rsen very sharply over recent years. There are currently several technques used to mplement IDS. Some are based on the use of expert systems (contanng a set of rules that descrbe attacks), sgnature verfcaton (where attack scenaros are converted nto sequences of audt events), petr nets (where known attacks are presented wth graphcal petr nets) or statetranston dagrams (representng attacks wth a set of goals and transtons). One of the man dsadvantages of these technques s the fact that new attack sgnatures are not automatcally dscovered wthout updatng the IDS. Connectonst models have been dentfed as very promsng methods of addressng the ID problem due to two key features: they are sutable to detect day-0 attacks and they are able to classfy patterns (attack classfcaton, alert valdaton). There have recently been several attempts to apply artfcal neural archtectures [1, 2] (such as Self-Organsng Maps [3, 4] or Elman Network [5]) to the feld of network securty. Ths paper presents an IDS based on a neural archtecture that has never before been appled to the problem of ID.

2 2 The Cooperatve Unsupervsed IDS Model Exploratory Proecton Pursut (EPP) [6, 7, 8, 9] s a statstcal method for solvng the complex problem of dentfyng structure n hgh dmensonal data. It s based on the proecton of the data onto a lower dmensonal subspace n whch ts structure s searched by eye. It s necessary to defne an ndex to measure the varyng degrees of nterest generated by each proecton. Subsequently, the data s transformed by maxmzng the ndex and the assocated nterest. From a statstcal pont of vew the most nterestng drectons are those that are as non-gaussan as possble. The Data Classfcaton and Result Dsplay steps performed by ths IDS model are based on the use of a neural EPP model called Cooperatve Maxmum Lkelhood Hebban Learnng (CMLHL) [10, 11, 12]. It was ntally appled to the feld of Artfcal Vson [10, 11] to dentfy local flters n space and tme. Here, we have appled t to the feld of Computer Securty [2, 13, 14]. It s based on Maxmum Lkelhood Hebban Learnng (MLHL) [8, 9]. Consder an N-dmensonal nput vector, x, and an M-dmensonal output vector, y, wth W beng the weght lnkng nput to output and let η be the learnng rate. MLHL can be expressed as: N y = W x,. (1) = 1 The actvaton ( e ) s fed back through the same weghts and subtracted from the nput: Weght change: e = x M = 1 W y,. (2) p 1 ( e ) e W = η. y. sgn. (3) Lateral connectons [10, 11] have been derved from the Rectfed Gaussan Dstrbuton [15] and appled to the MLHL. The resultant net can fnd the ndependent factors of a data set but do so n a way that captures some type of global orderng n the data set. So, the fnal CMLHL model s as follows: Feed forward step: Equaton (1) Lateral actvaton passng: y ( t + ) = [ y (t) + τ( b Ay) ] + 1. (4) Feed back step: Equaton (2) Weght change: Equaton (3) Where: η s the learnng rate, τ s the strength of the lateral connectons, b s the bas parameter and p s a parameter related to the energy functon [8, 9, 11]. Fnally A s a symmetrc matrx used to modfy the response to the data. Its effect s based on the relaton between the dstances among the output neurons.

3 3 Model Structure The am of ths research s to desgn a system capable of detectng anomalous stuatons wthn a computer network. The nformaton analysed by our system s obtaned from the packets that travel along the network, meanng that t s a Network-Based IDS. The data needed to analyse the traffc s contaned on the captured packets headers, obtaned usng a network analyser. The structure of the IDS model s descrbed as follows: Frst step.- Network Traffc Capture: one of the network nterfaces s set up n promscuous mode. It captures all the packets travellng along the network. Second step.- Data Pre-processng: the captured data s pre-processed and used as an nput data n the followng stage. Thrd step.- Data Classfcaton: once the data has been pre-processed, the connectonst model (secton 2) analyses the data and dentfes anomalous patterns. Fourth step.- Result Dsplay: the last step s related to the vsualzaton stage. Fnally the output s presented to the network admnstrator. 4 Real Data Sets Contanng Compounded and Independent Anomalous SNMP Stuatons We have decded to study anomalous SNMP stuatons because an attack based on ths protocol may severely compromse system securty [17]. CISCO [18] ranked the top fve most vulnerable servces n order of mportance, and SNMP was one of them. In the short-term, SNMP was orented to manage nodes n the Internet communty [19]. Our efforts have focussed on the study of two of the most dangerous anomalous stuatons related to SNMP [2, 13, 14]: SNMP port sweep: t s a scannng of network computers for the SNMP port usng snffng methods. The am s to make a systematc sweep wthn a group of hosts to verfy f SNMP s actve n any port. Both default port numbers (161 and 162) and random port number (3750) are used. MIB nformaton transfer: the MIB (Management Informaton Base) can be defned n broad terms as the database used by SNMP to store nformaton about the elements that t controls. Ths stuaton s a transfer of some nformaton contaned n the SNMP MIB. Ths knd of transfer s potentally qute a dangerous stuaton because anybody who possesses some free tools, some basc SNMP knowledge and the communty password (n SNMP v. 1 and SNMP v. 2) wll be able to access all sorts of nterestng and sometmes useful nformaton. In ths work, the IDS analysed three dfferent data sets: 1 st Data set (Fg 1): ths ncludes an example of each one of the anomalous stuatons defned above: an SNMP port sweep and an MIB nformaton transfer. We have called ths a compounded anomalous SNMP stuaton because t nvolves smple but dfferent anomalous events that occur at the same tme. 2 nd Data set (Fg 2.a): ths contans an example of an SNMP port sweep stuaton (an ndependent anomalous SNMP stuaton).

4 3 rd Data set (Fg 2.b): an example of an MIB nformaton transfer stuaton (another ndependent anomalous SNMP stuaton). In addton to the SNMP packets, these data sets contan traffc related to other protocols nstalled n our network, such as NETBIOS and BOOTPS. In the Data Pre-processng step, the system performs a data selecton from all of the captured nformaton. As a result, all of the above-mentoned data sets contan the followng fve varables extracted from the packet headers: tmestamp (the tme when the packet was sent n relaton to the frst one), protocol (all the protocols contaned n the data set have been codfed, takng values between 1 and 35), source port (the port number of the source host that sent the packet), destnaton port (the destnaton host port number to whch the packet s sent) and sze (total packet sze n Bytes). 5 Results, Conclusons and Future Work Scatterplot Matrx s used to analyse parwse relatonshps between varables n hgh dmensonal data sets. Each factor par hghlghts dfferent structures or clusters n the proectons of the same data set. It was used to analyse the results obtaned from the connectonst IDS model. The system dentfed (Fg 1.a) the two anomalous stuatons contaned n the real compounded data set. The analyss took account of such aspects as traffc densty or anomalous traffc drectons. Factor par 2-1 (Fg 1.a) contans the best representaton of ths anomalous stuaton, where the horzontal axe s related wth the tme feature and the vertcal axe represents a combnaton of the protocol and sze features. There are several ssues to hghlght about ths fgure: (Fg 1.a) dentfes the sweep by means of normal and abnormal drectons. It s clear that packets contaned n ths group do not progress n the same drecton as the rest of packets groups (related to normal stuatons). On the other hand, Groups 2 and 3 (Fg. 1.a) brng together packets related to the MIB nformaton transfer. These groups are dentfed as anomalous due to ther hgh temporal packets concentratons. Group 3 Group 3 Fg. 1.a. Scatterplot Matrx factor par 2-1 generated by the model for the 1 st data set Fg. 1.b. PCA proecton for the 1 st data set We have appled dfferent connectonst methods such as Prncpal Component Analyss (PCA) [20] (Fg. 1.b) or MLHL to the same data set. CMLHL provdes more

5 sparse proectons than the others [11]. CMLHL s able of dentfyng both anomalous stuatons whle PCA (Fg. 1.b) s only able to dentfy the sweep (Groups 1, 2 and 3). On the other hand, as can be seen n Fg. 2.a and Fg. 2.b, the neural IDS s capable of dentfyng both anomalous stuatons ndependently. The followng fgures (Fg. 2.a and Fg 2.b) show how the system performs successfully n those cases where there s only one anomalous stuaton wthn normal ones (2 nd and 3 rd Data Sets). In Fg 2.a we have dentfed the sweep (Groups 1, 2 and 3) by means of normal/abnormal drecton and n Fg 2.b we have dentfed the MIB transfer (Groups 1 and 2) by means of hgh temporal concentraton of packets. Group 3 Fg. 2.a. Independent SNMP anomalous stuaton by a port sweep (2 nd data set) Fg. 2.b. Independent SNMP anomalous stuaton by a MIB transfer (3 rd data set) Ths research demonstrates the effectveness and robustness of ths novel IDS due to ts capablty to dentfy anomalous stuatons n two dfferent ways: whether or not they are contaned n the same data set. In summary, the connectonst IDS descrbed n ths paper s able to dentfy both ndependent and compounded anomalous SNMP stuatons showng ts capablty for generalzaton. The vsualzaton tool used n the Result Dsplay step, shows data proectons that hghlght anomalous stuatons suffcently clearly to alert the network admnstrator, takng nto account such aspects as traffc densty or abnormal drectons. One of the most common IDS technques s the one called sgnature verfcaton [20b]. Most of sgnature verfcaton systems use pattern matchng algorthms based on prevously establshed rules ncluded n a database. To reduce the number of posteror false alarms, ths database should be adapted to the work envronment by studyng the traffc patterns that crculate along the network segment where the IDS s set up. One dsadvantage of ths method s the hgh processng tme consume. Ths can be reduced by speedng up the packets analyss [21]. In comparson wth ths method, the advantages of our novel neural IDS are the followng: t does not requre any prevous knowledge n the form of rules and t s able to detect unknown attacks day-0 ones. Further work wll be focused on the applcaton of GRID [22] computaton wth more complex data sets and the use of mult-agent dstrbuted systems.

6 References 1. Debar, H., Becker, M., Sbon, D.: A Neural Network Component for an Intruson Detecton System. IEEE Symposum on Research n Computer Securty and Prvacy (1992) 2. Corchado, E., Herrero, A., Baruque, B., Sáz, J.M.: Intruson Detecton System Based on a Cooperatve Topology Preservng Method. Internatonal Conference on Adaptve and Natural Computng Algorthms. Sprnger Computer Scence. SprngerWenNewYork (2005) 3. Hätönen, K., Höglund, A., Sorvar, A.: A Computer Host-Based User Anomaly Detecton System Usng the Self-Organzng Map. Internatonal Jont Conference of Neural Networks (2000) 4. Zanero, S., Savares, S.M.: Unsupervsed Learnng Technques for an Intruson Detecton System. ACM Symposum on Appled Computng (2004) Ghosh, A., Schwartzbard, A., Schatz, A.: Learnng Program Behavor Profles for Intruson Detecton. Workshop on Intruson Detecton and Network Montorng (1999) 6. Fredman, J., Tukey, J.: A Proecton Pursut Algorthm for Exploratory Data Analyss. IEEE Transacton on Computers 23 (1974) Hyvärnen, A.: Complexty Pursut: Separatng Interestng Components from Tme Seres. Neural Computaton 13 (2001) Corchado, E., MacDonald, D., Fyfe, C.: Maxmum and Mnmum Lkelhood Hebban Learnng for Exploratory Proecton Pursut. Data Mnng and Knowledge Dscovery. Kluwer Academc Publshng 8(3) (2004) Fyfe, C., Corchado, E.: Maxmum Lkelhood Hebban Rules. European Symposum on Artfcal Neural Networks (2002) 10. Corchado, E., Han, Y., Fyfe, C.: Structurng Global Responses of Local Flters usng Lateral Connectons. Journal of Expermental and Theoretcal Artfcal Intellgence 15(4) (2003) Corchado, E., Fyfe, C.: Connectonst Technques for the Identfcaton and Suppresson of Interferng Underlyng Factors. Internatonal Journal of Pattern Recognton and Artfcal Intellgence 17(8) (2003) Corchado, E., Corchado, J.M., Sáz, L., Lara, A.: Constructng a Global and Integral Model of Busness Management Usng a CBR System. 1st Internatonal Conference on Cooperatve Desgn, Vsualzaton and Engneerng (2004) 13. Herrero, A., Corchado, E., Sáz, J.M.: A Cooperatve Unsupervsed Connectonst Model Appled to Identfy Anomalous Massve SNMP Data Sendng. 1st Internatonal Conference on Natural Computaton (2005) ( In press ) 14. Herrero, A., Corchado, E., Sáz, J.M.: Identfcaton of Anomalous SNMP Stuatons Usng a Cooperatve Connectonst Exploratory Proecton Pursut Model. 6th Internatonal Conference on Intellgent Data Engneerng and Automated Learnng (2005) ( In press ) 15. Seung, H.S., Socc, N.D., Lee, D.: The Rectfed Gaussan Dstrbuton. Advances n Neural Informaton Processng Systems 10 (1998) Myerson, J.M.: Identfyng Enterprse Network Vulnerabltes. Internatonal Journal of Network Management 12 (2002) 18. Csco Secure Consultng: Vulnerablty Statstcs Report (2000) 19. Case, J., Fedor, M.S., Schoffstall, M.L., Davn, C.: Smple Network Management (SNMP). RFC-1157 (1990) 20. Oa, E.: Neural Networks, Prncpal Components and Subspaces. Internatonal Journal of Neural Systems 1 (1989) Aldwar, M., Conte, T., Franzon, P.: Confgurable strng matchng hardware for speedng up ntruson detecton. ACM SIGARCH Computer Archtecture News 33(1) (2005) 22. Foster, I., Kesselman, C.: The Grd: Blueprnt for a New Computng Infrastructure. 1 t edn. Morgan Kaufmann Publshers (1998)