Sharif Digital Repository

Today, with the development of technology, cyberattacks are on the rise. Personal and corporate computer systems can be exposed to various threats and dangers of hackers and malware, including information theft, forgery, and denial of service, which can cause great material and moral damage to individuals and organizations. So, it is necessary to take security measures in this regard. Many security mechanisms are available to prevent security vulnerabilities against various threats. In this study, first, after carefully studying network attacks, we identify the criteria for identifying attacks that can be executed in network traffic and explain how to calculate them. The current research... 

Flash Crowd traffic generation can be used as a metrics for measuring the resiliency and performance of a server. Also, it can provide a framework for verification and test of Intrusion detection systems (IDS) and Intrusion protection systems (IPS). Common traffic generation methods mimic timing and content of input traffic or regenerate input traffic by extracting its statistic distribution. So all of them need input traffic, while properties of Flash Crowd are different in the various servers and situations and there is no guaranty in existence of such samples of traffic for all servers. In this thesis, we introduce and use a new method for traffic generation without the need for input... 

In this thesis we propose a two-layer hybrid fuzzy genetic algorithm for designing anomaly based an Intrusion Detection System. Our proposed algorithm is based on two basic Genetic Based Machine Learning Styles (i.e. Pittsburgh and Michigan). The Algorithm supports multiple attack classifications; it means that the algorithm is able to detect five classes of network patterns consisting of Denial of Service, Remote to Local, User to Root, Probing and Normal class.
Our proposed algorithm has two approaches. In the first approach we choose Pittsburgh style as the base of the algorithm that provides a global search. Then combine it with Michigan style to support local search. In this... 

Web servers and web applications are susceptible to different attacks. In order to detect web-based attacks Intrusion detection systems (IDS) should be equipped with a large number of signatures. Unfortunately various types of web threats are increasingly growing and so detection and prevention of all these new and old attacks is exhaustive and really difficult.This thesis represents a designed system for intrusion detection that uses different techniques to discover vulnerabilities with derived patterns and also some user behavior based attacks against web applications. This was done by using new dataset which was generated by new log file.The primary objective of this thesis shows the... 

While intrusion detection systems (IDSs) are widely used, large number of alerts as well as high rate of false positive events make such a security mechanism insufficient. Accordingly, a track of recent security research, focused on alert correlation. This thesis proposes a Hidden Markov Model (HMM) based correlation method of intrusion alerts which have been fired from different IDS sensors across an enterprise. We used HMM to predict the next attack class of the intruder that is also known as plan recognition. Our method has two advantages. Firstly, it does not require any usage or modeling of network topology, system vulnerabilities, and system configurations. Secondly, as we perform high... 

Wireless Sensor Networks (WSNs) are rapidly emerging as an important area in mobile computing research. Applications of WSNs are numerous and growing, some of them are even highly critical, like military or safety applications. Security measures must be applied to protect the network from a variety of attacks. Since no intrusion prevention measure is perfect, intrusion detection becomes an important second wall to protect the network. WSNs have unique nature which is different from other kinds of networks. In this project, we examine the characteristics and vulnerabilities of WSNs and propose a new intrusion detection model to protect the network security. In this work we have not only... 

Existing Intrusion Detection Systems (IDSs) are not designed to deal with all categories of processing environments. This thesis focuses on IDSs for the Grid computing environment, and concentrates on feature selection and performance. An existing framework, Globus, is used as the basis for the consideration and development of the research issue in Grid computing. The system is based on two engine designs: (a) Signature and (b) Support Vector Machine; SVM has been selected for pattern discovery in traffic analysis. We found that the performance of the system greatly depends on the efficiency of the underlying framework and the number of Intrusion Detection System instances. We demonstrate... 

The growth of intelligent attacks has prompted the designers to envision the intrusion detection as a built-in process in operating systems. This thesis investigates a novel anomaly-based intrusion detection mechanism which utilizes the manner of interactions between users and kernel processes to bring functionality to this notion. In fact, this mechanism is inspired by homeostatic behavior of an organism. Homeostatic is the property of an open system or a closed system, particularly a living organism, which regulates its internal environment to maintain a stable, constant condition. Such a developed mechanism can provide the computer system with a high level of protection from artificial... 

We live in the cyber era in which network-based technologies have become omnipresent. Meanwhile, threats and attacks are rapidly growing in cyberspace. Nowadays, some signature-based intrusion detection systems try to detect these malicious traffics. However, as new vulnerabilities and new zero-day attacks appear, there is a growing risk of bypassing the current intrusion detection systems. Many research studies have worked on machine learning algorithms for intrusion detection applications. Their major weakness is to consider the different aspects of network security concurrently. For example, continuous concept drift in normal and abnormal traffic, the permanent appearance of zero-day... 

Today, with the increasing expansion and development of computer networks and information technology, network security has become an important concern for experts and researchers in this field. One of the main elements in the field of information and network security are intrusion detection systems. To maintain the accuracy and quality of these systems, we need to test and evaluate them frequently. The datasets of intrusion detection systems are one of the main tools for evaluating these systems. The quality and accuracy of these systems in detecting anomalies and attacks in the network largely rely on rich and complete data. Also, the main component of this datasets is the traffic data,... 

The rapid advancement of information technology and computer networks raised concerns of the users and network administrators regarding security. The development of computer networks and the increase in the number of specialists in this field led to the increase in the number of people who seek to abuse these networks, people known as attackers. The attackers look for security defects in a network to penetrate and abuse it proportionate to their needs. Considering the risks of these attacks, it is necessary to have an intrusion detection system (IDS). IDSs are capable of detecting attack traffic or suspected traffic, then, they alert the network administrators, and consequently, stop the... 

Intrusion Detection System (IDS) is an equipment destined to provide computer networks security. In recent years, Machine Learning and Deep Neural Network (DNN) methods have been considered as a way to detect new network attacks. Due to the huge amounts of calculations needed for these methods, there is a need for high performance and parallel or specific processors, such as Application Specific Integrated Circuit (ASIC), Graphical Processor Unit (GPU) and Field-Programmable Gate Array (FPGA). The latter seems more suitable than others due to its higher configurability and lesser power consumption. The goal of this study is the acceleration of a DNN-based IDS on FPGA. In this study, which is... 

Due to the rapid development of computer networks, security is a major concern. Methods of intruding computer networks are also rapidly developing, and there is a new method every day. These facts corroborate the need for new and more intelligent mechanisms for detecting intrusion. To detect intrusion, one must analyze the network traffic. The most used traditional methods of traffic separation are port-based and payload based detection. The former is not so efficient, and the latter is not only inefficient but also violates the privacy of users. Unsatisfied by such methods, researchers adopted machine learning techniques and tried to develop new solutions for detecting intrusion. Methods... 

Smart grids are the new generation of power grids that combine the power distribution grid with the communications network. The purpose of these networks is to create a secure, two-way infrastructure for the transmission of power and information. The complex structure of smart grids, along with the inherent vulnerabilities of physical systems, old devices and protocols on the network and the need for backward compatibility, have created serious cyber risks to critical assets and infrastructures. The difference between these types of networks and conventional computer networks has made the security mechanisms developed in conventional computer networks not very suitable for these types of... 

The rapid growth of computer networks has increased the importance of analytics and traffic analysis tools for these networks, and the increasing importance of these networks has increased the importance of security of these networks and the intrusion detection in these networks. Many studies aimed at providing a powerful way to quickly and accurately detect computer network intrusions, each of which has addressed this issue.The common point of all these methods is their reliance on the features extracted from network traffic by an expert. This strong dependence has prevented these methods from being flexible against new attacks and methods of intrusion or changes in the current normal... 

Intrusion detection systems’ test and evaluation is an active research area on which many researchers have been working for years. A complete and comprehensive test methodology that can be applied in reasonable time and cost is important and useful both to evaluate a newly designed system and to compare two or more existing systems to select an appropriate system for a particular network. In this research, we first determine the critical features of an IDS and then inspect methods and effective parameters that may influence the test process and propose a method for testing intrusion detection systems. In the proposed test methodology we only examine critical features which lake of them cause... 

With the growing deployment of host and network intrusion detection systems, analyzing generated alerts from these systems becomes critically important and challenging due to its complexity and high amount of data. A perfect intrusion detection system would be able to identify all the attacks without raising any false and non-relevant alarms. Unfortunately, false alarms are commonplace in intrusion detection systems. Non-relevant alerts, which are associated with attacks that were not successful, are also common. The process of identifying false and non-relevant alerts is called alert verification. Also nowadays, web applications are widely used in critical and important roles (e.g.,... 

The rapid growth and increase in complexity of modern network and communication systems have made a demand for protecting organizations’ sensitive data and resources from malicious intrusions. Attackers and intruders perform malicious attacks by exploiting vulnerabilities, weaknesses, and flaws in computer systems using novel and advanced techniques. Traditional security mechanisms, such as authentication, access control, and firewall cannot prevent these attacks. Therefore, Intrusion detection systems (IDSs) are employed to detect abnormal activities and monitor network traffic and hosts’ events. These systems suffer from several limitations, including generating a huge amount of alerts and... 

SCADA controls, audits and accesses data but is only attributed for controlling and carrying out measurements on a large scale. In the SCADA, gathering of information starts from the PLC and after interpretation morphs into a format that can be shown to the user of the control room. In the SCADA system, many protocols are used to exchange information amongst logical controller units like DNP3, Profibus and Modbus. Many of the aforementioned protocols have been upgraded and are used in the Internet. The use in the Internet has led to vulnerability of SCADA from Internet hackers. Consequently, securing the SCADA system is essential for nationally sensitive structures. The goal of this thesis... 

SQL injection is one of the most important security threats in web applications with backend SQLbased database. An attacker can abuse an application’s vulnerability to change the queries sent from the application to the database. Many techniques and frameworks have been proposed for detecting and preventing SQL injection. But most of them cannot detect all types of SQL injection such as second-order attacks. In this thesis, we propose a new method to detect and prevent all types of this attack. The proposed method is a kind of anomaly-based intrusion detection methods and could be considered as a proxy between the application server and the database server. The proposed method, can detect...