Sharif Digital Repository

Existing Intrusion Detection Systems (IDSs) are not designed to deal with all categories of processing environments. This thesis focuses on IDSs for the Grid computing environment, and concentrates on feature selection and performance. An existing framework, Globus, is used as the basis for the consideration and development of the research issue in Grid computing. The system is based on two engine designs: (a) Signature and (b) Support Vector Machine; SVM has been selected for pattern discovery in traffic analysis. We found that the performance of the system greatly depends on the efficiency of the underlying framework and the number of Intrusion Detection System instances. We demonstrate... 

In the last decade, Intrusion Detection Systems has attracted attention due to their importance in network security, but still they've shortcomings. Generating a lot of low level alerts is the main problem. Many of these alerts are actually false positives. One suggested solution is Alert Correlation Analysis. Because of false positives alert correlation techniques are not able to build accurate scenarios, but the accuracy of alerts can be verified with the aid of the information logged in the host systems. In this dissertation after surveying the current alert correlation techniques, a model will be introduced to effectively verify the generated alerts and to apply correlation techniques to... 

A Mobile Ad hoc NETwork (MANET) is a self-configuring network that is formed automatically by a collection of mobile nodes without the help of a fixed infrastructure or centralized management. In recent years, the use of MANETs has been widespread in many applications, including some mission critical applications, and as such security has become one of the major concerns in MANETs. Due to some unique characteristics of MANETs, prevention methods alone are not sufficient to make them secure; therefore, detection should be added as another defense before an attacker can breach the system. In this thesis, we have expressed some well-known and related intrusion detection systems. Besides we have... 

In recent decades, Securing mobile ad hoc networks has attracted much attention. Today, several security tools, such as intrusion detection systems are used in the network. Methods based IDS works on pattern recognition and anomaly detection are divided into two categories. Pattern recognition methods based on known attack patterns work with high detection rate, but do not have the ability to detect new attacks. Anomaly detection techniques have the ability to detect new attacks, but they have high false alarm rate.
In this thesis, an anomaly detection system based on artificial immune designed, implemented and evaluated.For example, an anomaly detection methods such cases, a variety of... 

Wireless technology can now be seen almost everywhere. This technology has recently become very popular, and with the convenience that comes with its use, it will probably be the most commonly used technology among computer networks in the near future. Unfortunately, new technology is always under fire when it comes to security.So that this type of network security has become a big challenge for them.
The researchers approach to security in wireless networks that have a lot of attention is the use of intrusion detection systems. An intrusion detection system (IDS) monitors network traffic and monitors for suspicious activity and alerts the system or network administrator. In some cases... 

Blackhole and grayhole attacks have been become two of the major security concerns in mobile ad hoc networks (MANET). To achieve security in MANETs, a lot of mechanisms had been proposed by now. Using intrusion detection systems(IDSs) is one of the important mechanism to reach this goal. Thus, a well-known IDS was chosen and analyzed in this thesis. Furthermore, a collaborative bayesian filter approach for this intrusion detection system was proposed to enhance its performance. Then the performance of this approach was considered. This intrusion detection system was analyzed using stochastic modeling like continuous time markov chain(CTMC), stochastic reward net(SRN) and stochastic... 

Mobile ad hoc networks (MANETs) have been attracting the attention of the researchers in the duration of last years. Because of lack of infrastructure in such networks, all network operations such as routing are done by the nodes themselves. On the other hand, standard MANETs' routing protocols suppose that all nodes are trusted. Thus, these protocols are prone to serious security attack. Wormhole attack is one of the attacks which abuse distributed routing in MANETs. This attack is held between two malicious nodes which are far away from each other. Mentioned nodes introduce themselves as one-hop neighbor of each other. Therefore, they deceive normal nodes and disturb the routing mechanism.... 

The rapid growth and increase in complexity of modern network and communication systems have made a demand for protecting organizations’ sensitive data and resources from malicious intrusions. Attackers and intruders perform malicious attacks by exploiting vulnerabilities, weaknesses, and flaws in computer systems using novel and advanced techniques. Traditional security mechanisms, such as authentication, access control, and firewall cannot prevent these attacks. Therefore, Intrusion detection systems (IDSs) are employed to detect abnormal activities and monitor network traffic and hosts’ events. These systems suffer from several limitations, including generating a huge amount of alerts and... 

Intrusion Detection Systems (IDSs) are among the mostly used security tools in computer networks. While they are promising technologies, they pose some serious drawbacks: When utilized in large and high traffic networks, IDSs generate high volumes of low level alerts which are hardly manageable. In addition, IDSs usually generate redundant or even irrelevant (false) alerts. One technique proposed to circumvent such drawbacks is alert correlation, which extracts useful and high-level alerts, and helps in making timely decisions when a security breach occurs. This thesis will survey current alert correlation techniques, and introduces a real-time and data-mining–based algorithm for alert... 

Wireless Sensor Networks (WSNs) are rapidly emerging as an important area in mobile computing research. Applications of WSNs are numerous and growing, some of them are even highly critical, like military or safety applications. Security measures must be applied to protect the network from a variety of attacks. Since no intrusion prevention measure is perfect, intrusion detection becomes an important second wall to protect the network. WSNs have unique nature which is different from other kinds of networks. In this project, we examine the characteristics and vulnerabilities of WSNs and propose a new intrusion detection model to protect the network security. In this work we have not only... 

In this thesis we propose a two-layer hybrid fuzzy genetic algorithm for designing anomaly based an Intrusion Detection System. Our proposed algorithm is based on two basic Genetic Based Machine Learning Styles (i.e. Pittsburgh and Michigan). The Algorithm supports multiple attack classifications; it means that the algorithm is able to detect five classes of network patterns consisting of Denial of Service, Remote to Local, User to Root, Probing and Normal class.
Our proposed algorithm has two approaches. In the first approach we choose Pittsburgh style as the base of the algorithm that provides a global search. Then combine it with Michigan style to support local search. In this... 

High-quality online services demand reliable and fast packet delivery at the network layer. However, clear evidence documents the existence of compromised routers in the ISP and enterprise networks, threatening network availability and reliability. A compromised router can stealthily drop, modify, inject, or delay packets in the forwarding path to launch Denial-of-Service, surveillance, man-in-the-middle attacks, etc. So researches tried to create intrusion detection methods to identify adversarial routers and switches. To this end, data-plane fault localization (FL) aims to identify faulty links and is an effective means of achieving high network availability. FL protocols use... 

Intrusion detection systems’ test and evaluation is an active research area on which many researchers have been working for years. A complete and comprehensive test methodology that can be applied in reasonable time and cost is important and useful both to evaluate a newly designed system and to compare two or more existing systems to select an appropriate system for a particular network. In this research, we first determine the critical features of an IDS and then inspect methods and effective parameters that may influence the test process and propose a method for testing intrusion detection systems. In the proposed test methodology we only examine critical features which lake of them cause... 

SQL injection is one of the most important security threats in web applications with backend SQLbased database. An attacker can abuse an application’s vulnerability to change the queries sent from the application to the database. Many techniques and frameworks have been proposed for detecting and preventing SQL injection. But most of them cannot detect all types of SQL injection such as second-order attacks. In this thesis, we propose a new method to detect and prevent all types of this attack. The proposed method is a kind of anomaly-based intrusion detection methods and could be considered as a proxy between the application server and the database server. The proposed method, can detect... 

Flash Crowd traffic generation can be used as a metrics for measuring the resiliency and performance of a server. Also, it can provide a framework for verification and test of Intrusion detection systems (IDS) and Intrusion protection systems (IPS). Common traffic generation methods mimic timing and content of input traffic or regenerate input traffic by extracting its statistic distribution. So all of them need input traffic, while properties of Flash Crowd are different in the various servers and situations and there is no guaranty in existence of such samples of traffic for all servers. In this thesis, we introduce and use a new method for traffic generation without the need for input... 

The growth of intelligent attacks has prompted the designers to envision the intrusion detection as a built-in process in operating systems. This thesis investigates a novel anomaly-based intrusion detection mechanism which utilizes the manner of interactions between users and kernel processes to bring functionality to this notion. In fact, this mechanism is inspired by homeostatic behavior of an organism. Homeostatic is the property of an open system or a closed system, particularly a living organism, which regulates its internal environment to maintain a stable, constant condition. Such a developed mechanism can provide the computer system with a high level of protection from artificial... 

SCADA controls, audits and accesses data but is only attributed for controlling and carrying out measurements on a large scale. In the SCADA, gathering of information starts from the PLC and after interpretation morphs into a format that can be shown to the user of the control room. In the SCADA system, many protocols are used to exchange information amongst logical controller units like DNP3, Profibus and Modbus. Many of the aforementioned protocols have been upgraded and are used in the Internet. The use in the Internet has led to vulnerability of SCADA from Internet hackers. Consequently, securing the SCADA system is essential for nationally sensitive structures. The goal of this thesis... 

With the rapid growth of Internet popularity, web applications are growing in usage and complexity, and therefore, are attractive targets for attackers. Increasing number of services and amount of information stored in the Internet, stimulates attackers to focus on these kind of applications. On the other hand, security specialists are deploying different solutions to mitigate such threats. One of these solutions are Honeypot systems. In contrast with other security solutions, honeypots are not designed to defend against attackers directly. Honeypots, rather, are planned to gather data about what attackers do. This information can help security administrators to learn and understand... 

While intrusion detection systems (IDSs) are widely used, large number of alerts as well as high rate of false positive events make such a security mechanism insufficient. Accordingly, a track of recent security research, focused on alert correlation. This thesis proposes a Hidden Markov Model (HMM) based correlation method of intrusion alerts which have been fired from different IDS sensors across an enterprise. We used HMM to predict the next attack class of the intruder that is also known as plan recognition. Our method has two advantages. Firstly, it does not require any usage or modeling of network topology, system vulnerabilities, and system configurations. Secondly, as we perform high... 

With the growing deployment of host and network intrusion detection systems, analyzing generated alerts from these systems becomes critically important and challenging due to its complexity and high amount of data. A perfect intrusion detection system would be able to identify all the attacks without raising any false and non-relevant alarms. Unfortunately, false alarms are commonplace in intrusion detection systems. Non-relevant alerts, which are associated with attacks that were not successful, are also common. The process of identifying false and non-relevant alerts is called alert verification. Also nowadays, web applications are widely used in critical and important roles (e.g.,...