Sharif Digital Repository

Intrusion Detection System (IDS) is an equipment destined to provide computer networks security. In recent years, Machine Learning and Deep Neural Network (DNN) methods have been considered as a way to detect new network attacks. Due to the huge amounts of calculations needed for these methods, there is a need for high performance and parallel or specific processors, such as Application Specific Integrated Circuit (ASIC), Graphical Processor Unit (GPU) and Field-Programmable Gate Array (FPGA). The latter seems more suitable than others due to its higher configurability and lesser power consumption. The goal of this study is the acceleration of a DNN-based IDS on FPGA. In this study, which is... 

With the growing deployment of host and network intrusion detection systems, analyzing generated alerts from these systems becomes critically important and challenging due to its complexity and high amount of data. A perfect intrusion detection system would be able to identify all the attacks without raising any false and non-relevant alarms. Unfortunately, false alarms are commonplace in intrusion detection systems. Non-relevant alerts, which are associated with attacks that were not successful, are also common. The process of identifying false and non-relevant alerts is called alert verification. Also nowadays, web applications are widely used in critical and important roles (e.g.,... 

With the rapid growth of Internet popularity, web applications are growing in usage and complexity, and therefore, are attractive targets for attackers. Increasing number of services and amount of information stored in the Internet, stimulates attackers to focus on these kind of applications. On the other hand, security specialists are deploying different solutions to mitigate such threats. One of these solutions are Honeypot systems. In contrast with other security solutions, honeypots are not designed to defend against attackers directly. Honeypots, rather, are planned to gather data about what attackers do. This information can help security administrators to learn and understand... 

Web servers and web applications are susceptible to different attacks. In order to detect web-based attacks Intrusion detection systems (IDS) should be equipped with a large number of signatures. Unfortunately various types of web threats are increasingly growing and so detection and prevention of all these new and old attacks is exhaustive and really difficult.This thesis represents a designed system for intrusion detection that uses different techniques to discover vulnerabilities with derived patterns and also some user behavior based attacks against web applications. This was done by using new dataset which was generated by new log file.The primary objective of this thesis shows the... 

In this thesis we propose a two-layer hybrid fuzzy genetic algorithm for designing anomaly based an Intrusion Detection System. Our proposed algorithm is based on two basic Genetic Based Machine Learning Styles (i.e. Pittsburgh and Michigan). The Algorithm supports multiple attack classifications; it means that the algorithm is able to detect five classes of network patterns consisting of Denial of Service, Remote to Local, User to Root, Probing and Normal class.
Our proposed algorithm has two approaches. In the first approach we choose Pittsburgh style as the base of the algorithm that provides a global search. Then combine it with Michigan style to support local search. In this... 

Existing Intrusion Detection Systems (IDSs) are not designed to deal with all categories of processing environments. This thesis focuses on IDSs for the Grid computing environment, and concentrates on feature selection and performance. An existing framework, Globus, is used as the basis for the consideration and development of the research issue in Grid computing. The system is based on two engine designs: (a) Signature and (b) Support Vector Machine; SVM has been selected for pattern discovery in traffic analysis. We found that the performance of the system greatly depends on the efficiency of the underlying framework and the number of Intrusion Detection System instances. We demonstrate... 

Smart grids are the new generation of power grids that combine the power distribution grid with the communications network. The purpose of these networks is to create a secure, two-way infrastructure for the transmission of power and information. The complex structure of smart grids, along with the inherent vulnerabilities of physical systems, old devices and protocols on the network and the need for backward compatibility, have created serious cyber risks to critical assets and infrastructures. The difference between these types of networks and conventional computer networks has made the security mechanisms developed in conventional computer networks not very suitable for these types of... 

The rapid growth and increase in complexity of modern network and communication systems have made a demand for protecting organizations’ sensitive data and resources from malicious intrusions. Attackers and intruders perform malicious attacks by exploiting vulnerabilities, weaknesses, and flaws in computer systems using novel and advanced techniques. Traditional security mechanisms, such as authentication, access control, and firewall cannot prevent these attacks. Therefore, Intrusion detection systems (IDSs) are employed to detect abnormal activities and monitor network traffic and hosts’ events. These systems suffer from several limitations, including generating a huge amount of alerts and... 

SCADA controls, audits and accesses data but is only attributed for controlling and carrying out measurements on a large scale. In the SCADA, gathering of information starts from the PLC and after interpretation morphs into a format that can be shown to the user of the control room. In the SCADA system, many protocols are used to exchange information amongst logical controller units like DNP3, Profibus and Modbus. Many of the aforementioned protocols have been upgraded and are used in the Internet. The use in the Internet has led to vulnerability of SCADA from Internet hackers. Consequently, securing the SCADA system is essential for nationally sensitive structures. The goal of this thesis... 

Nowadays, by integrating the Internet of Things systems into the daily life of humans, mankind has created a platform for providing numerous and diverse services through which life has become much simpler and more convenient. These systems have gradually become an integral part of today's life. They are used in many areas of production and service provision, such as healthcare, agricultural industry, supply chain, education system, transportation, and many others. Although these achievements have facilitated human life in many aspects, they are also associated with many security risks. Intrusion detection systems (IDS) are methods for predicting possible damage (through security attacks such... 

Flash Crowd traffic generation can be used as a metrics for measuring the resiliency and performance of a server. Also, it can provide a framework for verification and test of Intrusion detection systems (IDS) and Intrusion protection systems (IPS). Common traffic generation methods mimic timing and content of input traffic or regenerate input traffic by extracting its statistic distribution. So all of them need input traffic, while properties of Flash Crowd are different in the various servers and situations and there is no guaranty in existence of such samples of traffic for all servers. In this thesis, we introduce and use a new method for traffic generation without the need for input... 

The growth of intelligent attacks has prompted the designers to envision the intrusion detection as a built-in process in operating systems. This thesis investigates a novel anomaly-based intrusion detection mechanism which utilizes the manner of interactions between users and kernel processes to bring functionality to this notion. In fact, this mechanism is inspired by homeostatic behavior of an organism. Homeostatic is the property of an open system or a closed system, particularly a living organism, which regulates its internal environment to maintain a stable, constant condition. Such a developed mechanism can provide the computer system with a high level of protection from artificial... 

Software Defined Networking (SDN) provides a logically centralized view of the state of the network, and as a result opens up new ways to manage and monitor networks. In this dissertation a novel approach to network intrusion detection in SDNs is introduced that takes advantage of these attributes. This approach can detect compromised routers that produce faulty messages, copy or steal traffic or maliciously drop certain types of packets. To identify these attacks and the affected switches, we correlate the forwarding state of network---i.e. installed forwarding rules---with the forwarding status of packets---i.e. the actual route packets take in the network and detect anomaly in routes.... 

Due to the rapid development of computer networks, security is a major concern. Methods of intruding computer networks are also rapidly developing, and there is a new method every day. These facts corroborate the need for new and more intelligent mechanisms for detecting intrusion. To detect intrusion, one must analyze the network traffic. The most used traditional methods of traffic separation are port-based and payload based detection. The former is not so efficient, and the latter is not only inefficient but also violates the privacy of users. Unsatisfied by such methods, researchers adopted machine learning techniques and tried to develop new solutions for detecting intrusion. Methods... 

Wireless Sensor Networks (WSNs) are rapidly emerging as an important area in mobile computing research. Applications of WSNs are numerous and growing, some of them are even highly critical, like military or safety applications. Security measures must be applied to protect the network from a variety of attacks. Since no intrusion prevention measure is perfect, intrusion detection becomes an important second wall to protect the network. WSNs have unique nature which is different from other kinds of networks. In this project, we examine the characteristics and vulnerabilities of WSNs and propose a new intrusion detection model to protect the network security. In this work we have not only... 

Today, with the development of technology, cyberattacks are on the rise. Personal and corporate computer systems can be exposed to various threats and dangers of hackers and malware, including information theft, forgery, and denial of service, which can cause great material and moral damage to individuals and organizations. So, it is necessary to take security measures in this regard. Many security mechanisms are available to prevent security vulnerabilities against various threats. In this study, first, after carefully studying network attacks, we identify the criteria for identifying attacks that can be executed in network traffic and explain how to calculate them. The current research... 

Intrusion detection systems’ test and evaluation is an active research area on which many researchers have been working for years. A complete and comprehensive test methodology that can be applied in reasonable time and cost is important and useful both to evaluate a newly designed system and to compare two or more existing systems to select an appropriate system for a particular network. In this research, we first determine the critical features of an IDS and then inspect methods and effective parameters that may influence the test process and propose a method for testing intrusion detection systems. In the proposed test methodology we only examine critical features which lake of them cause... 

The rapid advancement of information technology and computer networks raised concerns of the users and network administrators regarding security. The development of computer networks and the increase in the number of specialists in this field led to the increase in the number of people who seek to abuse these networks, people known as attackers. The attackers look for security defects in a network to penetrate and abuse it proportionate to their needs. Considering the risks of these attacks, it is necessary to have an intrusion detection system (IDS). IDSs are capable of detecting attack traffic or suspected traffic, then, they alert the network administrators, and consequently, stop the... 

Today, with the increasing expansion and development of computer networks and information technology, network security has become an important concern for experts and researchers in this field. One of the main elements in the field of information and network security are intrusion detection systems. To maintain the accuracy and quality of these systems, we need to test and evaluate them frequently. The datasets of intrusion detection systems are one of the main tools for evaluating these systems. The quality and accuracy of these systems in detecting anomalies and attacks in the network largely rely on rich and complete data. Also, the main component of this datasets is the traffic data,... 

High-quality online services demand reliable and fast packet delivery at the network layer. However, clear evidence documents the existence of compromised routers in the ISP and enterprise networks, threatening network availability and reliability. A compromised router can stealthily drop, modify, inject, or delay packets in the forwarding path to launch Denial-of-Service, surveillance, man-in-the-middle attacks, etc. So researches tried to create intrusion detection methods to identify adversarial routers and switches. To this end, data-plane fault localization (FL) aims to identify faulty links and is an effective means of achieving high network availability. FL protocols use...