Title :
NBA of obfuscated network vulnerabilities´ exploitation hidden into HTTPS traffic
Author :
Homoliak, Ivan ; Ovsonka, Daniel ; Gregr, Matej ; Hanacek, Petr
Author_Institution :
Dept. of Intell. Syst., BUT, Brno, Czech Republic
Abstract :
This paper examines the detection properties of obfuscated network buffer overflow attacks by selected IDS and NBA. The obfuscation was performed by tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of simulating the usual legitimate characteristics of the HTTP traffic´s flow. The buffer overflow vulnerabilities of four services were used: Samba, BadBlue, Apache, DCOM RPC. Exploitation was performed in a virtual network environment by using scenarios simulating real traffic´s conditions as well as legitimate traffic simulations which were performed. Captured data were examined by SNORT and by ASNM network features of the AIPS representing statistically and behaviorally based NBA. The achieved results show an obfuscated attacks transparency for SNORT detection and low detection performance of the AIPS trained by direct attacks and legitimate traffic only in contrast with high classification accuracy of the AIPS trained with an inclusion of obfuscated attacks. Data mining analysis was performed by using both bi-nominal and poly-nominal classifications, resulting into better performance of poly-nominal classification. At the summary, we emphasize the necessity of training the statistically and behaviorally based NBAs with divergent obfuscation techniques to strengthen their detection capabilities.
Keywords :
computer network security; data mining; pattern classification; telecommunication traffic; transport protocols; AIPS; ASNM network features; Apache; BadBlue; DCOM RPC; HTTP protocols; HTTP secure protocol; HTTPS protocols; HTTPS traffic; IDS; NBA; SNORT detection; SNORT network features; Samba; advanced security network metrics; automated intrusion prevention system; binominal classification; buffer overflow vulnerabilities; classification accuracy; data mining analysis; hyper text transfer protocol; legitimate traffic simulations; obfuscated network buffer overflow attacks detection properties; obfuscated network vulnerability exploitation; polynominal classification; virtual network environment; Buffer overflows; Data mining; Feature extraction; Internet; Logic gates; Protocols; Servers; IDS; NBA; buffer overflow; network vulnerabilities; protocol tunneling; traffic obfuscation;
Conference_Titel :
Internet Technology and Secured Transactions (ICITST), 2014 9th International Conference for
Conference_Location :
London
DOI :
10.1109/ICITST.2014.7038827