Department Publications

The development of computer based systems expands the usage of computer based application in human life. It can be observed that illegal activities such as unauthorized data access, data theft, data modification and various other intrusion activities are rapidly growing during last decade. Hence, deployment and continuous improvement of Intrusion Detection Systems (IDS) are of paramount importance. Training, testing and evaluation of IDS with real network traffic is significant challenge, so most of IDS evaluation is based on intrusion datasets. Therefore, analysis of intrusion datasets are of paramount importance. In this paper, we evaluated Aegean Wi-Fi Intrusion Dataset (AWID) with different machine learning techniques. Feature reduction techniques such as Information Gain (IG) and Chi-Squared statistics (CH) were applied to evaluate dataset performance with feature reduction. Results of experiments show …

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Current intrusion prediction methods focus mainly on prediction of either intrusion type or intrusion category and do not use or provide contextual information such as source and target IP address. In addition most of them are dependant on domain knowledge and specific scenario knowledge. The proposed algorithm employs a bag-of-words model together with a hidden Markov model which not depend on specific domain knowledge. Since this algorithm depends on a training process it is adaptable to different conditions. A key advantage of the proposed algorithm is the inclusion of contextual data such as source IP address, destination IP range, alert type and alert category in its prediction, which is crucial for an eventual response. Experiments conducted using a public data set generated over 2500 alert predictions and achieved accuracy of 81% and 77% for single step and five step predictions respectively for prediction of the next alert cluster. It also achieved an accuracy of prediction of 95% and 92% for single step and five step predictions respectively for prediction of the next alert category. The proposed methods achieved a prediction accuracy improvement of 5% for alert category over existing variable length Markov chain intrusion prediction methods, while providing more information for a possible defense.

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Most of the existing intrusion prediction methods mainly focus on prediction of either intrusion type or intrusion category. Also, most of them are built based on domain knowledge and specific scenario knowledge. This thesis proposes an alert prediction framework which provides more detailed information than just the intrusion type or category to initiate possible defensive measures. The proposed algorithm is based on hidden Markov model and it does not depend on specific domain knowledge. Instead, it depends on a training process. Hence the proposed algorithm is adaptable to different conditions. Also, it is based on prediction of the next alert cluster, which contains source IP address, destination IP range, alert type and alert category. Hence …

Increasing demands for faster, more responsive and manageable networks have brought about a different approach to networking - Software Defined Networking (SDN). SDN introduces flow-based networking with a centralized controller. Matching incoming traffic flows with rules sent by the controller is an integral part of traffic forwarding in SDN. How efficiently this is carried out has a huge impact on network performance. In this paper, we present a high-performance, low-cost architecture for flow matching in an SDN switch. Our architecture consists of a dedicated unit for flow matching and a custom processor. Novel design of the flow match unit reduces matching latency significantly, when compared with the generic architecture, while also reducing usage of costly resources like TCAMs. When testing on FPGA platforms, implementing the system required only a minimum amount (around 10% on Virtex-7) of …

1.1 Background 1 1.2 Problem Statement 3 1.3 Proposed system 4 1.4 Objectives 4 1.5 Deliverables 4