NIDS Signatures Paper Appeared at Oakland 2005
Posted 20 May 2005
The paper Language-Based Generation and Evaluation of NIDS
Signatures by Shai Rubin, Somesh Jha, and Barton P. Miller
appeared at the 2005 IEEE Symposium on Security and Privacy. The
conference was held May 8–11 in Oakland, California. Shai
presented the paper at the conference.
The authors presented a methodology to automatically construct robust signatures whose accuracy is based on formal reasoning so it can be systematically evaluated. Two formal languages describe different properties of a given attack. The first language, called a session signature, describes temporal relations between the attack events. The second, called an attack invariant, describes semantic properties that hold in any instance of the attack. For example, an invariant may state that a given FTP attack must include a successful FTP login and can be launched only after the FTP representation mode has been set to ASCII. The authors iteratively eliminated false positives and negatives from an initial session signature by comparing the signature language to the language of the invariant.
The authors developed GARD, a tool for session-signature construction, and used it to construct session signatures for multi-step attacks. They showed that a session signature is more accurate than existing signatures.
