NIDS Signatures Paper Appeared at Oakland 2005

Posted 20 May 2005

The paper Language-Based Generation and Evaluation of NIDS Signatures by Shai Rubin, Somesh Jha, and Barton P. Miller appeared at the 2005 IEEE Symposium on Security and Privacy. The conference was held May 8–11 in Oakland, California. Shai presented the paper at the conference.

The authors presented a methodology to automatically construct robust signatures whose accuracy is based on formal reasoning so it can be systematically evaluated. Two formal languages describe different properties of a given attack. The first language, called a session signature, describes temporal relations between the attack events. The second, called an attack invariant, describes semantic properties that hold in any instance of the attack. For example, an invariant may state that a given FTP attack must include a successful FTP login and can be launched only after the FTP representation mode has been set to ASCII. The authors iteratively eliminated false positives and negatives from an initial session signature by comparing the signature language to the language of the invariant.

The authors developed GARD, a tool for session-signature construction, and used it to construct session signatures for multi-step attacks. They showed that a session signature is more accurate than existing signatures.

The paper is available online: [Abstract] [pdf] [ps]

<< Back to index

This page updated October 18, 2005.