Revisiting anomaly-based network intrusion detection systems
Damiano Bolzoni · 2009
Intrusion detection systems (IDSs) are well-known and widely-deployed security tools to detect cyber-attacks and malicious activities in computer systems and networks.A signature-based IDS works similar to anti-virus software.It employs a signature database of known attacks, and a successful match with current input raises an alert.A signature-based IDS cannot detect unknown attacks, either because the database is out of date or because no signature is available yet.To overcome this limitation, researchers have been developing anomaly-based IDSs.An anomaly-based IDS works by building a model of normal data/usage patterns during a training phase, then it compares new inputs to the model (using a similarity metric).A significant deviation is marked as an anomaly.An anomalybased IDS is able to detect previously unknown, or modifications of well-known, attacks as soon as they take place (i.e., so called zero-day attacks) and targeted attacks.Cyber-attacks and breaches of information security appear to be increasing in frequency and impact.Signature-based IDSs are likely to miss an increasingly number of attack attempts, as cyber-attacks diversify.Thus, one would expect a large number of anomaly-based IDSs to have been deployed to detect the newest disruptive attacks.However, most IDSs in use today are still signature-based, and few anomaly-based IDSs have been deployed in production environments.Up to now a signature-based IDS has been easier to implement and simpler to configure and maintain than an anomaly-based IDS, i.e., it is easier and less expensive to use.We see in these limitations the main reason why anomaly-based systems have not been widely deployed, despite research that has been conducted for more than a decade.To address these limitations we have developed SilentDefense, a comprehensive anomaly-based intrusion detection architecture that outperforms competitors not only in terms of attack detection and false alert rates, but it reduces the user vii lot of fun and I hope we will keep going on in the same way!(mai ipse dixit fu più azzeccato..."a giugno professore!" :)Emmanuele and I have been dreaming about starting up our own business since we were university students.It took us several years to have all of the ingredients, and we could not have done this without help and support from Sandro.SecurityMatters is the next big challenge for the three of us, and no matter what will happen next, we already proved to be a great team.Some very important people I had the pleasure to meet: Andreas, Anna, Daniel, Dimitrios, the DIES staff (including Marlous, Nicole and Thelma), i ragazzi del DSI, Dulce, Emma, Enrico (who kindly accepted to be a paranimf), il mio osteopata Fabio, Filippo e Francesca (e la piccola Violante), tutti i ragazzi (e non) del campo di San Giuliano, tutti i ragazzi (e non) dell'ufficio KPMG di Treviso (in particolare Rudy e Marco), Laura, Lianne, Luca, the Macandra