NDLI: On the completeness of attack mutation algorithms

Content Provider	IEEE Xplore Digital Library
Author	Rubin, S. Jha, S. Miller, B.P.
Copyright Year	2006
Description	Author affiliation: Dept. of Comput. Sci., Wisconsin Univ., Madison, WI (Rubin, S.; Jha, S.; Miller, B.P.)
Abstract	An attack mutation algorithm takes a known instance of an attack and transforms it into many distinct instances by repeatedly applying attack transformations. Such algorithms are widely used for testing intrusion detection systems. We investigate the notion of completeness of a mutation algorithm: its capability to generate all possible attack instances from a given set of attack transformations. We define the notion of a Phi-complete mutation algorithm. Given a set of transformations Phi, an algorithm is complete with respect to Phi, if it can generate every instance that the transformations in Phi derive. We show that if the rules in Phi are uniform and reversible then a Phi-complete algorithm exists. Intuitively speaking, uniform and reversible transformations mean that we can first exclusively apply transformations that simplify the attack, then exclusively apply transformations that complicate it, and still get all possible instances that are derived by the rules in Phi. Although uniformity and reversibility may appear severe restrictions, we show that common attack transformations are indeed uniform and reversible. Therefore, our Phi-complete algorithm can be incorporated into existing testing tools for intrusion detection systems. Furthermore, we show that a Phi-complete algorithm is useful, not only for testing purposes, but also for determining whether two packet traces are two different mutations of the same attack
Sponsorship	IEEE Comput. Soc. Tech. Comm. on Security and Privacy
Starting Page	14
Ending Page	56
File Size	408892
Page Count	43
File Format	PDF
ISBN	0769526152
ISSN	10636900
DOI	10.1109/CSFW.2006.21
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2006-07-05
Publisher Place	Italy
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Genetic mutations Intrusion detection System testing Uniform resource locators Encoding Pattern matching TCPIP Feeds Computer security Conferences
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Comparison of stringmatching algorithms: an aid to information content security

Automatic generation and analysis of NIDS attacks

Intrusion Detection Algorithm of Artificial Immune Based on Decision Tree and Genetic Algorithm

WebVaccine: A Client-Side Realtime Prevention System against Obfuscated Malicious Web Pages

Towards Improving Web Attack Detection: Highlighting the Significant Factors

Research of NIDS in IPV6 Based on Protocol Analysis and Pattern Matching

Comparison of Pattern Matching Techniques for Host Based Intrusion Detection System

A review of intrusion detection method based on automatic pattern matching (2012).

Shades of grey: On the effectiveness of reputation-based “blacklists”

On the completeness of attack mutation algorithms

Similar Documents

Comparison of stringmatching algorithms: an aid to information content security

Automatic generation and analysis of NIDS attacks

Intrusion Detection Algorithm of Artificial Immune Based on Decision Tree and Genetic Algorithm

WebVaccine: A Client-Side Realtime Prevention System against Obfuscated Malicious Web Pages

Towards Improving Web Attack Detection: Highlighting the Significant Factors

Research of NIDS in IPV6 Based on Protocol Analysis and Pattern Matching

Comparison of Pattern Matching Techniques for Host Based Intrusion Detection System

A review of intrusion detection method based on automatic pattern matching (2012).

Shades of grey: On the effectiveness of reputation-based “blacklists”

On the completeness of attack mutation algorithms