The article considers the methods that affect the operation of the intrusion detection system. Using the “disconnection task,” a two-stage criterion for detecting anomalies in computer networks has been formed, which provides an analysis of network infrastructure characteristics and their identification with specific computer attacks and provides the ability to respond to possible attacks in real-time.
Based on the annual rate of increase in the number of incidents in cyberspace, we can conclude that it is necessary to independently include in the integrated information security system critical infrastructure of automated means of detecting computer attacks and other dangerous divisions, including threats of man-made and natural (random) nature.
Modern Intrusion Detection Systems (IDS) to achieve information security goals
constantly monitor the functioning of hardware and software platforms of the network
infrastructure and record several quantitative and qualitative indicators of their work:
{X1(t), …, XN(t)}
(
Such indicators, in particular in the NIDES system [1], are: Ability to use the CPU separately by the system and the user. Time to complete the process. Total amount of memory used during the execution of the process and its maximum size during execution. Number of open files at runtime; the number of page failures. Amount of information read from the disk. Number of I/O characters during application execution. Username changed during the execution of the application. Start time of the application. Number of signals received during the execution of the application. Application was running on the remote station and the name of this station Name of the application that was used on the remote station. Application was running on the local station and the name of this station, the name of the application used on the local station, etc. 2
With this in mind, this article aims to build a model of intrusion detection system that would detect network anomalies in real-time and with the least error, as well as find answers to the following questions [2]: What happened online? What was attacked and how dangerous is the attack? When and where did the attack start? Who is the malefactor? How and as a result of what there was the invasion? Accordingly, the complexity of the attacking party’s tasks to create cryptographic software tools for attacks is significantly simplified, and the effectiveness of solving problems of recovery (decryption) of cryptosystem data, which are encrypted with software tools for attacks, has an objective tendency to constant decline from year to year. At the same time, there are such groups of threats related to reliability [3–5]: Cryptographic primitive programming errors. Errors in the use of cryptographic primitives in crypto providers. Errors in transferring parameters to the crypto provider and returning processing results. Errors in the failure of the hardware platform. Accidental and intentional violations of the integrity of programs and data of crypto providers.
These factors may be prerequisites for the formation of hidden channels of leakage of information about the operation of cryptographic software tools for attacks. Consider two options for attacks on the implementation of software tools for attacks that do not involve the presence of critical information about their work. 3
Premise 1. There is a certain cryptographic software tool for attacks (cryptosystem) with secret keys based on a stable block symmetric cryptographic algorithm, which provides encryption in output feedback (OFB) mode or otherwise tampering with feedback [6]. It is necessary: to build an attack on the implementation of the specified cryptosystem to ensure the possibility of partial or complete recovery of information (decryption).
This mode of operation of the crypto algorithm is widely used to build fully connected communication networks, in which each subscriber must send a message to any other subscriber of this network.
This mode is characterized by the presence of an initialization vector IV is random
number, which provides at an acceptable level the probability of not overlapping the
cipher in the case of using one key K for some time [6]. The idea of the attack on this
cryptosystem is to implement a fictitious random data generator of the crypto
algorithm, which is included instead of the real pseudorandom number generator, provides
a hidden repetition of initialization vectors or keys. As a result, some messages will
be encrypted in the same way:
(
In this case, depending on the number of equally encrypted messages and redundancy of the source texts of the messages, the corresponding encrypted messages can be partially or completely decrypted [7]. To repeat the initialization vectors IV the random bit generator should be used as follows:
IV 1, 2,..., k 1,2,...,b
(
To solve the problem, we first calculate the allowable number of random bits to provide the required number of repetitions of equally encrypted messages. Let in the network M subscribers, each of whom sends on average daily messages for each connection direction. With T is public key validity period (days). Then the average number of messages sent is the value: S~1 T1 Г j
~ ~ ... ... ... S~m j T~m j Г~j
M
N 2 T During the specified period, the average number of repetitions each of 2 the values of vectors of random bits 〈 1, 2, … , 〉 in the case of their even distribution will be: 2k
.
M k log 2 2 T log 2 R
Based on equation (
For example, in the case of a special network that includes M = 10 subscribers with an average intensity of sending messages during the validity of one network key ∙ = 10 to obtain the average number of repetitions of encryption = 2 it is necessary to have several random bits no more ≤ 7.
To hide statistical dependencies in vector IV and obtain the required number of bits in the corresponding expression as a function , you should use a stable hash function, such as MD5, which is part of the standard set of Windows algorithms, or similar. Thus from 128 bits of the digest which we receive using a hash function, we will use the necessary quantity.
Premise 2. Suppose that there is a software tool for implementing attacks (cryptosystem), built on a stable symmetric block cryptographic encryption algorithm in OFB mode using public key distribution based on the El Gamal protocol [6]. The task is to organize an attack on the implementation of the cryptosystem in such a way as to ensure complete decryption.
Initially, the operation of the cryptosystem in the El Gamal protocol using a cyclic
element g of some field and the secret key of the asymmetric algorithm x is formed
public key y:
y g x mod p
(
y1 g k mod p .
K yk mod p .
(
K y1x mod p .
(
Calculation of possible key variants K у in this case we carry out using
International Planned Parenthood Federation (IPPF) proceeding from the equation (
As a result, it should be noted that access to information of the “true” random data generator and methods of its substitution in each case depends on the hardware and software platforms on which the IPPF, the peculiarities of its implementation, the presence of an automated system of protection against unauthorized interference. her work, etc. To create a fictitious random number generator, it is possible to use a sequence of Mersenne numbers = 2 − 1, if is a simple number, also simple. 4
It is known that the efficiency of the IDS system significantly depends on the applied method of analysis of the original data. Currently, the following main methods are distinguished [1]: 1. Signature methods of analysis. 2. Statistical methods of analysis.
3. Hybrid methods of analysis with the function of self-learning. 4.1
Signature methods of analysis are based on the fact that most attacks and their scenarios are generally known. In this approach, the signatures of invasions determine the characteristics and conditions of the objects, the occurrence of events that are signs of attempted attacks (invasion), and their relationship. Of course, signature methods of analysis use intrusion signature databases that are supported by the security system. In this case, the order (sequence) of actions performed or initiated by the user or information process (program) is compared with known signatures. A sign of an attempted security breach may be partial compliance of the sequence of events with the signature.
Anti-virus scanners that work with a database of virus signatures are typical representatives which implement this idea. Their advantage is a fairly high speed of analysis. The effectiveness of signature methods of IDS can be increased through the use of methods of artificial intelligence. The advantages of statistical methods of analysis in IDS include: No need for a large amount of memory to store controlled variables. Ease of detecting deviations in the data characterizing the behavior of users and processes. Ability to analyze quantitative and qualitative data of different nature of origin as a parameter in the analysis. Disadvantages of statistical methods include difficulties in generating statistics of the normal behavior of users and processes. 4.2
Hybrid methods of analysis with the function of self-learning include: Teaching methods for the classification of examples. Neural networks. Genetic algorithms.
To achieve the goal set in the work, it is advisable to use statistical methods exactly. This allows, using the well-known “problem of disorder” [10]: to form a two-stage criterion for the detection of anomalies in computer networks, to overcome the connection of statistical methods to the model of usual (normal) users’ behavior.
Step 1. Let’s suppose that two complex hypotheses are considered concerning the
random sequence = { , ∈ , = ̅1̅,̅̅̅} under analysis: H0: the sequence X is
stationary with a single probability distribution function, H1: the sequence X is a
concatenation (the result of “gluing”) of two stationary random sequences with different
distribution functions:
= 1|| 2,
(
It is necessary to estimate the point of “gluing” n*. It is believed that the sequences
X1 and X2 differ in one of the two-dimensional distribution functions, namely, the
probability distribution of the vector ( , +2):
( 0, 1) = { ≤ 0, +2 ≤ 1}
(
It is known that the distribution function of a finite-dimensional random vector can be approximated uniformly with any accuracy to the probability distribution function of a random vector with a finite number of values. It follows that if we give the set R is a combination of a sufficiently large number of domains { , = ̅1̅,̅̅}, that do not intersect ∩ = ∅ for i ≠ j, then the vector ( , +2) can be approximated by a distribution vector with a finite number of values [11].
Therefore, if we are to enter new random sequences
= ( ∈ , +2 ∈ ), де 1 ≤ ≤ , 1 ≤ ≤ , where I(A) is an indicator of the set A, then at least in one of them there is a change in mathematical expectation.
Therefore, if we use an algorithm that detects a change in mathematical expectation, the same algorithm will detect a change in the distribution function. This fact allowed the work to be limited to the development of only one, a basic algorithm that can detect changes in the mathematical expectation. To do this, to identify moments of “disorders” a family of statistics of the form is proposed: to the moment 1∗ = ∗ − 2 including is equal to F1(u), and at ≥ 2∗ = ∗ + 1 is equal to F2(u), and (13) (14) (15) (16) ( , ) = [ (1 − )] ∙ [1 ∑ =1 −
1 −
∑ = +1 ], where 0 < ≤ 1, 1 ≤ ≤ − 1, = { , = ̅1̅,̅̅̅}} is the sequence under study.
The given family of statistics in the case of a fixed n is a generalized variant of Kolmogorov-Smirnov’s statistics, which is used to test hypotheses of coincidence or difference of distribution functions in two samples. The paper also proves that the statistics in the case of = 1 for
→ ∞ and maintaining the ratio between the volumes of “glued” implementations minimizes the maximum possible probability of error estimating the moment of “disorder” (minimax in order): {
max 1≤ ≤ −1
√ | ( , 1)| > (
) ) ≡ ( (
Step 2. Having fixed the level of probability “false alarm” about the disorder,
during the statistical processing of real data we determine the level of the threshold of
the first level C(
In the case of hypothesis Н1 on the representation of the original sequence of measurements in the form of the concatenation of several stationary random sequences with different probability distribution functions, we apply the criterion of the allowable number of triggers (“disorders”) Z. That is, we assume that the following equation takes place:
1 + 2 + … + = , де 2 ≤ < − 2.
For a small number of sequences, the Chebyshev inequality can be used to determine the boundary of the criterion if the random variable Z has a mathematical expectation and a standard deviation for a given > 0: {| − | ≥ } ≤ {| − | ≥ } ≤ 2 2 4 9 2 If Z is a random variable with a single-mode probability distribution with a mathematical expectation and a standard deviation of 0 < < ∞, then for any > √8⁄3 ≈ 1.63299, there is a Vysochansky-Petunin inequality, which improves the estimation of the deviation probability: In particular, for a typical deviation of 3σ (three sigmas), the significance level of the criterion is the probability of “false alarm” is calculated as [13]: (17) (18) (19) (20) (21) (22) (23) (24) 4 = 9 2 ≈ 0.0494.
= 1 + 2 + … + .
A more accurate result can be obtained for the case of a random variable Z, which is
the sum of a sufficiently large number of independent random variables (
→ ∞):
According to the integral limit theorem, the probability of deviation can be
approximated by the normal probability distribution function (
{| − | ≥ 1− } = 1 √2 ∫−∞1− exp(− 2) .
2
Based on (
Thus, the algorithm for calculating the criterion includes the following steps (Fig. 1).
It is possible to see that the complexity of the algorithm that implements the proposed criterion is estimated by the value of O(N). Thus, its implementation on the principle of the “sliding window” will not cause a significant load on the computer system.
The most difficult issue for the implementation of the method of detecting anomalies, as in other statistical methods, is the formation of regular behavior of the network infrastructure and its users. 5
In this regard, of particular interest are modern technologies that increase the efficiency of classical decryption methods [6], which using vulnerabilities in a particular cryptographic algorithm and/or protocol provide recovery of the secret key used to create encrypted messages, and/or disclosing the original value of the encrypted information. Thus recovery of the initial information can be full or partial therefore speak about full or partial decryption.
A two-level statistical criterion for detecting anomalies based on measurements of network infrastructure characteristics is proposed, which provides the possibility of their further analysis to identify them with certain computer attacks. The application of the criterion does not require significant computing resources and provides an opportunity to respond to possible attacks in almost real-time.